--- a/layout/base/nsCaret.cpp
+++ b/layout/base/nsCaret.cpp
@@ -173,17 +173,16 @@ nsCaret::nsCaret()
 , mShowDuringSelection(PR_FALSE)
 , mIgnoreUserModify(PR_TRUE)
 #ifdef IBMBIDI
 , mKeyboardRTL(PR_FALSE)
 , mLastBidiLevel(0)
 #endif
 , mLastContentOffset(0)
 , mLastHint(nsFrameSelection::HINTLEFT)
-, mLastFrameOffset(0)
 {
 }
 
 //-----------------------------------------------------------------------------
 nsCaret::~nsCaret()
 {
   KillTimer();
 }
@@ -296,17 +295,16 @@ void nsCaret::Terminate()
   nsCOMPtr<nsISelection> domSelection = do_QueryReferent(mDomSelectionWeak);
   nsCOMPtr<nsISelectionPrivate> privateSelection(do_QueryInterface(domSelection));
   if (privateSelection)
     privateSelection->RemoveSelectionListener(this);
   mDomSelectionWeak = nsnull;
   mPresShell = nsnull;
 
   mLastContent = nsnull;
-  mLastFrame = nsnull;
 }
 
 //-----------------------------------------------------------------------------
 NS_IMPL_ISUPPORTS1(nsCaret, nsISelectionListener)
 
 //-----------------------------------------------------------------------------
 nsISelection* nsCaret::GetCaretDOMSelection()
 {
@@ -500,18 +498,18 @@ nsresult nsCaret::DrawAtPosition(nsIDOMN
 }
 
 nsIFrame * nsCaret::GetCaretFrame(PRInt32 *aOffset)
 {
   // Return null if we're not drawn to prevent anybody from trying to draw us.
   if (!mDrawn)
     return nsnull;
 
-  // Recompute the frame that we're supposed to draw in if the cached frame
-  // is stale (dead).
+  // Recompute the frame that we're supposed to draw in to guarantee that
+  // we're not going to try to draw into a stale (dead) frame.
   PRInt32 offset;
   nsIFrame *frame = nsnull;
   nsresult rv = GetCaretFrameForNodeOffset(mLastContent, mLastContentOffset,
                                            mLastHint, mLastBidiLevel, &frame,
                                            &offset);
   if (NS_FAILED(rv))
     return nsnull;
 
@@ -737,26 +735,16 @@ nsCaret::DrawAtPositionWithHint(nsIDOMNo
 nsresult 
 nsCaret::GetCaretFrameForNodeOffset(nsIContent*             aContentNode,
                                     PRInt32                 aOffset,
                                     nsFrameSelection::HINT aFrameHint,
                                     PRUint8                 aBidiLevel,
                                     nsIFrame**              aReturnFrame,
                                     PRInt32*                aReturnOffset)
 {
-  // Try to see if we can use our cached frame
-  if (mLastFrame.IsAlive() &&
-      mLastContent == aContentNode &&
-      mLastContentOffset == aOffset &&
-      mLastHint == aFrameHint &&
-      mLastBidiLevel == aBidiLevel) {
-    *aReturnFrame = mLastFrame;
-    *aReturnOffset = mLastFrameOffset;
-    return NS_OK;
-  }
 
   //get frame selection and find out what frame to use...
   nsCOMPtr<nsIPresShell> presShell = do_QueryReferent(mPresShell);
   if (!presShell)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsFrameSelection> frameSelection = GetFrameSelection();
   if (!frameSelection)
@@ -907,18 +895,16 @@ nsCaret::GetCaretFrameForNodeOffset(nsIC
             }
           }   
         }
       }
     }
   }
   *aReturnFrame = theFrame;
   *aReturnOffset = theFrameOffset;
-  mLastFrame = theFrame;
-  mLastFrameOffset = theFrameOffset;
   return NS_OK;
 }
 
 nsresult nsCaret::CheckCaretDrawingState()
 {
   if (mDrawn) {
     // The caret is drawn; if it shouldn't be, erase it.
     if (!mVisible || !MustDrawCaret(PR_TRUE))

--- a/layout/base/nsCaret.h
+++ b/layout/base/nsCaret.h
@@ -288,21 +288,18 @@ protected:
     nsRect                mCaretRect;         // the last caret rect, in the coodinates of the last frame.
 
     nsCOMPtr<nsIContent>  mLastContent;       // store the content the caret was last requested to be drawn
                                               // in (by DrawAtPosition()/DrawCaret()),
                                               // note that this can be different than where it was
                                               // actually drawn (anon <BR> in text control)
     PRInt32               mLastContentOffset; // the offset for the last request
 
-    nsFrameSelection::HINT mLastHint;         // the hint associated with the last request, see also
-                                              // mLastBidiLevel above
-
-    nsWeakFrame           mLastFrame;         // the last frame on which the caret has been drawn.
-    PRInt32               mLastFrameOffset;   // the frame offset for the last caret position
+    nsFrameSelection::HINT mLastHint;        // the hint associated with the last request, see also
+                                              // mLastBidiLevel below
 
 };
 
 nsresult
 NS_NewCaret(nsCaret** aInstancePtrResult);
 
 // handy stack-based class for temporarily disabling the caret