diff --git a/mozilla/layout/forms/nsFileControlFrame.cpp b/mozilla/layout/forms/nsFileControlFrame.cpp
index 926574901e7..93c48f638bf 100644
--- a/mozilla/layout/forms/nsFileControlFrame.cpp
+++ b/mozilla/layout/forms/nsFileControlFrame.cpp
@@ -97,7 +97,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 
 nsFileControlFrame::nsFileControlFrame():
   mTextFrame(nsnull), 
-  mCachedState(nsnull)
+  mCachedState(nsnull),
+  mDidPreDestroy(PR_FALSE)
 {
     //Shrink the area around it's contents
   SetFlags(NS_BLOCK_SHRINK_WRAP);
@@ -117,8 +118,8 @@ nsFileControlFrame::~nsFileControlFrame()
   }
 }
 
-NS_IMETHODIMP 
-nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+void
+nsFileControlFrame::PreDestroy(nsIPresContext* aPresContext)
 {
   // Toss the value into the control from the anonymous content, which is about
   // to get lost.
@@ -131,10 +132,32 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
     nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
     fileInput->TakeTextFrameValue(value);
   }
+  mDidPreDestroy = PR_TRUE;
+}
+
+NS_IMETHODIMP
+nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
   mTextFrame = nsnull;
   return nsAreaFrame::Destroy(aPresContext);
 }
 
+void
+nsFileControlFrame::RemovedAsPrimaryFrame(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
+#ifdef DEBUG
+  else {
+    NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
+  }
+#endif
+}
+
 NS_IMETHODIMP
 nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
                                            nsISupportsArray& aChildList)
diff --git a/mozilla/layout/forms/nsFileControlFrame.h b/mozilla/layout/forms/nsFileControlFrame.h
index 8392e457400..62f21d85663 100644
--- a/mozilla/layout/forms/nsFileControlFrame.h
+++ b/mozilla/layout/forms/nsFileControlFrame.h
@@ -88,6 +88,9 @@ public:
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
+
+  virtual void RemovedAsPrimaryFrame(nsIPresContext* aPresContext);
+
   NS_IMETHOD Destroy(nsIPresContext *aPresContext);
 
 #ifdef NS_DEBUG
@@ -226,8 +229,16 @@ private:
   void SyncAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                 PRBool aWhichControls);
 
+  /**
+   * We call this when we are being destroyed or removed from the PFM.
+   * @param aPresContext the current pres context
+   */
+  void PreDestroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
   NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
+
+  PRBool mDidPreDestroy; // has PreDestroy been called
 };
 
 #endif
diff --git a/mozilla/layout/html/forms/src/nsFileControlFrame.cpp b/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
index 926574901e7..93c48f638bf 100644
--- a/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
@@ -97,7 +97,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 
 nsFileControlFrame::nsFileControlFrame():
   mTextFrame(nsnull), 
-  mCachedState(nsnull)
+  mCachedState(nsnull),
+  mDidPreDestroy(PR_FALSE)
 {
     //Shrink the area around it's contents
   SetFlags(NS_BLOCK_SHRINK_WRAP);
@@ -117,8 +118,8 @@ nsFileControlFrame::~nsFileControlFrame()
   }
 }
 
-NS_IMETHODIMP 
-nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+void
+nsFileControlFrame::PreDestroy(nsIPresContext* aPresContext)
 {
   // Toss the value into the control from the anonymous content, which is about
   // to get lost.
@@ -131,10 +132,32 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
     nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
     fileInput->TakeTextFrameValue(value);
   }
+  mDidPreDestroy = PR_TRUE;
+}
+
+NS_IMETHODIMP
+nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
   mTextFrame = nsnull;
   return nsAreaFrame::Destroy(aPresContext);
 }
 
+void
+nsFileControlFrame::RemovedAsPrimaryFrame(nsIPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
+#ifdef DEBUG
+  else {
+    NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
+  }
+#endif
+}
+
 NS_IMETHODIMP
 nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
                                            nsISupportsArray& aChildList)
diff --git a/mozilla/layout/html/forms/src/nsFileControlFrame.h b/mozilla/layout/html/forms/src/nsFileControlFrame.h
index 8392e457400..62f21d85663 100644
--- a/mozilla/layout/html/forms/src/nsFileControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsFileControlFrame.h
@@ -88,6 +88,9 @@ public:
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
+
+  virtual void RemovedAsPrimaryFrame(nsIPresContext* aPresContext);
+
   NS_IMETHOD Destroy(nsIPresContext *aPresContext);
 
 #ifdef NS_DEBUG
@@ -226,8 +229,16 @@ private:
   void SyncAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                 PRBool aWhichControls);
 
+  /**
+   * We call this when we are being destroyed or removed from the PFM.
+   * @param aPresContext the current pres context
+   */
+  void PreDestroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
   NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
+
+  PRBool mDidPreDestroy; // has PreDestroy been called
 };
 
 #endif