Bug 1009036 - Watch out for frame destruction caused by EnsureFrameForTextNode.  r=roc