See crash/44999870b04a3fa9 for an example crash.

Stack:
	0x92a2a5c8	(libchrome.so -Node.h:893 )	<name omitted>
0x92a2a5af	(libchrome.so -EphemeralRange.cpp:146 )	blink::EphemeralRangeTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::RangeOfContents(blink::Node const&)
0x9425640d	(libchrome.so -PlainTextRange.cpp:81 )	blink::PlainTextRange::CreateRangeFor(blink::ContainerNode const&, blink::PlainTextRange::GetRangeFor) const
0x942563b5	(libchrome.so -PlainTextRange.cpp:56 )	blink::PlainTextRange::CreateRange(blink::ContainerNode const&) const
0x942550d3	(libchrome.so -InputMethodController.cpp:508 )	blink::InputMethodController::AddImeTextSpans(WTF::Vector<blink::ImeTextSpan, 0u, WTF::PartitionAllocator> const&, blink::ContainerNode*, unsigned int)
0x9425543d	(libchrome.so -InputMethodController.cpp:779 )	blink::InputMethodController::SetComposition(WTF::String const&, WTF::Vector<blink::ImeTextSpan, 0u, WTF::PartitionAllocator> const&, int, int)
0x9429a9d5	(libchrome.so -WebInputMethodControllerImpl.cpp:75 )	blink::WebInputMethodControllerImpl::SetComposition(blink::WebString const&, blink::WebVector<blink::WebImeTextSpan> const&, blink::WebRange const&, int, int)
0x946fc9e1	(libchrome.so -render_widget.cc:1677 )	content::RenderWidget::OnImeSetComposition(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int)
0x946ff745	(libchrome.so -tuple.h:56 )	void base::DispatchToMethodImpl<content::RenderWidget*, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int), std::__ndk1::tuple<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> >, gfx::Range, int, int>, 0u, 1u, 2u, 3u, 4u>(content::RenderWidget* const&, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int), std::__ndk1::tuple<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> >, gfx::Range, int, int>&&, std::__ndk1::integer_sequence<unsigned int, 0u, 1u, 2u, 3u, 4u>)
0x946ff717	(libchrome.so -tuple.h:63 )	void IPC::DispatchToMethod<content::RenderWidget, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int), void, std::__ndk1::tuple<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> >, gfx::Range, int, int> >(content::RenderWidget*, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int), void*, std::__ndk1::tuple<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> >, gfx::Range, int, int>&&)
0x946fc8ff	(libchrome.so -ipc_message_templates.h:146 )	bool IPC::MessageT<InputMsg_ImeSetComposition_Meta, std::__ndk1::tuple<std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> >, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> >, gfx::Range, int, int>, void>::Dispatch<content::RenderWidget, content::RenderWidget, void, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int)>(IPC::Message const*, content::RenderWidget*, content::RenderWidget*, void*, void (content::RenderWidget::*)(std::__ndk1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__ndk1::allocator<unsigned short> > const&, std::__ndk1::vector<blink::WebImeTextSpan, std::__ndk1::allocator<blink::WebImeTextSpan> > const&, gfx::Range const&, int, int))
0x92839fd9	(libchrome.so -render_widget.cc:624 )	content::RenderWidget::OnMessageReceived(IPC::Message const&)