--- a/widget/android/GeckoEditableSupport.cpp
+++ b/widget/android/GeckoEditableSupport.cpp
@@ -986,17 +986,18 @@ GeckoEditableSupport::OnImeReplaceText(i
 
     RefPtr<TextComposition> composition(GetComposition());
     MOZ_ASSERT(!composition || !composition->IsEditorHandlingEvent());
 
     nsString string(aText->ToString());
     const bool composing = !mIMERanges->IsEmpty();
     nsEventStatus status = nsEventStatus_eIgnore;
 
-    if (!mIMEKeyEvents.IsEmpty() || !mDispatcher->IsComposing() ||
+    if (!mIMEKeyEvents.IsEmpty() ||
+        !composition || !mDispatcher->IsComposing() ||
         uint32_t(aStart) != composition->NativeOffsetOfStartComposition() ||
         uint32_t(aEnd) != composition->NativeOffsetOfStartComposition() +
                           composition->String().Length()) {
         // Only start a new composition if we have key events,
         // if we don't have an existing composition, or
         // the replaced text does not match our composition.
         RemoveComposition();
 
@@ -1147,17 +1148,17 @@ GeckoEditableSupport::OnImeUpdateComposi
      * text content.  Only the offsets are specified and not the text content
      * to eliminate the possibility of this event altering the text content
      * unintentionally.
      */
     nsString string;
     RefPtr<TextComposition> composition(GetComposition());
     MOZ_ASSERT(!composition || !composition->IsEditorHandlingEvent());
 
-    if (!mDispatcher->IsComposing() ||
+    if (!composition || !mDispatcher->IsComposing() ||
         uint32_t(aStart) != composition->NativeOffsetOfStartComposition() ||
         uint32_t(aEnd) != composition->NativeOffsetOfStartComposition() +
                           composition->String().Length()) {
         if (keepCurrent) {
             // Don't start a new composition if we want to keep the current one.
             mIMERanges->Clear();
             return;
         }