This bug was split off from crasher bug 109754, which was fixed with a simple null check, but the cause is still present ... The basic problem is that the rev 1.170 checkin to nsGfxTextControlFrame2.cpp by jst/jkeiser, modified the Destroy() method to call GetTextControlFrameState(), which uses the editor. We shouldn't be doing that since at the time Destroy() is called, there are no guarantees that some of the things the editor relies on, for example style contexts, content, etc., are going to be around. We need to find some other place to retrieve the value of the editor, before Destroy() is called. Perhaps the frame manager has a notification we can hook into?
Setting milestone to 1.0 because of bug 74091.
Moving to Moz1.1
This was fixed in bug 132334.
code level fix; need help from development to verify. Charley/Kathy, can you please verify these and mark verified-fixed ? thanks.