Crash while doing Flash IME. b=443024 r=josh,masayuki sr=vlad a=ss

widget/src/cocoa/nsChildView.h

@@ -197,6 +197,8 @@ public:
   static PRBool IsIMEEnabled() { return sIsIMEEnabled; }
   static PRBool IgnoreCommit() { return sIgnoreCommit; }
 
+  static void OnDestroyView(NSView<mozView>* aDestroyingView);
+
   // Note that we cannot get the actual state in TSM. But we can trust this
   // value. Because nsIMEStateManager reset this at every focus changing.
   static PRBool IsRomanKeyboardsOnly() { return sIsRomanKeyboardsOnly; }

widget/src/cocoa/nsChildView.mm

@@ -2226,6 +2226,7 @@ NSEvent* gLastDragEvent = nil;
 
 - (void)widgetDestroyed
 {
+  nsTSMManager::OnDestroyView(self);
   mGeckoChild = nsnull;
   // Just in case we're destroyed abruptly and missed the draggingExited
   // or performDragOperation message.
@@ -5957,6 +5958,18 @@ static BOOL keyUpAlreadySentKeyDown = NO;
 #pragma mark -
 
 
+void
+nsTSMManager::OnDestroyView(NSView<mozView>* aDestroyingView)
+{
+  if (aDestroyingView != sComposingView)
+    return;
+  if (IsComposing()) {
+    CancelIME(); // XXX Might CancelIME() fail because sComposingView is being destroyed?
+    EndComposing();
+  }
+}
+
+
 PRBool
 nsTSMManager::GetIMEOpenState()
 {