diff --git a/mozilla/content/html/content/public/Makefile.in b/mozilla/content/html/content/public/Makefile.in
index a4889bf1297..8ca9345aef1 100644
--- a/mozilla/content/html/content/public/Makefile.in
+++ b/mozilla/content/html/content/public/Makefile.in
@@ -62,7 +62,6 @@ EXPORTS		= \
 		nsIRadioVisitor.h \
 		nsIRadioGroupContainer.h \
 		nsITextControlElement.h \
-		nsIFileControlElement.h \
 		nsIFormSubmission.h \
 		nsIFrameSetElement.h \
                 $(NULL)
diff --git a/mozilla/content/html/content/public/nsIFileControlElement.h b/mozilla/content/html/content/public/nsIFileControlElement.h
deleted file mode 100755
index 3a389cc187f..00000000000
--- a/mozilla/content/html/content/public/nsIFileControlElement.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Mozilla Foundation
- * Portions created by the Initial Developer are Copyright (C) 2006
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Jonas Sicking <jonas@sicking.cc> (Original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nsIFileControlElement_h___
-#define nsIFileControlElement_h___
-
-#include "nsISupports.h"
-class nsAString;
-
-// IID for the nsIFileControl interface
-#define NS_IFILECONTROLELEMENT_IID \
-{ 0x848145e7, 0x3f73, 0x4889, \
- { 0xbf, 0x4d, 0x72, 0x52, 0xa5, 0x98, 0x14, 0xfa } }
-
-/**
- * This interface is used for the file control frame to store its value away
- * into the content.
- */
-class nsIFileControlElement : public nsISupports {
-public:
-
-  NS_DEFINE_STATIC_IID_ACCESSOR(NS_IFILECONTROLELEMENT_IID)
-
-  /**
-   * Gets filename to be uploaded when this control is submitted
-   */
-  virtual void GetFileName(nsAString& aFileName) = 0;
-
-  /**
-   * Sets filename to be uploaded when this control is submitted
-   */
-  virtual void SetFileName(const nsAString& aFileName,
-                           PRBool aUpdateFrame) = 0;
-};
-
-#endif // nsIFileControlElement_h___
diff --git a/mozilla/content/html/content/src/nsHTMLAtomList.h b/mozilla/content/html/content/src/nsHTMLAtomList.h
index 430ca62df9b..cad9a53d4bd 100644
--- a/mozilla/content/html/content/src/nsHTMLAtomList.h
+++ b/mozilla/content/html/content/src/nsHTMLAtomList.h
@@ -141,7 +141,6 @@ HTML_ATOM(enctype, "enctype")
 HTML_ATOM(_event, "event")
 HTML_ATOM(face, "face")
 HTML_ATOM(fieldset, "fieldset")
-HTML_ATOM(filename, "filename")
 HTML_ATOM(font, "font")
 HTML_ATOM(fontWeight, "font-weight")
 HTML_ATOM(_for, "for")
diff --git a/mozilla/content/html/content/src/nsHTMLInputElement.cpp b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
index f041df02932..72de8a1eafc 100644
--- a/mozilla/content/html/content/src/nsHTMLInputElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
@@ -39,7 +39,6 @@
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMNSHTMLInputElement.h"
 #include "nsITextControlElement.h"
-#include "nsIFileControlElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIRadioControlElement.h"
 #include "nsIRadioVisitor.h"
@@ -139,8 +138,7 @@ class nsHTMLInputElement : public nsGenericHTMLFormElement,
                            public nsITextControlElement,
                            public nsIRadioControlElement,
                            public nsIPhonetic,
-                           public nsIDOMNSEditableElement,
-                           public nsIFileControlElement
+                           public nsIDOMNSEditableElement
 {
 public:
   nsHTMLInputElement(nsINodeInfo *aNodeInfo, PRBool aFromParser);
@@ -233,10 +231,6 @@ public:
   // nsITextControlElement
   NS_IMETHOD TakeTextFrameValue(const nsAString& aValue);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
-  
-  // nsIFileControlElement
-  virtual void GetFileName(nsAString& aFileName);
-  virtual void SetFileName(const nsAString& aFileName, PRBool aUpdateFrame);
 
