diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index dfac1395dff8..6777523cc289 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -2963,7 +2963,10 @@ nsHTMLInputElement::VisitGroup(nsIRadioVisitor* aVisitor, PRBool aFlushContent)
 PRBool
 nsHTMLInputElement::IsTooLong()
 {
-  // TODO: return PR_FALSE if dirty value flag is TRUE, see bug 549475.
+  if (!GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
+    return PR_FALSE;
+  }
+
   PRInt32 maxLength = -1;
   PRInt32 textLength = -1;
 
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index 7213f2b44299..c33c166c7330 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -1049,6 +1049,10 @@ nsHTMLTextAreaElement::CopyInnerTo(nsGenericElement* aDest) const
 PRBool
 nsHTMLTextAreaElement::IsTooLong()
 {
+  if (!mValueChanged) {
+    return PR_FALSE;
+  }
+
   PRInt32 maxLength = -1;
   PRInt32 textLength = -1;
 
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 121eb217dba4..65a54b108a73 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -193,6 +193,7 @@ _TEST_FILES = \
 		test_bug585508.html \
 		test_bug345624-1.html \
 		test_bug345624-2.html \
+		test_bug561640.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/content/html/content/test/test_bug561640.html b/content/html/content/test/test_bug561640.html
new file mode 100644
index 000000000000..938ceb7f1f0e
--- /dev/null
+++ b/content/html/content/test/test_bug561640.html
@@ -0,0 +1,64 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=561640
+-->
+<head>
+  <title>Test for Bug 561640</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=561640">Mozilla Bug 561640</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 561640 **/
+
+var elements = [ 'input', 'textarea' ];
+var content = document.getElementById('content');
+
+function checkValid(elmt)
+{
+  ok(!elmt.validity.tooLong, "element should not be too long");
+}
+
+function checkInvalid(elmt)
+{
+  ok(elmt.validity.tooLong, "element should be too long");
+}
+
+for each (var elmtName in elements) {
+  var elmt = document.createElement(elmtName);
+  content.appendChild(elmt);
+
+  if (elmtName == 'textarea') {
+    elmt.textContent = 'foo';
+  } else {
+    elmt.setAttribute('value', 'foo');
+  }
+  elmt.maxLength = 2;
+  checkValid(elmt);
+
+  elmt.value = 'a';
+  checkValid(elmt);
+
+  if (elmtName == 'textarea') {
+    elmt.textContent = 'f';
+  } else {
+    elmt.setAttribute('value', 'f');
+  }
+  elmt.value = 'bar';
+  checkInvalid(elmt);
+
+  content.removeChild(elmt);
+}
+
+</script>
+</pre>
+</body>
+</html>
