diff --git a/editor/libeditor/html/crashtests/793866.html b/editor/libeditor/html/crashtests/793866.html
new file mode 100644
index 000000000000..4984474dbc04
--- /dev/null
+++ b/editor/libeditor/html/crashtests/793866.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var b = document.body;
+  b.contentEditable = "true";
+  document.execCommand("contentReadOnly", false, null);
+  b.focus();
+  b.contentEditable = "false";
+  document.documentElement.contentEditable = "true";
+  document.createDocumentFragment().appendChild(b);
+  document.documentElement.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
index 8cf65364169f..4e6a585fdf98 100644
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -35,3 +35,4 @@ load 766795.html
 load 767169.html
 load 769967.xhtml
 load 768748.html
+needs-focus load 793866.html
diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.cpp b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
index 72af2ad5bf5b..e6447b4f9a3d 100644
--- a/extensions/spellcheck/src/mozInlineSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -1780,10 +1780,12 @@ NS_IMETHODIMP mozInlineSpellChecker::UpdateCurrentDictionary()
     previousDictionary.Truncate();
   }
 
+  // This might set mSpellCheck to null (bug 793866)
   nsresult rv = mSpellCheck->UpdateCurrentDictionary();
 
   nsAutoString currentDictionary;
-  if (NS_FAILED(mSpellCheck->GetCurrentDictionary(currentDictionary))) {
+  if (!mSpellCheck ||
+      NS_FAILED(mSpellCheck->GetCurrentDictionary(currentDictionary))) {
     currentDictionary.Truncate();
   }
 