   // nsIRadioControlElement
   NS_IMETHOD RadioSetChecked(PRBool aNotify);
@@ -251,6 +245,7 @@ public:
    */
   virtual already_AddRefed<nsIRadioGroupContainer> GetRadioGroupContainer();
 
+
 protected:
   // Helper method
   nsresult SetValueInternal(const nsAString& aValue,
@@ -339,17 +334,6 @@ protected:
    * The current value of the input if it has been changed from the deafault
    */
   char*                    mValue;
-  /**
-   * The value of the input if it is a file input. This is the filename used
-   * when uploading a file. It is vital that this is kept separate from mValue
-   * so that it won't be possible to 'leak' the value from a text-input to a
-   * file-input. Additionally, the logic for this value is kept as simple as
-   * possible to avoid accidental errors where the wrong filename is used.
-   * Therefor the filename is always owned by this member, never by the frame.
-   * Whenever the frame wants to change the filename it has to call
-   * SetFileName to update this member.
-   */
-  nsAutoPtr<nsString>      mFileName;
 };
 
 //
@@ -388,7 +372,6 @@ NS_HTML_CONTENT_INTERFACE_MAP_BEGIN(nsHTMLInputElement,
   NS_INTERFACE_MAP_ENTRY(nsIDOMHTMLInputElement)
   NS_INTERFACE_MAP_ENTRY(nsIDOMNSHTMLInputElement)
   NS_INTERFACE_MAP_ENTRY(nsITextControlElement)
-  NS_INTERFACE_MAP_ENTRY(nsIFileControlElement)
   NS_INTERFACE_MAP_ENTRY(nsIRadioControlElement)
   NS_INTERFACE_MAP_ENTRY(nsIPhonetic)
   NS_INTERFACE_MAP_ENTRY(imgIDecoderObserver)
@@ -417,6 +400,7 @@ nsHTMLInputElement::CloneNode(PRBool aDeep, nsIDOMNode** aReturn)
   switch (mType) {
     case NS_FORM_INPUT_TEXT:
     case NS_FORM_INPUT_PASSWORD:
+    case NS_FORM_INPUT_FILE:
       if (GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
         // We don't have our default value anymore.  Set our value on
         // the clone.
@@ -426,11 +410,6 @@ nsHTMLInputElement::CloneNode(PRBool aDeep, nsIDOMNode** aReturn)
         it->SetValueInternal(value, nsnull);
       }
       break;
-    case NS_FORM_INPUT_FILE:
-      if (mFileName) {
-        it->mFileName = new nsString(*mFileName);
-      }
-      break;
     case NS_FORM_INPUT_RADIO:
     case NS_FORM_INPUT_CHECKBOX:
       if (GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
@@ -627,7 +606,8 @@ nsHTMLInputElement::SetSize(PRUint32 aValue)
 NS_IMETHODIMP 
 nsHTMLInputElement::GetValue(nsAString& aValue)
 {
-  if (mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_PASSWORD) {
+  if (mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_PASSWORD ||
+      mType == NS_FORM_INPUT_FILE) {
     // No need to flush here, if there's no frame created for this
     // input yet, there won't be a value in it (that we don't already
     // have) even if we force it to be created
@@ -659,17 +639,6 @@ nsHTMLInputElement::GetValue(nsAString& aValue)
     return NS_OK;
   }
 
-  if (mType == NS_FORM_INPUT_FILE) {
-    if (mFileName) {
-      aValue = *mFileName;
-    }
-    else {
-      aValue.Truncate();
-    }
-
-    return NS_OK;
-  }
-  
   // Treat value == defaultValue for other input elements
   nsresult rv = GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, aValue);
 
@@ -689,28 +658,22 @@ nsHTMLInputElement::SetValue(const nsAString& aValue)
 {
   // check security.  Note that setting the value to the empty string is always
   // OK and gives pages a way to clear a file input if necessary.
-  if (mType == NS_FORM_INPUT_FILE) {
-    if (!aValue.IsEmpty()) {
-      nsIScriptSecurityManager *securityManager =
-        nsContentUtils::GetSecurityManager();
+  if (mType == NS_FORM_INPUT_FILE && !aValue.IsEmpty()) {
+    nsIScriptSecurityManager *securityManager =
+      nsContentUtils::GetSecurityManager();
 
