diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -389,17 +389,19 @@ nsINode::GetSelectionRootContent(nsIPres
 {
   NS_ENSURE_TRUE(aPresShell, nsnull);
 
   if (IsNodeOfType(eDOCUMENT))
     return static_cast<nsIDocument*>(this)->GetRootContent();
   if (!IsNodeOfType(eCONTENT))
     return nsnull;
 
-  NS_ENSURE_TRUE(GetCurrentDoc() == aPresShell->GetDocument(), nsnull);
+  if (GetCurrentDoc() != aPresShell->GetDocument()) {
+    return nsnull;
+  }
 
   nsIFrame* frame = static_cast<nsIContent*>(this)->GetPrimaryFrame();
   if (frame && frame->GetStateBits() & NS_FRAME_INDEPENDENT_SELECTION) {
     // This node should be a descendant of input/textarea editor.
     nsIContent* content = GetTextEditorRootContent();
     if (content)
       return content;
   }
diff --git a/editor/libeditor/html/nsHTMLEditor.cpp b/editor/libeditor/html/nsHTMLEditor.cpp
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -4090,17 +4090,17 @@ nsHTMLEditor::SelectAll()
   rv = selection->GetAnchorNode(getter_AddRefs(anchorNode));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIContent> anchorContent = do_QueryInterface(anchorNode, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIPresShell> ps = do_QueryReferent(mPresShellWeak);
   nsIContent *rootContent = anchorContent->GetSelectionRootContent(ps);
-  NS_ASSERTION(rootContent, "GetSelectionRootContent failed");
+  NS_ENSURE_TRUE(rootContent, NS_ERROR_UNEXPECTED);
 
   nsCOMPtr<nsIDOMNode> rootElement = do_QueryInterface(rootContent, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return selection->SelectAllChildren(rootElement);
 }
 
 
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -883,26 +883,28 @@ nsFrameSelection::ConstrainFrameAndPoint
     return NS_ERROR_FAILURE;
   
   //
   // Now find the root of the subtree containing the anchor's content.
   //
 
   NS_ENSURE_STATE(mShell);
   nsIContent* anchorRoot = anchorContent->GetSelectionRootContent(mShell);
+  NS_ENSURE_TRUE(anchorRoot, NS_ERROR_UNEXPECTED);
 
   //
   // Now find the root of the subtree containing aFrame's content.
   //
 
   nsIContent* content = aFrame->GetContent();
 
   if (content)
   {
     nsIContent* contentRoot = content->GetSelectionRootContent(mShell);
+    NS_ENSURE_TRUE(contentRoot, NS_ERROR_UNEXPECTED);
 
     if (anchorRoot == contentRoot)
     {
       // If the aFrame's content isn't the capturing content, it should be
       // a descendant.  At this time, we can return simply.
       nsIContent* capturedContent = nsIPresShell::GetCapturingContent();
       if (capturedContent != content)
       {
@@ -920,16 +922,17 @@ nsFrameSelection::ConstrainFrameAndPoint
       // If the mouse cursor in on a frame which is descendant of same
       // selection root, we can expand the selection to the frame.
       if (cursorFrame && cursorFrame->PresContext()->PresShell() == mShell)
       {
         nsIContent* cursorContent = cursorFrame->GetContent();
         NS_ENSURE_TRUE(cursorContent, NS_ERROR_FAILURE);
         nsIContent* cursorContentRoot =
           cursorContent->GetSelectionRootContent(mShell);
+        NS_ENSURE_TRUE(cursorContentRoot, NS_ERROR_UNEXPECTED);
         if (cursorContentRoot == anchorRoot)
         {
           *aRetFrame = cursorFrame;
           aRetPoint = aPoint + aFrame->GetOffsetTo(cursorFrame);
           return NS_OK;
         }
       }
       // Otherwise, e.g., the cursor isn't on any frames (e.g., the mouse