diff --git a/mozilla/editor/libeditor/base/nsSelectionState.cpp b/mozilla/editor/libeditor/base/nsSelectionState.cpp
index b6adbc2463d..314e971ad46 100644
--- a/mozilla/editor/libeditor/base/nsSelectionState.cpp
+++ b/mozilla/editor/libeditor/base/nsSelectionState.cpp
@@ -423,9 +423,9 @@ nsRangeUpdater::SelAdjJoinNodes(nsIDOMNode *aLeftNode,
     item = (nsRangeStore*)mArray.ElementAt(i);
     if (!item) return NS_ERROR_NULL_POINTER;
     
-    // adjust endpoints in aParent
     if (item->startNode.get() == aParent)
     {
+      // adjust start point in aParent
       if (item->startOffset > aOffset)
       {
         item->startOffset--;
@@ -437,8 +437,20 @@ nsRangeUpdater::SelAdjJoinNodes(nsIDOMNode *aLeftNode,
         item->startOffset = aOldLeftNodeLength;
       }
     }
+    else if (item->startNode.get() == aRightNode)
+    {
+      // adjust start point in aRightNode
+      item->startOffset += aOldLeftNodeLength;
+    }
+    else if (item->startNode.get() == aLeftNode)
+    {
+      // adjust start point in aLeftNode
+      item->startNode = aRightNode;
+    }
+
     if (item->endNode.get() == aParent)
     {
+      // adjust end point in aParent
       if (item->endOffset > aOffset)
       {
         item->endOffset--;
@@ -450,16 +462,16 @@ nsRangeUpdater::SelAdjJoinNodes(nsIDOMNode *aLeftNode,
         item->endOffset = aOldLeftNodeLength;
       }
     }
-    // adjust endpoints in aRightNode
-    if (item->startNode.get() == aRightNode)
-      item->startOffset += aOldLeftNodeLength;
-    if (item->endNode.get() == aRightNode)
-      item->endOffset += aOldLeftNodeLength;
-    // adjust endpoints in aLeftNode
-    if (item->startNode.get() == aLeftNode)
-      item->startNode = aRightNode;
-    if (item->endNode.get() == aLeftNode)
+    else if (item->endNode.get() == aRightNode)
+    {
+      // adjust end point in aRightNode
+       item->endOffset += aOldLeftNodeLength;
+    }
+    else if (item->endNode.get() == aLeftNode)
+    {
+      // adjust end point in aLeftNode
       item->endNode = aRightNode;
+    }
   }
   
   return NS_OK;
diff --git a/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp b/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp
index 5384079e468..c80bc7725c0 100644
--- a/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp
+++ b/mozilla/editor/libeditor/html/nsHTMLDataTransfer.cpp
@@ -1146,15 +1146,6 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 
       rv = nsuiEvent->GetRangeOffset(&newSelectionOffset);
       if (NS_FAILED(rv)) return rv;
-      /* Creating a range to store insert position because when
-         we delete the selection, range gravity will make sure the insertion
-         point is in the correct place */
-      nsCOMPtr<nsIDOMRange> destinationRange;
-      rv = CreateRange(newSelectionParent, newSelectionOffset,newSelectionParent, newSelectionOffset, getter_AddRefs(destinationRange));
-      if (NS_FAILED(rv))
-        return rv;
-      if(!destinationRange)
-        return NS_ERROR_FAILURE;
 
       // We never have to delete if selection is already collapsed
       PRBool deleteSelection = PR_FALSE;
@@ -1214,6 +1205,9 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 
       if (deleteSelection)
       {
+        // Use an auto tracker so that our drop point is correctly
+        // positioned after the delete.
+        nsAutoTrackDOMPoint tracker(mRangeUpdater, &newSelectionParent, &newSelectionOffset);
         rv = DeleteSelection(eNone);
         if (NS_FAILED(rv)) return rv;
       }
@@ -1223,15 +1217,6 @@ NS_IMETHODIMP nsHTMLEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
       if (!(deleteSelection && srcdomdoc != destdomdoc))
       {
         // Move the selection to the point under the mouse cursor
-        rv = destinationRange->GetStartContainer(getter_AddRefs(newSelectionParent));
-        if (NS_FAILED(rv))
-          return rv;
-        if(!newSelectionParent)
-          return NS_ERROR_FAILURE;
-       
-        rv = destinationRange->GetStartOffset(&newSelectionOffset);
-        if (NS_FAILED(rv))
-          return rv;
         selection->Collapse(newSelectionParent, newSelectionOffset);
       }      
       // We have to figure out whether to delete and relocate caret only once
diff --git a/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp
index e3e7382596d..29fa8aff5a5 100644
--- a/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp
+++ b/mozilla/editor/libeditor/text/nsPlaintextDataTransfer.cpp
@@ -250,15 +250,6 @@ NS_IMETHODIMP nsPlaintextEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 
       rv = nsuiEvent->GetRangeOffset(&newSelectionOffset);
       if (NS_FAILED(rv)) return rv;
-      /* Creating a range to store insert position because when
-         we delete the selection, range gravity will make sure the insertion
-         point is in the correct place */
-      nsCOMPtr<nsIDOMRange> destinationRange;
-      rv = CreateRange(newSelectionParent, newSelectionOffset,newSelectionParent, newSelectionOffset, getter_AddRefs(destinationRange));
-      if (NS_FAILED(rv))
-        return rv;
-      if(!destinationRange)
-        return NS_ERROR_FAILURE;
 
       // We never have to delete if selection is already collapsed
       PRBool deleteSelection = PR_FALSE;
@@ -318,6 +309,9 @@ NS_IMETHODIMP nsPlaintextEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
 
       if (deleteSelection)
       {
+        // Use an auto tracker so that our drop point is correctly
+        // positioned after the delete.
+        nsAutoTrackDOMPoint tracker(mRangeUpdater, &newSelectionParent, &newSelectionOffset);
         rv = DeleteSelection(eNone);
         if (NS_FAILED(rv)) return rv;
       }
@@ -327,15 +321,6 @@ NS_IMETHODIMP nsPlaintextEditor::InsertFromDrop(nsIDOMEvent* aDropEvent)
       if (!(deleteSelection && srcdomdoc != destdomdoc))
       {
         // Move the selection to the point under the mouse cursor
-        rv = destinationRange->GetStartContainer(getter_AddRefs(newSelectionParent));
-        if (NS_FAILED(rv))
-          return rv;
-        if(!newSelectionParent)
-          return NS_ERROR_FAILURE;
-       
-        rv = destinationRange->GetStartOffset(&newSelectionOffset);
-        if (NS_FAILED(rv))
-          return rv;
         selection->Collapse(newSelectionParent, newSelectionOffset);
       }      
       // We have to figure out whether to delete and relocate caret only once