-      PRBool enabled;
-      nsresult rv =
-        securityManager->IsCapabilityEnabled("UniversalFileRead", &enabled);
-      NS_ENSURE_SUCCESS(rv, rv);
+    PRBool enabled;
+    nsresult rv =
+      securityManager->IsCapabilityEnabled("UniversalFileRead", &enabled);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-      if (!enabled) {
-        // setting the value of a "FILE" input widget requires the
-        // UniversalFileRead privilege
-        return NS_ERROR_DOM_SECURITY_ERR;
-      }
+    if (!enabled) {
+      // setting the value of a "FILE" input widget requires the
+      // UniversalFileRead privilege
+      return NS_ERROR_DOM_SECURITY_ERR;
     }
-    SetFileName(aValue, PR_TRUE);
   }
-  else {
-    SetValueInternal(aValue, nsnull);
-  }
-
+  SetValueInternal(aValue, nsnull);
   return NS_OK;
 }
 
@@ -725,42 +688,12 @@ nsHTMLInputElement::TakeTextFrameValue(const nsAString& aValue)
   return NS_OK;
 }
 
-void
-nsHTMLInputElement::GetFileName(nsAString& aValue)
-{
-  if (mFileName) {
-    aValue = *mFileName;
-  }
-  else {
-    aValue.Truncate();
-  }
-}
-
-void
-nsHTMLInputElement::SetFileName(const nsAString& aValue, PRBool aUpdateFrame)
-{
-  // No big deal if |new| fails, we simply won't submit the file
-  mFileName = aValue.IsEmpty() ? nsnull : new nsString(aValue);
-
-  SetValueChanged(PR_TRUE);
-
-  if (aUpdateFrame) {
-    nsIFormControlFrame* formControlFrame = GetFormControlFrame(PR_FALSE);
-    if (formControlFrame) {
-      nsCOMPtr<nsPresContext> presContext = GetPresContext();
-      formControlFrame->SetProperty(presContext, nsHTMLAtoms::filename, aValue);
-    }
-  }
-}
-
 nsresult
 nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
                                      nsITextControlFrame* aFrame)
 {
-  NS_PRECONDITION(mType != NS_FORM_INPUT_FILE,
-                  "Don't call SetValueInternal for file inputs");
-
-  if (mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_PASSWORD) {
+  if (mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_PASSWORD ||
+      mType == NS_FORM_INPUT_FILE) {
 
     nsITextControlFrame* textControlFrame = aFrame;
     nsIFormControlFrame* formControlFrame = textControlFrame;
@@ -778,6 +711,9 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
     // File frames always own the value (if the frame is there).
     // Text frames have a bit that says whether they own the value.
     PRBool frameOwnsValue = PR_FALSE;
+    if (mType == NS_FORM_INPUT_FILE && formControlFrame) {
+      frameOwnsValue = PR_TRUE;
+    }
     if (textControlFrame) {
       textControlFrame->OwnsValue(&frameOwnsValue);
     }
@@ -799,10 +735,6 @@ nsHTMLInputElement::SetValueInternal(const nsAString& aValue,
     return mValue ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
   }
 
-  if (mType == NS_FORM_INPUT_FILE) {
-    return NS_ERROR_UNEXPECTED;
-  }
-
   // If the value of a hidden input was changed, we mark it changed so that we
   // will know we need to save / restore the value.  Yes, we are overloading
   // the meaning of ValueChanged just a teensy bit to save a measly byte of
@@ -1372,14 +1304,6 @@ nsHTMLInputElement::HandleDOMEvent(nsPresContext* aPresContext,
     return NS_OK;
   }
 
