diff --git a/mozilla/content/html/content/public/nsITextControlElement.h b/mozilla/content/html/content/public/nsITextControlElement.h
index 0099253421c..70b97994620 100644
--- a/mozilla/content/html/content/public/nsITextControlElement.h
+++ b/mozilla/content/html/content/public/nsITextControlElement.h
@@ -55,6 +55,11 @@ public:
 
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_ITEXTCONTROLELEMENT_IID)
 
+  /**
+   * Set the control's value without security checks
+   */
+  NS_IMETHOD SetValueGuaranteed(const nsAReadableString& aValue) = 0;
+
   /**
    * Tell the control that value has been deliberately changed (or not).
    */
diff --git a/mozilla/content/html/content/src/nsHTMLInputElement.cpp b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
index c9b1fe8c477..00d10025a4d 100644
--- a/mozilla/content/html/content/src/nsHTMLInputElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
@@ -186,6 +186,7 @@ public:
   }
 
   // nsITextControlElement
+  NS_IMETHOD SetValueGuaranteed(const nsAReadableString& aValue);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
 
 protected:
@@ -416,6 +417,7 @@ nsHTMLInputElement::GetValue(nsAWritableString& aValue)
 {
   PRInt32 type;
   GetType(&type);
+
   if (type == NS_FORM_INPUT_TEXT || type == NS_FORM_INPUT_PASSWORD ||
       type == NS_FORM_INPUT_FILE) {
     nsIFormControlFrame* formControlFrame = nsnull;
@@ -425,15 +427,19 @@ nsHTMLInputElement::GetValue(nsAWritableString& aValue)
     // have) even if we force it to be created
     GetPrimaryFrame(this, formControlFrame, PR_FALSE, PR_FALSE);
 
-    nsIGfxTextControlFrame2* textControlFrame = nsnull;
+    PRBool frameOwnsValue = PR_FALSE;
     if (formControlFrame) {
+      nsIGfxTextControlFrame2* textControlFrame = nsnull;
       CallQueryInterface(formControlFrame, &textControlFrame);
+
+      if (textControlFrame) {
+        textControlFrame->OwnsValue(&frameOwnsValue);
+      } else {
+        // We assume if it's not a text control frame that it owns the value
+        frameOwnsValue = PR_TRUE;
+      }
     }
 
-    PRBool frameOwnsValue = PR_FALSE;
-    if (textControlFrame) {
-      textControlFrame->OwnsValue(&frameOwnsValue);
-    }
     if (frameOwnsValue) {
       formControlFrame->GetProperty(nsHTMLAtoms::value, aValue);
     } else {
@@ -443,7 +449,7 @@ nsHTMLInputElement::GetValue(nsAWritableString& aValue)
         aValue = NS_ConvertUTF8toUCS2(mValue);
       }
     }
- 
+
     return NS_OK;
   }
 
@@ -469,6 +475,12 @@ nsHTMLInputElement::SetValue(const nsAReadableString& aValue)
   return SetValueSecure(aValue, PR_TRUE);
 }
 
+NS_IMETHODIMP
+nsHTMLInputElement::SetValueGuaranteed(const nsAReadableString& aValue)
+{
+  return SetValueSecure(aValue, PR_FALSE);
+}
+
 NS_IMETHODIMP
 nsHTMLInputElement::SetValueSecure(const nsAReadableString& aValue,
                                    PRBool aCheckSecurity)
@@ -1849,6 +1861,7 @@ nsHTMLInputElement::GetMaxNumValues(PRInt32 *_retval)
   PRInt32 type;
   GetType(&type);
   *_retval = type == NS_FORM_INPUT_IMAGE ? 2 : 1;
+
   return NS_OK;
 }
 
diff --git a/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp b/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
index 0f2c8abb40d..391cc12f811 100644
--- a/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -113,6 +113,7 @@ public:
   NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   // nsITextControlElement
+  NS_IMETHOD SetValueGuaranteed(const nsAReadableString& aValue);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
 
   // nsIContent
@@ -422,6 +423,12 @@ nsHTMLTextAreaElement::GetValue(nsAWritableString& aValue)
 }
 
 
+NS_IMETHODIMP
+nsHTMLTextAreaElement::SetValueGuaranteed(const nsAReadableString& aValue)
+{
+  return SetValue(aValue);
+}
+
 NS_IMETHODIMP 
 nsHTMLTextAreaElement::SetValue(const nsAReadableString& aValue)
 {
diff --git a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
index 38e1c67df57..9915d0102f6 100644
--- a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
@@ -3402,19 +3402,10 @@ nsGfxTextControlFrame2::SetTextControlFrameState(const nsAReadableString& aValue
   else
   {
     // Otherwise set the value in content.
-    nsCOMPtr<nsIDOMHTMLInputElement> inputControl = do_QueryInterface(mContent);
-    if (inputControl)
+    nsCOMPtr<nsITextControlElement> textControl = do_QueryInterface(mContent);
+    if (textControl)
     {
-      inputControl->SetValue(aValue);
-    }
-    else
-    {
-      nsCOMPtr<nsIDOMHTMLTextAreaElement> textareaControl
-          = do_QueryInterface(mContent);
-      if (textareaControl)
-      {
-        textareaControl->SetValue(aValue);
-      }
+      textControl->SetValueGuaranteed(aValue);
     }
   }
 }