diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index 033da4cd1fd..fa96e2ead6f 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1636,7 +1636,7 @@ nsTextEditorState::GetMaxLength(PRInt32* aMaxLength)
 void
 nsTextEditorState::GetValue(nsAString& aValue, PRBool aIgnoreWrap) const
 {
-  if (mEditor && mBoundFrame) {
+  if (mEditor && mBoundFrame && (mEditorInitialized || !IsSingleLineTextControl())) {
     PRBool canCache = aIgnoreWrap && !IsSingleLineTextControl();
     if (canCache && !mCachedValue.IsEmpty()) {
       aValue = mCachedValue;
@@ -1713,8 +1713,22 @@ nsTextEditorState::SetValue(const nsAString& aValue, PRBool aUserInput)
       mBoundFrame->SetFireChangeEventState(PR_TRUE);
     }
 
+    NS_ASSERTION(mEditorInitialized || mInitializing,
+      "We should never try to use the editor if we're not initialized unless we're being initialized");
+
     nsAutoString currentValue;
-    mBoundFrame->GetText(currentValue);
+    if (!mEditorInitialized && IsSingleLineTextControl()) {
+      // Grab the current value directly from the text node to make sure that we
+      // deal with stale data correctly.
+      NS_ASSERTION(mRootNode, "We should have a root node here");
+      nsIContent *textContent = mRootNode->GetChildAt(0);
+      nsCOMPtr<nsIDOMCharacterData> textNode = do_QueryInterface(textContent);
+      if (textNode) {
+        textNode->GetData(currentValue);
+      }
+    } else {
+      mBoundFrame->GetText(currentValue);
+    }
 
     nsWeakFrame weakFrame(mBoundFrame);
 
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 54d2f54f701..21acfb40e6c 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -242,6 +242,7 @@ _TEST_FILES = \
 		test_bug601061.html \
 		test_bug596511.html \
 		reflect.js \
+		test_bug611189.html \
 		test_bug613113.html \
 		test_bug605124-1.html \
 		test_bug605124-2.html \
diff --git a/content/html/content/test/test_bug611189.html b/content/html/content/test/test_bug611189.html
new file mode 100644
index 00000000000..deed763155e
--- /dev/null
+++ b/content/html/content/test/test_bug611189.html
@@ -0,0 +1,46 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=611189
+-->
+<head>
+  <title>Test for Bug 611189</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=611189">Mozilla Bug 611189</a>
+<p id="display"></p>
+<div id="content">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 611189 **/
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function() {
+  var i = document.createElement("input");
+  var b = document.getElementById("content");
+  b.appendChild(i);
+  b.clientWidth; // bind to frame
+  i.focus(); // initialize editor
+  var before = snapshotWindow(window, true);
+  i.value = "L"; // set the value
+  i.style.display = "none";
+  b.clientWidth; // unbind from frame
+  i.value = ""; // set the value without a frame
+  i.style.display = "";
+  b.clientWidth; // rebind to frame
+  is(i.value, "", "Input's value should be correctly updated");
+  var after = snapshotWindow(window, true);
+  ok(compareSnapshots(before, after, true), "The correct value should be rendered inside the control");
+  SimpleTest.finish();
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 2b76971bd82..03e758ec1f9 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -881,6 +881,9 @@ nsTextControlFrame::SelectAllOrCollapseToEndOfText(PRBool aSelect)
 
   nsCOMPtr<nsIContent> rootContent = do_QueryInterface(rootElement);
   nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(rootElement));
+
+  NS_ENSURE_TRUE(rootNode && rootContent, NS_ERROR_FAILURE);
+
   PRInt32 numChildren = rootContent->GetChildCount();
 
   if (numChildren > 0) {
