diff --git a/content/html/content/public/nsITextControlElement.h b/content/html/content/public/nsITextControlElement.h
index 9e3423fd646..e3ae43aee7d 100644
--- a/content/html/content/public/nsITextControlElement.h
+++ b/content/html/content/public/nsITextControlElement.h
@@ -60,7 +60,7 @@ public:
   /**
    * Set the control's value without security checks
    */
-  NS_IMETHOD TakeTextFrameValue(const nsAString& aValue) = 0;
+  NS_IMETHOD SetValueGuaranteed(const nsAString& aValue, nsITextControlFrame* aFrame) = 0;
 
   /**
    * Tell the control that value has been deliberately changed (or not).
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index 90cc90d2365..efd1e5c7eea 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -219,7 +219,7 @@ public:
   NS_IMETHOD DoneCreatingElement();
 
   // nsITextControlElement
-  NS_IMETHOD TakeTextFrameValue(const nsAString& aValue);
+  NS_IMETHOD SetValueGuaranteed(const nsAString& aValue, nsITextControlFrame* aFrame);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
 
   // nsIRadioControlElement
@@ -232,8 +232,9 @@ public:
 
 protected:
   // Helper method
-  nsresult SetValueInternal(const nsAString& aValue,
-                            nsITextControlFrame* aFrame);
+  NS_IMETHOD SetValueSecure(const nsAString& aValue,
+                            nsITextControlFrame* aFrame,
+                            PRBool aCheckSecurity);
 
   nsresult GetSelectionRange(PRInt32* aSelectionStart, PRInt32* aSelectionEnd);
   //Helper method
@@ -504,21 +505,6 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
       SetCheckedChanged(PR_FALSE);
     }
   }
-  //
-  // If we are changing type from File/Text/Passwd to other input types
-  // we need save the mValue into value attribute
-  //
-  if (aName == nsHTMLAtoms::type && mValue &&
-      mType != NS_FORM_INPUT_TEXT &&
-      mType != NS_FORM_INPUT_PASSWORD &&
-      mType != NS_FORM_INPUT_FILE) {
-    SetAttr(kNameSpaceID_None, nsHTMLAtoms::value,
-            NS_ConvertUTF8toUCS2(mValue), PR_FALSE);
-    if (mValue) {
-      nsMemory::Free(mValue);
-      mValue = nsnull;
-    }
-  }
 }
 
 // nsIDOMHTMLInputElement
@@ -661,42 +647,46 @@ nsHTMLInputElement::GetValue(nsAString& aValue)
 NS_IMETHODIMP 
 nsHTMLInputElement::SetValue(const nsAString& aValue)
 {
-  //check secuity
-  if (mType == NS_FORM_INPUT_FILE) {
-    nsresult rv;
-    nsCOMPtr<nsIScriptSecurityManager> securityManager =
-             do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    PRBool enabled;
-    rv = securityManager->IsCapabilityEnabled("UniversalFileRead", &enabled);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (!enabled) {
-      // setting the value of a "FILE" input widget requires the
-      // UniversalFileRead privilege
-      return NS_ERROR_DOM_SECURITY_ERR;
-    }
-  }
-  return SetValueInternal(aValue, nsnull);
+  return SetValueSecure(aValue, nsnull, PR_TRUE);
 }
 
 NS_IMETHODIMP
-nsHTMLInputElement::TakeTextFrameValue(const nsAString& aValue)
+nsHTMLInputElement::SetValueGuaranteed(const nsAString& aValue,
+                                       nsITextControlFrame* aFrame)
 {
-  if (mValue) {
-    nsMemory::Free(mValue);
-  }
-  mValue = ToNewUTF8String(aValue);
-  return SetValueChanged(PR_TRUE);
+  return SetValueSecure(aValue, aFrame, PR_FALSE);
 }
 
-nsresult
-nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
-                                     nsITextControlFrame* aFrame)
+NS_IMETHODIMP
+nsHTMLInputElement::SetValueSecure(const nsAString& aValue,
+                                   nsITextControlFrame* aFrame,
+                                   PRBool aCheckSecurity)
 {
-  if (mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_PASSWORD ||
-      mType == NS_FORM_INPUT_FILE) {
+  PRInt32 type;
+  GetType(&type);
+  if (type == NS_FORM_INPUT_TEXT || type == NS_FORM_INPUT_PASSWORD ||
+      type == NS_FORM_INPUT_FILE) {
+
+    if (aCheckSecurity && type == NS_FORM_INPUT_FILE) {
+      nsresult rv;
+      nsCOMPtr<nsIScriptSecurityManager> securityManager = 
+               do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+
+      PRBool enabled;
+      rv = securityManager->IsCapabilityEnabled("UniversalFileRead", &enabled);
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+
+      if (!enabled) {
+        // setting the value of a "FILE" input widget requires the
+        // UniversalFileRead privilege
+        return NS_ERROR_DOM_SECURITY_ERR;
+      }
+    }
 
     nsITextControlFrame* textControlFrame = aFrame;
     nsIFormControlFrame* formControlFrame = textControlFrame;
@@ -714,7 +704,7 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
     // File frames always own the value (if the frame is there).
     // Text frames have a bit that says whether they own the value.
     PRBool frameOwnsValue = PR_FALSE;
-    if (mType == NS_FORM_INPUT_FILE && formControlFrame) {
+    if (type == NS_FORM_INPUT_FILE && formControlFrame) {
       frameOwnsValue = PR_TRUE;
     }
     if (textControlFrame) {
@@ -744,7 +734,7 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
   // the meaning of ValueChanged just a teensy bit to save a measly byte of
   // storage space in nsHTMLInputElement.  Yes, you are free to make a new flag,
   // NEED_TO_SAVE_VALUE, at such time as mBitField becomes a 16-bit value.
-  if (mType == NS_FORM_INPUT_HIDDEN) {
+  if (type == NS_FORM_INPUT_HIDDEN) {
     SetValueChanged(PR_TRUE);
   }
 