-  if (!(NS_EVENT_FLAG_INIT & aFlags) &&
-      aEvent->message == NS_FORM_INPUT &&
-      formControlFrame) {
-    nsAutoString fName;
-    formControlFrame->GetProperty(nsHTMLAtoms::filename, fName);
-    mFileName = fName.IsEmpty() ? nsnull : new nsString(fName);
-  }
-
   //
   // Web pages expect the value of a radio button or checkbox to be set
   // *before* onclick and DOMActivate fire, and they expect that if they set
@@ -1866,10 +1790,10 @@ nsHTMLInputElement::ParseAttribute(nsIAtom* aAttribute,
     // process).
     PRInt8 newType = aResult.GetEnumValue();
     if (newType == NS_FORM_INPUT_FILE) {      
-      // These calls aren't strictly needed any more since we'll never
-      // confuse values and filenames. However they're there for backwards
-      // compat.
-      SetFileName(EmptyString(), PR_TRUE);
+      // If the type is being changed to file, set the element value
+      // to the empty string. This is for security.
+      // Call SetValueInternal so that this doesn't accidentally get caught
+      // in the security checks in SetValue.
       SetValueInternal(EmptyString(), nsnull);
     }
 
@@ -2206,7 +2130,7 @@ nsHTMLInputElement::Reset()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      SetFileName(EmptyString(), PR_TRUE);
+      rv = SetValueInternal(EmptyString(), nsnull);
       break;
     }
     // Value is the same as defaultValue for hidden inputs
@@ -2327,6 +2251,22 @@ nsHTMLInputElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
     return rv;
   }
 
+  // Get the value
+  nsAutoString value;
+  rv = GetValue(value);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  if (mType == NS_FORM_INPUT_SUBMIT && value.IsEmpty() &&
+      !HasAttr(kNameSpaceID_None, nsHTMLAtoms::value)) {
+    // Get our default value, which is the same as our default label
+    nsXPIDLString defaultValue;
+    nsContentUtils::GetLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
+                                       "Submit", defaultValue);
+    value = defaultValue;
+  }
+      
   //
   // Submit file if it's input type=file and this encoding method accepts files
   //
@@ -2336,24 +2276,22 @@ nsHTMLInputElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
     //
     nsCOMPtr<nsIFile> file;
  
-    if (mFileName) {
-      if (StringBeginsWith(*mFileName, NS_LITERAL_STRING("file:"),
-                           nsCaseInsensitiveStringComparator())) {
-        // Converts the URL string into the corresponding nsIFile if possible.
-        // A local file will be created if the URL string begins with file://.
-        rv = NS_GetFileFromURLSpec(NS_ConvertUCS2toUTF8(*mFileName),
-                                   getter_AddRefs(file));
-      }
-
-      if (!file) {
-        // this is no "file://", try as local file
-        nsCOMPtr<nsILocalFile> localFile;
-        rv = NS_NewLocalFile(*mFileName, PR_FALSE, getter_AddRefs(localFile));
-        file = localFile;
-      }
+    if (StringBeginsWith(value, NS_LITERAL_STRING("file:"),
+                         nsCaseInsensitiveStringComparator())) {
+      // Converts the URL string into the corresponding nsIFile if possible.
+      // A local file will be created if the URL string begins with file://.
+      rv = NS_GetFileFromURLSpec(NS_ConvertUCS2toUTF8(value),
+                                 getter_AddRefs(file));
     }
 
-    if (file) {
+    if (!file) {
+      // this is no "file://", try as local file
+      nsCOMPtr<nsILocalFile> localFile;
+      rv = NS_NewLocalFile(value, PR_FALSE, getter_AddRefs(localFile));
+      file = localFile;
+    }
+
+    if (NS_SUCCEEDED(rv)) {
 
       //
       // Get the leaf path name (to be submitted as the value)
@@ -2423,28 +2361,12 @@ nsHTMLInputElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
     // If we can't even make a truncated filename, submit empty string
     // rather than sending everything
     //
-    aFormSubmission->AddNameFilePair(this, name, EmptyString(),
+    aFormSubmission->AddNameFilePair(this, name, value,
         nsnull, NS_LITERAL_CSTRING("application/octet-stream"),
         PR_FALSE);
     return rv;
   }
 
