diff --git a/content/base/crashtests/554230-1.xhtml b/content/base/crashtests/554230-1.xhtml
new file mode 100644
index 000000000000..753d5c0fd725
--- /dev/null
+++ b/content/base/crashtests/554230-1.xhtml
@@ -0,0 +1,15 @@
+<html class="reftest-wait" xmlns="http://www.w3.org/1999/xhtml"><iframe contenteditable="true"></iframe><span></span><script style="display: none;" id="fuzz1" type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementsByTagName("iframe")[0].focus();
+  document.getElementsByTagName("span")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div"));
+  document.execCommand("selectAll", false, null);
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index d718b29cf662..ac5189a6d0d7 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -60,3 +60,4 @@ load 493281-2.html
 load 490760-1.xhtml
 load 494810-1.html
 load 529670.html
+load 554230-1.xhtml
diff --git a/content/base/src/nsCopySupport.cpp b/content/base/src/nsCopySupport.cpp
index f80b4522d42d..a8c1a0dcb740 100644
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@@ -629,6 +629,7 @@ nsCopySupport::CanCopy(nsIDocument* aDocument)
 
   nsCOMPtr<nsISelection> sel;
   GetSelectionForCopy(aDocument, getter_AddRefs(sel));
+  NS_ENSURE_TRUE(sel, PR_FALSE);
 
   PRBool isCollapsed;
   sel->GetIsCollapsed(&isCollapsed);
