This seems to be regression by bug 1651705, not bug 1612802. Bug 1612802 is revert fix of bug 1612802 on Android only. I guess that IME_BLUR is fired after `SetOnBrowserChild` is called. Then we dispose current `GeckoEditableChild` unfortunately...
Bug 1684967 Comment 7 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
This seems to be regression by bug 1651705, not bug 1672095. Bug 1672095 is revert fix of bug 1612802 on Android only. I guess that IME_BLUR is fired after `SetOnBrowserChild` is called. Then we dispose current `GeckoEditableChild` unfortunately...