Carmen says:

I reproduced the issue (following the steps bellow) in IE 8.0.7600 on Windows 7, and IE 8.0.6001 on Windows XP (icepc4), using ICEfaces 2.0.2 code version deployed locally on tomcat7. This happens only if setting focus in the Input Rich Text.

IE browser crashes when navigating away from Rich Text to any other component in IE 8.0.6001.
IE browser crashes when navigating back to Rich Text from any other component in IE 8.0.7600.

Screen shots attached.

I also tested this using latest trunk version (#25268), using same browser version (IE 8.0.6001) on Windows XP (icepc4).
First, there is a JS error when loading component-showcase app (JIRA-7134 has been created for this issue).

When clicking on Rich Text link an error message is displayed in a popup: "TypeError: Object doesn't support this property or method", error details are bellow.
If closing this JS error message, Rich Text does not display its content on the page (there is no Input Rich Text). If clicking a second time on Rich Text nothing changes on the page.
Navigating away from Rich Text to another component works fine, but when selecting again Rich Text the JS error pops up again.

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB7.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MDDS; .NET4.0C)
Timestamp: Wed, 17 Aug 2011 20:51:44 UTC

Message: Object doesn't support this property or method
Line: 1924
Char: 5
Code: 0
URI: http://localhost:8080/component-showcase/javax.faces.resource/icepush.js.jsf

Message: Object expected
Line: 14352745
Char: 1
Code: 0
URI: http://localhost:8080/component-showcase/showcase.jsf

Applied the fix described here: http://jira.icefaces.org/browse/ICE-6714?focusedCommentId=34776&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#action_34776 . It seems that when while working on ICE-6714 we forgot about ICEfaces2.

Need to analyze the root cause of the issue with ICEfaces EE 2.0 level code, which is based on FCKeditor, not the newer CKEditor used by 2.0.2 and 2.1 in the future.

IE8 crashes while JSF tries to cleanup the replaced elements in browser's document to avoid memory leaks (more on that here: http://weblogs.java.net/blog/driscoll/archive/2009/11/13/ie-memory-management-and-you ). But the crash during cleanup seems to be caused by the presence of one of more dynamically created iframes inside the updated element.

The attached patch removes pre-emptively the included iframes to avoid the hard crash that occurs when iframes are removed by updating innerHTML or outerHTML to the empty string.

Retested using ICEfaces3/trunk revision 26767 in IE 8.0.7601 on Windows7 and found the JS error still occurs:

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; MDDS; .NET4.0C)
Timestamp: Wed, 7 Dec 2011 21:59:09 UTC

Message: Object expected
Line: 13315273
Char: 1
Code: 0
URI: http://localhost:8080/sc10371/

Another observation that might be related:

I was running the ACE Showcase from the latest on the trunk and noticed that in the ace:linkButton demo when I press the Action Navigation button that it does a "forward-style" navigation to the new location. Watching the console, I see a lot of extra activity (GETs, etc) where it looks as if it's trying to get resources. This only happens with Mojarra. MyFaces seems to be fine.

Modified BridgeSetup to add the mandatory resources first, when some resources are already added they would be replaced without changing their order. Modified PropagatingNavigationHandler to propagate the oldDOM whenever a forward navigation is triggered to allow the dom-diff to run and avoid a full page DOM update. Fixed unescapeHtml() JS function to test for empty string or null input before executing.