--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -284,22 +284,19 @@ HTMLEditor::HideGrabber()
   NS_ENSURE_TRUE(mGrabber, NS_ERROR_NULL_POINTER);
 
   // get the presshell's document observer interface.
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   // We allow the pres shell to be null; when it is, we presume there
   // are no document observers to notify, but we still want to
   // UnbindFromTree.
 
-  nsCOMPtr<nsIContent> parentContent = mGrabber->GetParent();
-  NS_ENSURE_TRUE(parentContent, NS_ERROR_NULL_POINTER);
-
-  DeleteRefToAnonymousNode(mGrabber, parentContent, ps);
+  DeleteRefToAnonymousNode(mGrabber, ps);
   mGrabber = nullptr;
-  DeleteRefToAnonymousNode(mPositioningShadow, parentContent, ps);
+  DeleteRefToAnonymousNode(mPositioningShadow, ps);
   mPositioningShadow = nullptr;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
 {
@@ -389,20 +386,17 @@ HTMLEditor::GrabberClicked()
 
 nsresult
 HTMLEditor::EndMoving()
 {
   if (mPositioningShadow) {
     nsCOMPtr<nsIPresShell> ps = GetPresShell();
     NS_ENSURE_TRUE(ps, NS_ERROR_NOT_INITIALIZED);
 
-    nsCOMPtr<nsIContent> parentContent = mGrabber->GetParent();
-    NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
-
-    DeleteRefToAnonymousNode(mPositioningShadow, parentContent, ps);
+    DeleteRefToAnonymousNode(mPositioningShadow, ps);
 
     mPositioningShadow = nullptr;
   }
   nsCOMPtr<nsIDOMEventTarget> piTarget = GetDOMEventTarget();
 
   if (piTarget && mMouseMotionListenerP) {
     DebugOnly<nsresult> rv =
       piTarget->RemoveEventListener(NS_LITERAL_STRING("mousemove"),

--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -258,40 +258,44 @@ HTMLEditor::CreateAnonymousElement(nsIAt
 }
 
 // Removes event listener and calls DeleteRefToAnonymousNode.
 void
 HTMLEditor::RemoveListenerAndDeleteRef(const nsAString& aEvent,
                                        nsIDOMEventListener* aListener,
                                        bool aUseCapture,
                                        Element* aElement,
-                                       nsIContent* aParentContent,
                                        nsIPresShell* aShell)
 {
   nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(aElement));
   if (evtTarget) {
     evtTarget->RemoveEventListener(aEvent, aListener, aUseCapture);
   }
-  DeleteRefToAnonymousNode(aElement, aParentContent, aShell);
+  DeleteRefToAnonymousNode(aElement, aShell);
 }
 
 // Deletes all references to an anonymous element
 void
 HTMLEditor::DeleteRefToAnonymousNode(nsIContent* aContent,
-                                     nsIContent* aParentContent,
                                      nsIPresShell* aShell)
 {
   // call ContentRemoved() for the anonymous content
   // node so its references get removed from the frame manager's
   // undisplay map, and its layout frames get destroyed!
 
   if (NS_WARN_IF(!aContent)) {
     return;
   }
 
+  nsIContent* parentContent = aContent->GetParent();
+  if (NS_WARN_IF(!parentContent)) {
+    // aContent was already removed?
+    return;
+  }
+
   nsAutoScriptBlocker scriptBlocker;
   // Need to check whether aShell has been destroyed (but not yet deleted).
   // In that case presContext->GetPresShell() returns nullptr.
   // See bug 338129.
   if (aContent->IsInComposedDoc() && aShell && aShell->GetPresContext() &&
       aShell->GetPresContext()->GetPresShell() == aShell) {
     nsCOMPtr<nsIDocumentObserver> docObserver = do_QueryInterface(aShell);
     if (docObserver) {
@@ -301,31 +305,31 @@ HTMLEditor::DeleteRefToAnonymousNode(nsI
       if (document) {
         docObserver->BeginUpdate(document, UPDATE_CONTENT_MODEL);
       }
 
       // XXX This is wrong (bug 439258).  Once it's fixed, the NS_WARNING
       // in RestyleManager::RestyleForRemove should be changed back
       // to an assertion.
       docObserver->ContentRemoved(aContent->GetComposedDoc(),
-                                  aParentContent, aContent, -1,
+                                  parentContent, aContent, -1,
                                   aContent->GetPreviousSibling());
       if (document) {
         docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
       }
     }
   }
 
