--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5036,16 +5036,23 @@ nsCSSFrameConstructor::AddFrameConstruct
     // "is possible restyle root" flags, and need to.  Otherwise we can
     // end up with stale such flags (e.g. if we used to have a
     // display:none parent when our last restyle was posted and
     // processed and now no longer do).
     aContent->UnsetFlags(ELEMENT_ALL_RESTYLE_FLAGS &
                          ~ELEMENT_PENDING_RESTYLE_FLAGS);
   }
 
+  // XXX the GetContent() != aContent check is needed due to bug 135040.
+  // Remove it once that's fixed.  
+  NS_ASSERTION(!aContent->GetPrimaryFrame() ||
+    aContent->GetPrimaryFrame()->GetContent() != aContent ||
+    aState.mCreatingExtraFrames,
+    "asked to create frame construction item for a node that already has a frame");
+
   // don't create a whitespace frame if aParent doesn't want it
   if (!NeedFrameFor(aState, aParentFrame, aContent)) {
     return;
   }
 
   // never create frames for comments or PIs
   if (aContent->IsNodeOfType(nsINode::eCOMMENT) ||
       aContent->IsNodeOfType(nsINode::ePROCESSING_INSTRUCTION))
@@ -6476,16 +6483,28 @@ nsCSSFrameConstructor::ContentAppended(n
            static_cast<void*>(aContainer), aFirstNewContent,
            aAllowLazyConstruction);
     if (gReallyNoisyContentUpdates && aContainer) {
       aContainer->List(stdout, 0);
     }
   }
 #endif
 
+#ifdef DEBUG
+  for (nsIContent* child = aFirstNewContent;
+       child;
+       child = child->GetNextSibling()) {
+    // XXX the GetContent() != child check is needed due to bug 135040.
+    // Remove it once that's fixed.  
+    NS_ASSERTION(!child->GetPrimaryFrame() ||
+                 child->GetPrimaryFrame()->GetContent() != child,
+                 "asked to construct a frame for a node that already has a frame");
+  }
+#endif
+
 #ifdef MOZ_XUL
   if (aContainer) {
     PRInt32 namespaceID;
     nsIAtom* tag =
       mDocument->BindingManager()->ResolveTag(aContainer, &namespaceID);
 
     // Just ignore tree tags, anyway we don't create any frames for them.
     if (tag == nsGkAtoms::treechildren ||
@@ -6827,16 +6846,28 @@ nsCSSFrameConstructor::ContentRangeInser
         aContainer->List(stdout,0);
       } else {
         aStartChild->List(stdout, 0);
       }
     }
   }
 #endif
 
+#ifdef DEBUG
+  for (nsIContent* child = aStartChild;
+       child != aEndChild;
+       child = child->GetNextSibling()) {
+    // XXX the GetContent() != child check is needed due to bug 135040.
+    // Remove it once that's fixed.  
+    NS_ASSERTION(!child->GetPrimaryFrame() ||
+                 child->GetPrimaryFrame()->GetContent() != child,
+                 "asked to construct a frame for a node that already has a frame");
+  }
+#endif
+
   nsresult rv = NS_OK;
 
   PRBool isSingleInsert = (aStartChild->GetNextSibling() == aEndChild);
   NS_ASSERTION(isSingleInsert || !aAllowLazyConstruction,
                "range insert shouldn't be lazy");
   NS_ASSERTION(isSingleInsert || aEndChild,
                "range should not include all nodes after aStartChild");