This bug has always been there in a way, but bug 821307 made it actually obvious. The test case in that bug hits this. Basically what happened is that bug 821307 moved the GetValue call further up in nsTextEditor::PrepareEditor() and in that test case when we call GetValue we end up taking the first branch in the function but we read the wrong cached value. The value cache was not updated in the SetValue call which happened while the text control did not have a bound frame. Because in general we can't trust the cached value when we don't have an editor attached, we should clear it out when the editor is being destroyed.

Comment on attachment 8413293 [details] [diff] [review] Clear the value cache when the editor is being destroyed because it won't get updated when we don't have a bound frame Fast reviews appreciated, as I want to land this before we branch 31 off.

Comment on attachment 8413293 [details] [diff] [review] Clear the value cache when the editor is being destroyed because it won't get updated when we don't have a bound frame r=me