   // Remove reference from the parent element.
   auto nac = static_cast<mozilla::ManualNAC*>(
-      aParentContent->GetProperty(nsGkAtoms::manualNACProperty));
+      parentContent->GetProperty(nsGkAtoms::manualNACProperty));
   MOZ_ASSERT(nac);
   nac->RemoveElement(aContent);
   if (nac->IsEmpty()) {
-    aParentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
+    parentContent->DeleteProperty(nsGkAtoms::manualNACProperty);
   }
 
   aContent->UnbindFromTree();
 }
 
 // The following method is mostly called by a selection listener. When a
 // selection change is notified, the method is called to check if resizing
 // handles, a grabber and/or inline table editing UI need to be displayed

--- a/editor/libeditor/HTMLEditor.h
+++ b/editor/libeditor/HTMLEditor.h
@@ -853,20 +853,18 @@ protected:
   nsTArray<PropItem*> mDefaultStyles;
 
 protected:
   // ANONYMOUS UTILS
   void RemoveListenerAndDeleteRef(const nsAString& aEvent,
                                   nsIDOMEventListener* aListener,
                                   bool aUseCapture,
                                   Element* aElement,
-                                  nsIContent* aParentContent,
                                   nsIPresShell* aShell);
   void DeleteRefToAnonymousNode(nsIContent* aContent,
-                                nsIContent* aParentContent,
                                 nsIPresShell* aShell);
 
   nsresult ShowResizersInner(nsIDOMElement *aResizedElement);
 
   /**
    * Returns the offset of an element's frame to its absolute containing block.
    */
   nsresult GetElementOrigin(nsIDOMElement* aElement,

--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -378,62 +378,56 @@ HTMLEditor::HideResizers()
   NS_ENSURE_TRUE(mResizedObject, NS_OK);
 
   // get the presshell's document observer interface.
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   // We allow the pres shell to be null; when it is, we presume there
   // are no document observers to notify, but we still want to
   // UnbindFromTree.
 
-  nsCOMPtr<nsIContent> parentContent;
-
-  if (mTopLeftHandle) {
-    parentContent = mTopLeftHandle->GetParent();
-  }
-
   NS_NAMED_LITERAL_STRING(mousedown, "mousedown");
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mTopLeftHandle, parentContent, ps);
+                             mTopLeftHandle, ps);
   mTopLeftHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mTopHandle, parentContent, ps);
+                             mTopHandle, ps);
   mTopHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mTopRightHandle, parentContent, ps);
+                             mTopRightHandle, ps);
   mTopRightHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mLeftHandle, parentContent, ps);
+                             mLeftHandle, ps);
   mLeftHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mRightHandle, parentContent, ps);
+                             mRightHandle, ps);
   mRightHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mBottomLeftHandle, parentContent, ps);
+                             mBottomLeftHandle, ps);
   mBottomLeftHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mBottomHandle, parentContent, ps);
+                             mBottomHandle, ps);
   mBottomHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mBottomRightHandle, parentContent, ps);
+                             mBottomRightHandle, ps);
   mBottomRightHandle = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mResizingShadow, parentContent, ps);
+                             mResizingShadow, ps);
   mResizingShadow = nullptr;
 
   RemoveListenerAndDeleteRef(mousedown, mEventListener, true,
-                             mResizingInfo, parentContent, ps);
+                             mResizingInfo, ps);
   mResizingInfo = nullptr;
 
   if (mActivatedHandle) {
     mActivatedHandle->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_activated,
                                 true);
     mActivatedHandle = nullptr;
   }
 

--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -105,30 +105,27 @@ HTMLEditor::HideInlineTableEditingUI()
   RemoveMouseClickListener(mAddRowAfterButton);
 
   // get the presshell's document observer interface.
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   // We allow the pres shell to be null; when it is, we presume there
   // are no document observers to notify, but we still want to
   // UnbindFromTree.
 
-  // get the root content node.
-  nsCOMPtr<nsIContent> bodyContent = GetRoot();
-
-  DeleteRefToAnonymousNode(mAddColumnBeforeButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mAddColumnBeforeButton, ps);
   mAddColumnBeforeButton = nullptr;
-  DeleteRefToAnonymousNode(mRemoveColumnButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mRemoveColumnButton, ps);
   mRemoveColumnButton = nullptr;
-  DeleteRefToAnonymousNode(mAddColumnAfterButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mAddColumnAfterButton, ps);
   mAddColumnAfterButton = nullptr;
-  DeleteRefToAnonymousNode(mAddRowBeforeButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mAddRowBeforeButton, ps);
   mAddRowBeforeButton = nullptr;
-  DeleteRefToAnonymousNode(mRemoveRowButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mRemoveRowButton, ps);
   mRemoveRowButton = nullptr;
-  DeleteRefToAnonymousNode(mAddRowAfterButton, bodyContent, ps);
+  DeleteRefToAnonymousNode(mAddRowAfterButton, ps);
   mAddRowAfterButton = nullptr;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLEditor::DoInlineTableEditingAction(nsIDOMElement* aElement)
 {