diff --git a/layout/html/forms/src/nsGfxTextControlFrame.cpp b/layout/html/forms/src/nsGfxTextControlFrame.cpp
index c2830fac9b0..565b4699814 100644
--- a/layout/html/forms/src/nsGfxTextControlFrame.cpp
+++ b/layout/html/forms/src/nsGfxTextControlFrame.cpp
@@ -320,19 +320,19 @@ nsGfxTextControlFrame::CreateEditor()
 }
 
 nsGfxTextControlFrame::nsGfxTextControlFrame()
-: mCreatingViewer(PR_FALSE),
-  mTempObserver(0), mDocObserver(0),
+: mTempObserver(0), mDocObserver(0),
+  mCreatingViewer(PR_FALSE),
   mNotifyOnInput(PR_FALSE),
   mIsProcessing(PR_FALSE),
   mNeedsStyleInit(PR_TRUE),
+  mDidSetFocus(PR_FALSE),
+  mGotSelectionState(PR_FALSE),
+  mSelectionWasCollapsed(PR_FALSE),
   mFramePresContext(nsnull),
   mCachedState(nsnull),
   mWeakReferent(this),
   mFrameConstructor(nsnull),
   mDisplayFrame(nsnull),
-  mDidSetFocus(PR_FALSE),
-  mGotSelectionState(PR_FALSE),
-  mSelectionWasCollapsed(PR_FALSE),
   mPassThroughMouseEvents(eUninitialized)
 {
 #ifdef DEBUG
@@ -1346,6 +1346,10 @@ void nsGfxTextControlFrame::SetTextControlFrameState(const nsString& aValue)
     if (PR_TRUE==IsSingleLineTextControl()) {
       RemoveNewlines(currentValue); 
     }
+    else {
+      // \r is an illegal character in the dom, so get rid of them:
+      RemoveReturns(currentValue);
+    }
     if (PR_FALSE==currentValue.Equals(aValue))  // this is necessary to avoid infinite recursion
     {
       nsCOMPtr<nsIDOMDocument>domDoc;
@@ -3160,6 +3164,12 @@ void nsGfxTextControlFrame::RemoveNewlines(nsString &aString)
   aString.StripChars(badChars);
 }
 
+void nsGfxTextControlFrame::RemoveReturns(nsString &aString)
+{
+  // strip just CR
+  aString.StripChar('\r');
+}
+
 
 NS_IMETHODIMP
 nsGfxTextControlFrame::GetAdditionalChildListName(PRInt32 aIndex,
@@ -4281,7 +4291,6 @@ NS_IMETHODIMP nsEnderEventListener::DidDo(nsITransactionManager *aManager,
 {
   // we only need to update if the undo count is now 1
   nsGfxTextControlFrame *gfxFrame = mFrame.Reference();
-  PRBool mustUpdate = PR_FALSE;
   
   if (gfxFrame)
   {
diff --git a/layout/html/forms/src/nsGfxTextControlFrame.h b/layout/html/forms/src/nsGfxTextControlFrame.h
index e18b88a6ea5..3cdff942194 100644
--- a/layout/html/forms/src/nsGfxTextControlFrame.h
+++ b/layout/html/forms/src/nsGfxTextControlFrame.h
@@ -513,7 +513,10 @@ public:
   NS_IMETHOD InternalContentChanged();
   NS_IMETHOD DoesAttributeExist(nsIAtom *aAtt);
 
+  // Remove CR and LF:
   void RemoveNewlines(nsString &aString);
+  // Remove just CR:
+  void RemoveReturns(nsString &aString);
 
   nsCWeakReferent *WeakReferent()
     { return &mWeakReferent; }