When the last character in a text input field is deleted, a <br> placeholder is inserted. The problem is that textContent returns "\n" for a <br> even if it's collapsed. In HTMLInputElement:setValueFromRenderer(), value = "\n" and constrainValue(value) = "".
See Bug 9358 for the original issue (an assertion failure).
textContent also returns '\n' for a '\n' even if it is collapsed. Renaming.
I believe the behavior of textContent is correct, and it's the client that has a problem. I believe this bug report may be INVALID.