@@ -2233,7 +2223,7 @@ nsHTMLInputElement::Reset()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      rv = SetValueInternal(NS_LITERAL_STRING(""), nsnull);
+      rv = SetValueGuaranteed(NS_LITERAL_STRING(""), nsnull);
       break;
     }
     // Value is the same as defaultValue for hidden inputs
@@ -2616,7 +2606,7 @@ nsHTMLInputElement::RestoreState(nsIPresState* aState)
         nsAutoString value;
         rv = aState->GetStateProperty(NS_LITERAL_STRING("v"), value);
         NS_ASSERTION(NS_SUCCEEDED(rv), "value restore failed!");
-        SetValueInternal(value, nsnull);
+        SetValueGuaranteed(value, nsnull);
         break;
       }
   }
diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index 41794337823..f2043545982 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -1876,11 +1876,11 @@ nsHTMLSelectElement::GetMappedAttributeImpact(const nsIAtom* aAttribute,
                                               PRInt32 aModType,
                                               nsChangeHint& aHint) const
 {
-  if (aAttribute == nsHTMLAtoms::multiple ||
-      aAttribute == nsHTMLAtoms::size) {
+  if (aAttribute == nsHTMLAtoms::multiple) {
     aHint = NS_STYLE_HINT_FRAMECHANGE;
   }
-  else if (aAttribute == nsHTMLAtoms::align) {
+  else if ((aAttribute == nsHTMLAtoms::align) ||
+           (aAttribute == nsHTMLAtoms::size)) {
     aHint = NS_STYLE_HINT_REFLOW;
   }
   else if (!GetCommonMappedAttributesImpact(aAttribute, aHint)) {
diff --git a/content/html/content/src/nsHTMLTextAreaElement.cpp b/content/html/content/src/nsHTMLTextAreaElement.cpp
index 75585f6eb83..05efff398cf 100644
--- a/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -115,8 +115,8 @@ public:
   NS_IMETHOD SaveState();
   NS_IMETHOD RestoreState(nsIPresState* aState);
 
-  // nsITextControlElemet
-  NS_IMETHOD TakeTextFrameValue(const nsAString& aValue);
+  // nsITextControlElement
+  NS_IMETHOD SetValueGuaranteed(const nsAString& aValue, nsITextControlFrame* aFrame);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
 
   // nsIContent
@@ -162,9 +162,6 @@ protected:
    *        wrap=hard.
    */
   void GetValueInternal(nsAString& aValue, PRBool aIgnoreWrap);
-
-  nsresult SetValueInternal(const nsAString& aValue,
-                            nsITextControlFrame* aFrame);
 };
 
 nsresult
@@ -456,19 +453,10 @@ nsHTMLTextAreaElement::GetValueInternal(nsAString& aValue, PRBool aIgnoreWrap)
   }
 }
 
-NS_IMETHODIMP
-nsHTMLTextAreaElement::TakeTextFrameValue(const nsAString& aValue)
-{
-  if (mValue) {
-    nsMemory::Free(mValue);
-  }
-  mValue = ToNewUTF8String(aValue);
-  return SetValueChanged(PR_TRUE);
-}
 
-nsresult
-nsHTMLTextAreaElement::SetValueInternal(const nsAString& aValue,
-                                        nsITextControlFrame* aFrame)
+NS_IMETHODIMP
+nsHTMLTextAreaElement::SetValueGuaranteed(const nsAString& aValue,
+                                          nsITextControlFrame* aFrame)
 {
   nsITextControlFrame* textControlFrame = aFrame;
   nsIFormControlFrame* formControlFrame = textControlFrame;
@@ -508,7 +496,7 @@ nsHTMLTextAreaElement::SetValueInternal(const nsAString& aValue,
 NS_IMETHODIMP 
 nsHTMLTextAreaElement::SetValue(const nsAString& aValue)
 {
-  return SetValueInternal(aValue, nsnull);
+  return SetValueGuaranteed(aValue, nsnull);
 }
 
 
diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index 9fbc1b09fb0..ff457db8742 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -2940,7 +2940,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
     nsCOMPtr<nsITextControlElement> textControl = do_QueryInterface(mContent);
     if (textControl)
     {
-      textControl->TakeTextFrameValue(aValue);
+      textControl->SetValueGuaranteed(aValue, this);
     }
   }
 }
diff --git a/layout/html/forms/src/nsTextControlFrame.cpp b/layout/html/forms/src/nsTextControlFrame.cpp
index 9fbc1b09fb0..ff457db8742 100644
--- a/layout/html/forms/src/nsTextControlFrame.cpp
+++ b/layout/html/forms/src/nsTextControlFrame.cpp
@@ -2940,7 +2940,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
     nsCOMPtr<nsITextControlElement> textControl = do_QueryInterface(mContent);
     if (textControl)
     {
-      textControl->TakeTextFrameValue(aValue);
+      textControl->SetValueGuaranteed(aValue, this);
     }
   }
 }