Mozilla/5.0 (Maemo;Linux armv71; rv:2.0b8pre) Gecko/20101105 Firefox/4.0b8pre Fennec/4.0b3pre 1. close the hardware keyboard 2. go to http://people.mozilla.com/~nhirata/html_tp/formsninput.html 3. click in the text area box (the box that states "The cat was playing in the garden") 4. dismiss the virtual keyboard Expected: no crash, return to the browser Actual: content crash

I forgot to mention: Use landscape mode

It was mentioned this could be related to bug 609374.

Please enabled litmus test when this bug is fixed: https://litmus.mozilla.org/show_test.cgi?searchType=by_id&id=13776

We need a stack.

nhirata ^

i haven't seen this, if you can reproduce and/or have a stack, please reopen.

Related : 603641 NEW Crash may occur when clicking in the awesome bar right after being in form view [@ nsIMEStateManager::GetFocusSelectionAndRoot ] 605989 RESOLVED crash in [@ nsIMEStateManager::GetFocusSelectionAndRoot ] after changing IMEs typing in RTL and then going back to the text using the Form Helper Content Crash: Crashing Thread Frame Module Signature [Expand] Source 0 libxul.so nsIMEStateManager::GetFocusSelectionAndRoot content/events/src/nsIMEStateManager.cpp:661 1 libxul.so nsContentEventHandler::OnSelectionEvent content/events/src/nsContentEventHandler.cpp:934 2 libxul.so nsEventStateManager::PreHandleEvent content/events/src/nsEventStateManager.cpp:1410 3 libxul.so PresShell::HandleEventInternal layout/base/nsPresShell.cpp:6923 4 libxul.so PresShell::HandleEvent layout/base/nsPresShell.cpp:6687 5 libxul.so nsViewManager::HandleEvent view/src/nsViewManager.cpp:1092 6 libxul.so nsViewManager::DispatchEvent view/src/nsViewManager.cpp:1070 7 libxul.so HandleEvent view/src/nsView.cpp:161 8 libxul.so mozilla::widget::PuppetWidget::DispatchEvent widget/src/xpwidgets/PuppetWidget.cpp:299 9 libxul.so mozilla::widget::PuppetWidget::DispatchEvent widget/src/xpwidgets/PuppetWidget.cpp:306 10 libxul.so mozilla::dom::TabChild::DispatchWidgetEvent dom/ipc/TabChild.cpp:623 11 libxul.so mozilla::dom::TabChild::RecvSelectionEvent dom/ipc/TabChild.cpp:611 12 libxul.so mozilla::dom::PBrowserChild::OnMessageReceived PBrowserChild.cpp:1115 13 libxul.so mozilla::dom::PContentChild::OnMessageReceived PContentChild.cpp:762 14 libxul.so mozilla::ipc::AsyncChannel::OnDispatchMessage ipc/glue/AsyncChannel.cpp:262 15 libxul.so mozilla::ipc::RPCChannel::OnMaybeDequeueOne ipc/glue/RPCChannel.cpp:438 16 libxul.so RunnableMethod<mozilla::ipc::RPCChannel,bool ,Tuple0>::Run ipc/chromium/src/base/tuple.h:383 17 libxul.so mozilla::ipc::RPCChannel::DequeueTask::Run RPCChannel.h:449 18 libxul.so MessageLoop::RunTask ipc/chromium/src/base/message_loop.cc:343 19 libxul.so MessageLoop::DeferOrRunPendingTask ipc/chromium/src/base/message_loop.cc:351 20 libxul.so MessageLoop::DoWork ipc/chromium/src/base/message_loop.cc:451 21 libxul.so mozilla::ipc::DoWorkRunnable::Run ipc/glue/MessagePump.cpp:70 22 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:610 23 libxul.so NS_ProcessNextEvent_P nsThreadUtils.cpp:250 24 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:134 25 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:229 26 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:219 27 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:202 28 libxul.so nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:181 29 libxul.so XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp:631 30 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:215 31 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:219 32 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:202 33 libxul.so XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp:506 34 plugin-container main ipc/app/MozillaRuntimeMain.cpp:80 35 libc-2.5.so libc-2.5.so@0x14973 36 plugin-container plugin-container@0x10eb 37 libc-2.5.so libc-2.5.so@0x14927 38 libpthread-2.5.so libpthread-2.5.so@0x122f 39 ld-2.5.so ld-2.5.so@0x134c3 40 libc-2.5.so libc-2.5.so@0xb23b 41 ld-2.5.so ld-2.5.so@0xd8ab 42 libc-2.5.so libc-2.5.so@0xb23b 43 ld-2.5.so ld-2.5.so@0xe247

I can't reproduce this.