-  // Get the value
-  nsAutoString value;
-  rv = GetValue(value);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  if (mType == NS_FORM_INPUT_SUBMIT && value.IsEmpty() &&
-      !HasAttr(kNameSpaceID_None, nsHTMLAtoms::value)) {
-    // Get our default value, which is the same as our default label
-    nsXPIDLString defaultValue;
-    nsContentUtils::GetLocalizedString(nsContentUtils::eFORMS_PROPERTIES,
-                                       "Submit", defaultValue);
-    value = defaultValue;
-  }
-      
   // Submit
   // (for type=image, only submit if value is non-null)
   if (mType != NS_FORM_INPUT_IMAGE || !value.IsEmpty()) {
@@ -2492,6 +2414,7 @@ nsHTMLInputElement::SaveState()
     case NS_FORM_INPUT_PASSWORD:
       break;
     case NS_FORM_INPUT_TEXT:
+    case NS_FORM_INPUT_FILE:
     case NS_FORM_INPUT_HIDDEN:
       {
         if (GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
@@ -2510,17 +2433,6 @@ nsHTMLInputElement::SaveState()
         }
         break;
       }
-    case NS_FORM_INPUT_FILE:
-      {
-        if (mFileName) {
-          rv = GetPrimaryPresState(this, &state);
-          if (state) {
-            rv = state->SetStateProperty(NS_LITERAL_STRING("f"), *mFileName);
-            NS_ASSERTION(NS_SUCCEEDED(rv), "value save failed!");
-          }
-        }
-        break;
-      }
   }
   
   if (GET_BOOLBIT(mBitField, BF_DISABLED_CHANGED)) {
@@ -2610,6 +2522,7 @@ nsHTMLInputElement::RestoreState(nsPresState* aState)
       }
 
     case NS_FORM_INPUT_TEXT:
+    case NS_FORM_INPUT_FILE:
     case NS_FORM_INPUT_HIDDEN:
       {
         nsAutoString value;
@@ -2620,17 +2533,6 @@ nsHTMLInputElement::RestoreState(nsPresState* aState)
         }
         break;
       }
-    case NS_FORM_INPUT_FILE:
-      {
-        nsAutoString value;
-        rv = aState->GetStateProperty(NS_LITERAL_STRING("f"), value);
-        NS_ASSERTION(NS_SUCCEEDED(rv), "value restore failed!");
-        if (rv == NS_STATE_PROPERTY_EXISTS) {
-          // Can there really be a frame at this point?
-          SetFileName(value, PR_TRUE);
-        }
-        break;
-      }
   }
   
   nsAutoString disabled;
diff --git a/mozilla/layout/forms/nsFileControlFrame.cpp b/mozilla/layout/forms/nsFileControlFrame.cpp
index 0f711acba24..b26dfb4e9be 100644
--- a/mozilla/layout/forms/nsFileControlFrame.cpp
+++ b/mozilla/layout/forms/nsFileControlFrame.cpp
@@ -68,7 +68,7 @@
 #include "nsIDOMEventReceiver.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsILocalFile.h"
-#include "nsIFileControlElement.h"
+#include "nsITextControlElement.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
@@ -94,7 +94,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 
 nsFileControlFrame::nsFileControlFrame():
   mTextFrame(nsnull), 
-  mCachedState(nsnull)
+  mCachedState(nsnull),
+  mDidPreDestroy(PR_FALSE)
 {
     //Shrink the area around it's contents
   SetFlags(NS_BLOCK_SHRINK_WRAP);
@@ -114,13 +115,54 @@ nsFileControlFrame::~nsFileControlFrame()
   }
 }
 
+void
+nsFileControlFrame::PreDestroy(nsPresContext* aPresContext)
+{
+  // Toss the value into the control from the anonymous content, which is about
+  // to get lost.  Note that if the page is being torn down then the anonymous
+  // content may no longer have access to its frame.  But _we_ can access that
+  // frame.  So if it's there, get the value from the frame
+  if (mTextContent) {
+    nsAutoString value;
+    if (mTextFrame) {
+      // Second arg doesn't really matter here...
+      mTextFrame->GetValue(value, PR_TRUE);
+    } else {
+      // Get from the content
+      nsCOMPtr<nsIDOMHTMLInputElement> input = do_QueryInterface(mTextContent);
+      input->GetValue(value);
+    }
+
+    // Have it take the value, just like when input type=text goes away
+    nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
+    fileInput->TakeTextFrameValue(value);
+  }
+  mDidPreDestroy = PR_TRUE;
+}
+
 NS_IMETHODIMP
 nsFileControlFrame::Destroy(nsPresContext* aPresContext)
 {
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
   mTextFrame = nsnull;
   return nsAreaFrame::Destroy(aPresContext);
 }
 
