Bug 239373. Assertion in nsGenericElement.cpp, the toolkit part. r=mconnor

toolkit/content/widgets/textbox.xml

@@ -91,12 +91,22 @@
         </body>
       </method>
 
-      <constructor action="var str = this.boxObject.getProperty('value'); 
-                                                if (str) {
-                                                  this.inputField.value=str;
-                                                  this.boxObject.removeProperty('value');
-                                                }"/>
-      <destructor action="if (this.inputField.value) this.boxObject.setProperty('value', this.inputField.value);"/>
+      <constructor>
+        <![CDATA[
+          var str = this.boxObject.getProperty('value'); 
+          if (str) {
+            this.inputField.value = str;
+            this.boxObject.removeProperty('value');
+          }
+        ]]>
+      </constructor>
+      <destructor>
+        <![CDATA[
+          if (this.inputField.value) 
+            this.boxObject.setProperty('value', this.inputField.value);
+          this.mInputField = null;
+        ]]>
+      </destructor>
    
     </implementation>