diff --git a/dom/base/Element.cpp b/dom/base/Element.cpp
index 42b2567bcc8c..0b0c907e6955 100644
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -282,41 +282,20 @@ void Element::UpdateState(bool aNotify) {
 }  // namespace mozilla
 
 void nsIContent::UpdateEditableState(bool aNotify) {
-  // Guaranteed to be non-element content
-  NS_ASSERTION(!IsElement(), "What happened here?");
   nsIContent* parent = GetParent();
 
-  // Skip over unknown native anonymous content to avoid setting a flag we
-  // can't clear later
-  bool isUnknownNativeAnon = false;
-  if (IsInNativeAnonymousSubtree()) {
-    isUnknownNativeAnon = true;
-    nsCOMPtr<nsIContent> root = this;
-    while (root && !root->IsRootOfNativeAnonymousSubtree()) {
-      root = root->GetParent();
-    }
-    // root should always be true here, but isn't -- bug 999416
-    if (root) {
-      nsIFrame* rootFrame = root->GetPrimaryFrame();
-      if (rootFrame) {
-        nsContainerFrame* parentFrame = rootFrame->GetParent();
-        nsITextControlFrame* textCtrl = do_QueryFrame(parentFrame);
-        isUnknownNativeAnon = !textCtrl;
-      }
-    }
-  }
-
+  // Don't implicitly set the flag on the root of a native anonymous subtree.
+  // This needs to be set explicitly, see for example
+  // nsTextControlFrame::CreateRootNode().
   SetEditableFlag(parent && parent->HasFlag(NODE_IS_EDITABLE) &&
-                  !isUnknownNativeAnon);
+                  !IsRootOfNativeAnonymousSubtree());
 }
 
 namespace mozilla {
 namespace dom {
 
 void Element::UpdateEditableState(bool aNotify) {
-  nsIContent* parent = GetParent();
-
-  SetEditableFlag(parent && parent->HasFlag(NODE_IS_EDITABLE));
+  nsIContent::UpdateEditableState(aNotify);
   if (aNotify) {
     UpdateState(aNotify);
   } else {
diff --git a/dom/base/nsIContentInlines.h b/dom/base/nsIContentInlines.h
index 26b51b9ae91e..026ba1c42433 100644
--- a/dom/base/nsIContentInlines.h
+++ b/dom/base/nsIContentInlines.h
@@ -153,9 +153,14 @@ inline bool nsINode::IsEditable() const {
     return true;
   }
 
-  Document* doc = GetUncomposedDoc();
+  // All editable anonymous content should be made explicitly editable via the
+  // NODE_IS_EDITABLE flag.
+  if (IsInNativeAnonymousSubtree()) {
+    return false;
+  }
 
   // Check if the node is in a document and the document is in designMode.
+  Document* doc = GetUncomposedDoc();
   return doc && doc->HasFlag(NODE_IS_EDITABLE);
 }
 
diff --git a/layout/base/crashtests/1511563.html b/layout/base/crashtests/1511563.html
new file mode 100644
index 000000000000..6baac7d8fb65
--- /dev/null
+++ b/layout/base/crashtests/1511563.html
@@ -0,0 +1,8 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  document.designMode='on'
+  window.getSelection().modify('move', 'right', 'line')
+})
+</script>
+<br>
+<keygen>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 68e54d46365d..febb76c32939 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -556,3 +556,4 @@ pref(layout.css.column-span.enabled,true) load 1507244.html
 load 1510080.html
 load 1510485.html
 pref(layout.css.column-span.enabled,true) load 1511535.html
+load 1511563.html
diff --git a/widget/tests/test_imestate.html b/widget/tests/test_imestate.html
index 7129bf22d08a..41cdcd8da5a4 100644
--- a/widget/tests/test_imestate.html
+++ b/widget/tests/test_imestate.html
@@ -406,7 +406,7 @@ function runBasicTest(aIsEditable, aInDesignMode, aDescription)
       description: "input[type=file]",
       focusable: !aInDesignMode,
       focusEventNotFired: aIsEditable && !aInDesignMode,
-      expectedEnabled: kEnabledStateOnNonEditableElement },
+      expectedEnabled: kEnabledStateOnReadonlyField },
     { id: "button",
       description: "input[type=button]",
       focusable: !aInDesignMode,