diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 7291fd3d10eb..13efabadc6fc 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2306,11 +2306,20 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
     // In table selection mode, a nearest scrollable frame should capture the
     // mouse events.
     if (captureMouse) {
+      // NOTE: we must have set a content to capture already.  The content is
+      // selection root of this frame.  Therefore, when there is no scrollable
+      // frame, we don't need to reset the capturing content.
+      NS_ASSERTION(nsIPresShell::GetCapturingContent() != nsnull,
+                   "Someone must have captured mouse event already");
       nsIScrollableFrame* scrollableFrame =
         FindNearestScrollableFrameForSelection(this);
-      nsIFrame* frame = do_QueryFrame(scrollableFrame);
-      nsIPresShell::SetCapturingContent(frame->GetContent(),
-                                        CAPTURE_IGNOREALLOWED);
+      if (scrollableFrame) {
+        nsIFrame* frame = do_QueryFrame(scrollableFrame);
+        nsIContent* contentToCaptureForTableSelection =
+          GetContentToCaptureForSelection(frame->GetContent());
+        nsIPresShell::SetCapturingContent(contentToCaptureForTableSelection,
+                                          CAPTURE_IGNOREALLOWED);
+      }
     }
     fs->SetMouseDownState(PR_TRUE);
     return fs->HandleTableSelection(parentContent, contentOffset, target, me);
diff --git a/layout/generic/test/Makefile.in b/layout/generic/test/Makefile.in
index 742e7ca4ce42..8c630791356e 100644
--- a/layout/generic/test/Makefile.in
+++ b/layout/generic/test/Makefile.in
@@ -138,6 +138,7 @@ _CHROME_FILES = \
   test_selection_scrolling.html \
   window_selection_scrolling.html \
   test_bug670058.html \
+  test_bug670508.html \
   $(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/layout/generic/test/test_bug670508.html b/layout/generic/test/test_bug670508.html
new file mode 100644
index 000000000000..facd62829e53
--- /dev/null
+++ b/layout/generic/test/test_bug670508.html
@@ -0,0 +1,37 @@
+<!DOCTYPE>
+<html>
+<head>
+<title>test for bug 670508</title>
+<script type="text/javascript"
+  src="chrome://mochikit/content/MochiKit/packed.js"></script>
+<script type="text/javascript"
+  src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="text/javascript"
+  src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+<link rel="stylesheet" type="text/css"
+  href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<table>
+  <tr>
+    <td id="td" contenteditable="true">
+      here is an editable table cell
+    </td>
+  </tr>
+</table>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+
+function doTest() {
+  synthesizeMouse(document.getElementById('td'), 5, 5, { ctrlKey: true });
+  ok(true, "not crashed");
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForFocus(doTest, window);
+
+</script>
+</pre>
+</body>
+</html>
