--- a/mobile/android/base/GeckoEditable.java
+++ b/mobile/android/base/GeckoEditable.java
@@ -978,18 +978,20 @@ final class GeckoEditable
             // return an empty value instead.
             if (!(e.getCause() instanceof IndexOutOfBoundsException)) {
                 // Only handle IndexOutOfBoundsException for now,
                 // as other exceptions might signal other bugs
                 throw e;
             }
             Log.w(LOGTAG, "Exception in GeckoEditable." + method.getName(), e.getCause());
             Class<?> retClass = method.getReturnType();
-            if (retClass != Void.TYPE && retClass.isPrimitive()) {
-                ret = retClass.newInstance();
+            if (retClass == Character.TYPE) {
+                ret = '\0';
+            } else if (retClass == Integer.TYPE) {
+                ret = 0;
             } else if (retClass == String.class) {
                 ret = "";
             } else {
                 ret = null;
             }
         }
         if (DEBUG) {
             StringBuilder log = new StringBuilder(method.getName());

--- a/mobile/android/base/GeckoInputConnection.java
+++ b/mobile/android/base/GeckoInputConnection.java
@@ -679,16 +679,27 @@ class GeckoInputConnection
             // text from the old composing span
             return replaceComposingSpanWithSelection() &&
                 mKeyInputConnection.commitText(text, newCursorPosition);
         }
         return super.commitText(text, newCursorPosition);
     }
 
     @Override
+    public boolean setSelection(int start, int end) {
+        if (start < 0 || end < 0) {
+            // Some keyboards (e.g. Samsung) can call setSelection with
+            // negative offsets. In that case we ignore the call, similar to how
+            // BaseInputConnection.setSelection ignores offsets that go past the length.
+            return true;
+        }
+        return super.setSelection(start, end);
+    }
+
+    @Override
     public boolean sendKeyEvent(KeyEvent event) {
         // BaseInputConnection.sendKeyEvent() dispatches the key event to the main thread.
         // In order to ensure events are processed in the proper order, we must block the
         // IC thread until the main thread finishes processing the key event
         super.sendKeyEvent(event);
         final View v = getView();
         if (v == null) {
             return false;