--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -974,16 +974,26 @@ IMEStateManager::OnCompositionEventDisca
   // Ignore compositionstart for now because sTextCompositions may not have
   // been created yet.
   if (aCompositionEvent->message == NS_COMPOSITION_START) {
     return;
   }
 
   nsRefPtr<TextComposition> composition =
     sTextCompositions->GetCompositionFor(aCompositionEvent->widget);
+  if (!composition) {
+    // If the PresShell has been being destroyed during composition,
+    // a TextComposition instance for the composition was already removed from
+    // the array and destroyed in OnDestroyPresContext().  Therefore, we may
+    // fail to retrieve a TextComposition instance here.
+    PR_LOG(sISMLog, PR_LOG_ALWAYS,
+      ("ISM:   IMEStateManager::OnCompositionEventDiscarded(), "
+       "TextComposition instance for the widget has already gone"));
+    return;
+  }
   composition->OnCompositionEventDiscarded(aCompositionEvent);
 }
 
 // static
 nsresult
 IMEStateManager::NotifyIME(IMEMessage aMessage,
                            nsIWidget* aWidget)
 {