Bug 345600, Crash [@ nsTextInputListener::UpdateTextInputCommands] using onselect and removing textarea, r+sr=roc

layout/forms/nsTextControlFrame.cpp

@@ -540,6 +540,8 @@ nsTextInputListener::EditAction()
 nsresult
 nsTextInputListener::UpdateTextInputCommands(const nsAString& commandsToUpdate)
 {
+  NS_ENSURE_STATE(mFrame);
+
   nsIContent* content = mFrame->GetContent();
   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);