fix bug 71274. r=nhotta sr=jst

remove bad code which may cause crash
work around the condition which will case IME crash on Mac when Mac cabonalized MSL does not comfirm to
ISO C++ standard and return null when ask for new xxx[0];

content/events/src/nsDOMEvent.cpp

@@ -184,9 +184,13 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent, const nsAR
 			}
 		}
 		
-		mTextRange = (nsIPrivateTextRangeList*) new nsPrivateTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
-		if (mTextRange!=nsnull)  mTextRange->AddRef();
 	  }
+	  // We need to create mTextRange even rangeCount is 0. 
+	  // if rangeCount is 0, mac carbon will return 0 for new and tempTextRangeList will be null. but we should still
+	  // create mTextRange, otherwise, we will crash it later when some code call GetInputRange and AddRef to the result
+	mTextRange = (nsIPrivateTextRangeList*) new nsPrivateTextRangeList(((nsTextEvent*)aEvent)->rangeCount,tempTextRangeList);
+	if (mTextRange!=nsnull)  
+		mTextRange->AddRef();
   }
 
   NS_INIT_REFCNT();

content/events/src/nsPrivateTextRange.cpp

@@ -74,12 +74,14 @@ NS_METHOD nsPrivateTextRange::SetRangeType(PRUint16 aRangeType)
 }
 
 
-nsPrivateTextRangeList::nsPrivateTextRangeList(PRUint16 aLength,nsIPrivateTextRange** aList)
-:	mLength(aLength),
-	mList(aList)
+nsPrivateTextRangeList::nsPrivateTextRangeList(PRUint16 aLength,
+                                               nsIPrivateTextRange** aList)
+:	mLength(aLength), mList(aList)
 {
-	if (aList==nsnull)
-		aLength = 0;
+        if(! aList) {
+           NS_WARN_IF_FALSE(!aLength, "Geez, this deosn't make sense");
+           mLength = 0;
+        }
 
 	NS_INIT_REFCNT();
 }
@@ -105,7 +107,7 @@ NS_METHOD nsPrivateTextRangeList::GetLength(PRUint16* aLength)
 
 NS_METHOD nsPrivateTextRangeList::Item(PRUint16 aIndex, nsIPrivateTextRange** aReturn)
 {
-	if (aIndex>mLength) {
+	if (aIndex>=mLength) {
 		*aReturn = nsnull;
 		return NS_ERROR_FAILURE;
 	}