diff --git a/mozilla/editor/libeditor/html/nsHTMLEditor.cpp b/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
index bbec04cf143..e02117e995e 100644
--- a/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/mozilla/editor/libeditor/html/nsHTMLEditor.cpp
@@ -3722,25 +3722,35 @@ nsHTMLEditor::SetCompositionString(const nsAReadableString& aCompositionString,
   if (NS_FAILED(result)) return result;
 
   mIMETextRangeList = aTextRangeList;
-  nsAutoPlaceHolderBatch batch(this, gIMETxnName);
 
-  result = InsertText(aCompositionString);
+  // we need the nsAutoPlaceHolderBatch destructor called before hitting
+  // GetCaretCoordinates so the states in Frame system sync with content
+  // therefore, we put the nsAutoPlaceHolderBatch into a inner block
+  {
+    nsAutoPlaceHolderBatch batch(this, gIMETxnName);
 
-  mIMEBufferLength = aCompositionString.Length();
+    result = InsertText(aCompositionString);
 
-  if (!mPresShellWeak) return NS_ERROR_NOT_INITIALIZED;
-  nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
-  if (!ps) return NS_ERROR_NOT_INITIALIZED;
-  ps->GetCaret(getter_AddRefs(caretP));
-  caretP->SetCaretDOMSelection(selection);
+    mIMEBufferLength = aCompositionString.Length();
+
+    if (!mPresShellWeak)  
+      return NS_ERROR_NOT_INITIALIZED;
+    nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
+    if (!ps) 
+      return NS_ERROR_NOT_INITIALIZED;
+    ps->GetCaret(getter_AddRefs(caretP));
+    caretP->SetCaretDOMSelection(selection);
+
+    // second part of 23558 fix:
+    if (aCompositionString.IsEmpty()) 
+    {
+      mIMETextNode = nsnull;
+    }
+  }
   result = caretP->GetCaretCoordinates(nsICaret::eIMECoordinates, selection,
               &(aReply->mCursorPosition), &(aReply->mCursorIsCollapsed));
+  NS_ASSERTION(NS_SUCCEEDED(result), "cannot get caret position");
 
-  // second part of 23558 fix:
-  if (aCompositionString.IsEmpty()) 
-  {
-    mIMETextNode = nsnull;
-  }
   
   return result;
 }
diff --git a/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp b/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp
index d2170639d99..db9bf7ce268 100644
--- a/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp
+++ b/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp
@@ -1906,26 +1906,35 @@ nsPlaintextEditor::SetCompositionString(const nsAReadableString& aCompositionStr
   if (NS_FAILED(result)) return result;
 
   mIMETextRangeList = aTextRangeList;
-  nsAutoPlaceHolderBatch batch(this, gIMETxnName);
 
-  result = InsertText(aCompositionString);
-
-  mIMEBufferLength = aCompositionString.Length();
-
-  if (!mPresShellWeak) return NS_ERROR_NOT_INITIALIZED;
-  nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
-  if (!ps) return NS_ERROR_NOT_INITIALIZED;
-  ps->GetCaret(getter_AddRefs(caretP));
-  caretP->SetCaretDOMSelection(selection);
-
-  caretP->GetCaretCoordinates(nsICaret::eIMECoordinates, selection,
-            &(aReply->mCursorPosition), &(aReply->mCursorIsCollapsed));
-
-  // second part of 23558 fix:
-  if (aCompositionString.IsEmpty()) 
+  // we need the nsAutoPlaceHolderBatch destructor called before hitting
+  // GetCaretCoordinates so the states in Frame system sync with content
+  // therefore, we put the nsAutoPlaceHolderBatch into a inner block
   {
-    mIMETextNode = nsnull;
+    nsAutoPlaceHolderBatch batch(this, gIMETxnName);
+
+    result = InsertText(aCompositionString);
+
+    mIMEBufferLength = aCompositionString.Length();
+
+    if (!mPresShellWeak) 
+      return NS_ERROR_NOT_INITIALIZED;
+    nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
+    if (!ps) 
+      return NS_ERROR_NOT_INITIALIZED;
+    ps->GetCaret(getter_AddRefs(caretP));
+    caretP->SetCaretDOMSelection(selection);
+
+    // second part of 23558 fix:
+    if (aCompositionString.IsEmpty()) 
+    {
+      mIMETextNode = nsnull;
+    }
   }
+
+  result = caretP->GetCaretCoordinates(nsICaret::eIMECoordinates, selection,
+            &(aReply->mCursorPosition), &(aReply->mCursorIsCollapsed));
+  NS_ASSERTION(NS_SUCCEEDED(result), "cannot get caret position");
   
   return result;
 }