diff --git a/mozilla/layout/forms/nsTextControlFrame.cpp b/mozilla/layout/forms/nsTextControlFrame.cpp
index 5b27195bc3e..3fda36c14b6 100644
--- a/mozilla/layout/forms/nsTextControlFrame.cpp
+++ b/mozilla/layout/forms/nsTextControlFrame.cpp
@@ -2344,7 +2344,8 @@ NS_IMETHODIMP nsTextControlFrame::SetProperty(nsPresContext* aPresContext, nsIAt
         // has changed.
         SetValueChanged(PR_TRUE);
       }
-      SetValue(aValue);   // set new text value
+      nsresult rv = SetValue(aValue);   // set new text value
+      NS_ENSURE_SUCCESS(rv, rv);
     }
     else if (nsHTMLAtoms::select == aName && mSelCon)
     {
@@ -3096,13 +3097,15 @@ nsTextControlFrame::GetValue(nsAString& aValue, PRBool aIgnoreWrap)
 
 // END IMPLEMENTING NS_IFORMCONTROLFRAME
 
-void
+nsresult
 nsTextControlFrame::SetValue(const nsAString& aValue)
 {
   // XXX this method should actually propagate errors!  It'd make debugging it
   // so much easier...
   if (mEditor && mUseEditor) 
   {
+    nsCOMPtr<nsIEditor> editor = mEditor;
+    nsWeakFrame weakFrame(this);
     nsAutoString currentValue;
     GetValue(currentValue, PR_FALSE);
     if (IsSingleLineTextControl())
@@ -3120,9 +3123,9 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
       nsFormControlHelper::PlatformToDOMLineBreaks(currentValue);
 
       nsCOMPtr<nsIDOMDocument>domDoc;
-      nsresult rv = mEditor->GetDocument(getter_AddRefs(domDoc));
-      if (NS_FAILED(rv)) return;
-      if (!domDoc) return;
+      nsresult rv = editor->GetDocument(getter_AddRefs(domDoc));
+      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_STATE(domDoc);
 
       // Time to mess with our security context... See comments in GetValue()
       // for why this is needed.  Note that we have to do this up here, because
@@ -3150,7 +3153,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
           stack->Pop(&cx);
           NS_ASSERTION(!cx, "Unexpected JSContext popped!");
         }
-        return;
+        return NS_ERROR_FAILURE;
       }
 
       // Since this code does not handle user-generated changes to the text,
@@ -3167,21 +3170,19 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
       // get the flags, remove readonly and disabled, set the value,
       // restore flags
       PRUint32 flags, savedFlags;
-      mEditor->GetFlags(&savedFlags);
+      editor->GetFlags(&savedFlags);
       flags = savedFlags;
       flags &= ~(nsIPlaintextEditor::eEditorDisabledMask);
       flags &= ~(nsIPlaintextEditor::eEditorReadonlyMask);
-      mEditor->SetFlags(flags);
-
+      editor->SetFlags(flags);
       if (currentValue.Length() < 1)
-        mEditor->DeleteSelection(nsIEditor::eNone);
+        editor->DeleteSelection(nsIEditor::eNone);
       else {
-        nsCOMPtr<nsIPlaintextEditor> textEditor = do_QueryInterface(mEditor);
+        nsCOMPtr<nsIPlaintextEditor> textEditor = do_QueryInterface(editor);
         if (textEditor)
           textEditor->InsertText(currentValue);
       }
-
-      mEditor->SetFlags(savedFlags);
+      editor->SetFlags(savedFlags);
       if (selPriv)
         selPriv->EndBatchChanges();
 
@@ -3191,6 +3192,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
         NS_ASSERTION(!cx, "Unexpected JSContext popped!");
       }
 
+      NS_ENSURE_STATE(weakFrame.IsAlive());
       if (outerTransaction)
         mNotifyOnInput = PR_TRUE;
 
@@ -3218,6 +3220,7 @@ nsTextControlFrame::SetValue(const nsAString& aValue)
       textControl->TakeTextFrameValue(aValue);
     }
   }
+  return NS_OK;
 }
 
 
diff --git a/mozilla/layout/forms/nsTextControlFrame.h b/mozilla/layout/forms/nsTextControlFrame.h
index 7d5b6dd09f5..8830bc9c7df 100644
--- a/mozilla/layout/forms/nsTextControlFrame.h
+++ b/mozilla/layout/forms/nsTextControlFrame.h
@@ -126,7 +126,11 @@ public:
   virtual void PostCreateFrames();
 
   // Utility methods to set current widget state
-  void SetValue(const nsAString& aValue);
+
+  // Be careful when using this method.
+  // Calling it may cause |this| to be deleted.
+  // In that case the method returns an error value.
+  nsresult SetValue(const nsAString& aValue);
   NS_IMETHOD SetInitialChildList(nsPresContext* aPresContext,
                                   nsIAtom*        aListName,
                                   nsIFrame*       aChildList);