diff --git a/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp b/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp
index a0a797a32a5..d23233681c8 100644
--- a/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp
+++ b/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp
@@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
   NS_ENSURE_ARG_POINTER(aFrame);
   NS_ENSURE_ARG_POINTER(aLineNumberResult);
 
+  // make sure it is a rowFrame in the RowGroup
+  // - it should be, but we do not validate in every case (see bug 88849)
+  nsCOMPtr<nsIAtom> frameType;
+  aFrame->GetFrameType(getter_AddRefs(frameType));
+  if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
+    NS_WARNING("RowGroup contains a frame that is not a row");
+    *aLineNumberResult = 0;
+    return NS_ERROR_FAILURE;
+  } 
+
   nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
   *aLineNumberResult = rowFrame->GetRowIndex();
 
diff --git a/mozilla/layout/tables/nsTableRowGroupFrame.cpp b/mozilla/layout/tables/nsTableRowGroupFrame.cpp
index a0a797a32a5..d23233681c8 100644
--- a/mozilla/layout/tables/nsTableRowGroupFrame.cpp
+++ b/mozilla/layout/tables/nsTableRowGroupFrame.cpp
@@ -1616,6 +1616,16 @@ nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame,
   NS_ENSURE_ARG_POINTER(aFrame);
   NS_ENSURE_ARG_POINTER(aLineNumberResult);
 
+  // make sure it is a rowFrame in the RowGroup
+  // - it should be, but we do not validate in every case (see bug 88849)
+  nsCOMPtr<nsIAtom> frameType;
+  aFrame->GetFrameType(getter_AddRefs(frameType));
+  if (frameType.get() != nsLayoutAtoms::tableRowFrame) {
+    NS_WARNING("RowGroup contains a frame that is not a row");
+    *aLineNumberResult = 0;
+    return NS_ERROR_FAILURE;
+  } 
+
   nsTableRowFrame* rowFrame = (nsTableRowFrame*)aFrame;
   *aLineNumberResult = rowFrame->GetRowIndex();