+void
+nsFileControlFrame::RemovedAsPrimaryFrame(nsPresContext* aPresContext)
+{
+  if (!mDidPreDestroy) {
+    PreDestroy(aPresContext);
+  }
+#ifdef DEBUG
+  else {
+    NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
+  }
+#endif
+}
+
 NS_IMETHODIMP
 nsFileControlFrame::CreateAnonymousContent(nsPresContext* aPresContext,
                                            nsISupportsArray& aChildList)
@@ -144,14 +186,13 @@ nsFileControlFrame::CreateAnonymousContent(nsPresContext* aPresContext,
 
   if (mTextContent) {
     mTextContent->SetAttr(kNameSpaceID_None, nsHTMLAtoms::type, NS_LITERAL_STRING("text"), PR_FALSE);
-    nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(mContent);
     nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-    if (fileControl && fileContent && textControl) {
+    if (fileContent && textControl) {
       // Initialize value when we create the content in case the value was set
       // before we got here
       nsAutoString value;
       nsAutoString accessKey;
-      fileControl->GetFileName(value);
+      fileContent->GetValue(value);
       textControl->SetValue(value);
 
       PRInt32 tabIndex;
@@ -338,11 +379,6 @@ nsFileControlFrame::MouseClick(nsIDOMEvent* aMouseEvent)
     result = localFile->GetPath(unicodePath);
     if (!unicodePath.IsEmpty()) {
       mTextFrame->SetProperty(mPresContext, nsHTMLAtoms::value, unicodePath);
-      nsCOMPtr<nsIFileControlElement> fileControl = do_QueryInterface(mContent);
-      if (fileControl) {
-        fileControl->SetFileName(unicodePath, PR_FALSE);
-      }
-      
       // May need to fire an onchange here
       mTextFrame->CheckFireOnChange();
       return NS_OK;
@@ -600,7 +636,7 @@ NS_IMETHODIMP nsFileControlFrame::SetProperty(nsPresContext* aPresContext,
                                               const nsAString& aValue)
 {
   nsresult rv = NS_OK;
-  if (nsHTMLAtoms::value == aName || nsHTMLAtoms::filename == aName) {
+  if (nsHTMLAtoms::value == aName) {
     if (mTextFrame) {
       mTextFrame->SetValue(aValue);
     } else {
@@ -616,7 +652,7 @@ NS_IMETHODIMP nsFileControlFrame::GetProperty(nsIAtom* aName, nsAString& aValue)
 {
   aValue.Truncate();  // initialize out param
 
-  if (nsHTMLAtoms::value == aName || nsHTMLAtoms::filename == aName) {
+  if (nsHTMLAtoms::value == aName) {
     if (mTextFrame) {
       mTextFrame->GetValue(aValue, PR_FALSE);
     }
diff --git a/mozilla/layout/forms/nsFileControlFrame.h b/mozilla/layout/forms/nsFileControlFrame.h
index b0892c7d0e7..e20fd003c46 100644
--- a/mozilla/layout/forms/nsFileControlFrame.h
+++ b/mozilla/layout/forms/nsFileControlFrame.h
@@ -86,6 +86,8 @@ public:
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
 
+  virtual void RemovedAsPrimaryFrame(nsPresContext* aPresContext);
+
   NS_IMETHOD Destroy(nsPresContext *aPresContext);
 
 #ifdef NS_DEBUG
@@ -224,8 +226,16 @@ private:
   void SyncAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                 PRBool aWhichControls);
 
+  /**
+   * We call this when we are being destroyed or removed from the PFM.
+   * @param aPresContext the current pres context
+   */
+  void PreDestroy(nsPresContext* aPresContext);
+
   NS_IMETHOD_(nsrefcnt) AddRef() { return 1; }
   NS_IMETHOD_(nsrefcnt) Release() { return 1; }
+
+  PRBool mDidPreDestroy; // has PreDestroy been called
 };
 
 #endif