diff --git a/widget/src/windows/nsToolkit.cpp b/widget/src/windows/nsToolkit.cpp
index 74bb6b91ece6..7c486094cbc8 100644
--- a/widget/src/windows/nsToolkit.cpp
+++ b/widget/src/windows/nsToolkit.cpp
@@ -54,7 +54,7 @@ NS_IMPL_ISUPPORTS1(nsToolkit, nsIToolkit)
 static PRUintn gToolkitTLSIndex = 0;
 
 HINSTANCE nsToolkit::mDllInstance = 0;
-PRBool    nsToolkit::mIsNT        = PR_FALSE;
+PRBool    nsToolkit::mUseImeApiW  = PR_FALSE;
 
 #ifdef MOZ_AIMM
 IActiveIMMApp* nsToolkit::gAIMMApp   = NULL;
@@ -224,14 +224,35 @@ nsToolkit::Startup(HMODULE hModule)
     VERIFY(::RegisterClass(&wc));
 
     //
-    // Set flag of nsToolkit::mIsNT due to using Unicode API.
+    // Set flag of nsToolkit::mUseImeApiW due to using Unicode API.
     //
 
-    OSVERSIONINFO osversion;
-    ::ZeroMemory(&osversion, sizeof(OSVERSIONINFO));
-    osversion.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
-    ::GetVersionEx(&osversion);
-    nsToolkit::mIsNT = (osversion.dwPlatformId == VER_PLATFORM_WIN32_NT) ? PR_TRUE : PR_FALSE;
+    OSVERSIONINFOEX osversion;
+    BOOL osVersionInfoEx;
+    
+    ::ZeroMemory(&osversion, sizeof(OSVERSIONINFOEX));
+    osversion.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
+
+    if (!(osVersionInfoEx = GetVersionEx((OSVERSIONINFO *)&osversion))) {
+      // if OSVERSIONINFOEX doesn't work, try OSVERSIONINFO.
+      osversion.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
+      if (!GetVersionEx((OSVERSIONINFO *)&osversion)) {
+        // maybe we are running on very old Windows OS. Assign FALSE.
+        nsToolkit::mUseImeApiW = PR_FALSE; 
+        return;
+      }
+    }
+
+    nsToolkit::mUseImeApiW = (osversion.dwPlatformId == VER_PLATFORM_WIN32_NT);
+    if (nsToolkit::mUseImeApiW)  {
+      // XXX Hack for stopping the crash (125573)
+      if (osversion.dwMajorVersion == 5 && (osversion.dwMinorVersion == 0 || osversion.dwMinorVersion == 1))  { 
+        // "Microsoft Windows 2000 " or "Microsoft Windows XP "
+        if (936 == ::GetACP())  // Chinese (PRC, Singapore)
+          nsToolkit::mUseImeApiW = PR_FALSE;
+      }
+    }
+
 }
 
 
diff --git a/widget/src/windows/nsToolkit.h b/widget/src/windows/nsToolkit.h
index 85b0180844c2..eff60a5ade09 100644
--- a/widget/src/windows/nsToolkit.h
+++ b/widget/src/windows/nsToolkit.h
@@ -89,7 +89,7 @@ protected:
 public:
     static HINSTANCE mDllInstance;
     // OS flag
-    static PRBool    mIsNT;
+    static PRBool    mUseImeApiW;
 
     static void Startup(HINSTANCE hModule);
     static void Shutdown();
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index 9fce529e4e67..3489e282d714 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -5132,7 +5132,7 @@ nsWindow::HandleTextEvent(HIMC hIMEContext,PRBool aCheckAttr)
   // convert the composition string text into unicode before it is sent to xp-land
   // but, on Windows NT / 2000, need not convert.
   //
-  if (!nsToolkit::mIsNT) {
+  if (!nsToolkit::mUseImeApiW) {
     unicharSize = ::MultiByteToWideChar(gCurrentKeyboardCP,MB_PRECOMPOSED,
       mIMECompString->get(),
       mIMECompString->Length(),
@@ -5302,7 +5302,7 @@ nsWindow::MapDBCSAtrributeArrayToUnicodeOffsets(PRUint32* textRangeListLengthRes
   // IME strings already store to mIMECompUnicode.
   //
 
-  long maxlen = nsToolkit::mIsNT ? mIMECompUnicode->Length() : mIMECompString->Length();
+  long maxlen = nsToolkit::mUseImeApiW ? mIMECompUnicode->Length() : mIMECompString->Length();
   long cursor = mIMECursorPosition;
   NS_ASSERTION(cursor <= maxlen, "wrong cursor positoin");
   if(cursor > maxlen)
@@ -5315,12 +5315,12 @@ nsWindow::MapDBCSAtrributeArrayToUnicodeOffsets(PRUint32* textRangeListLengthRes
 		*textRangeListLengthResult = 2;
 		*textRangeListResult = new nsTextRange[2];
 		(*textRangeListResult)[0].mStartOffset=0;
-		substringLength = nsToolkit::mIsNT ? mIMECompUnicode->Length() :
+		substringLength = nsToolkit::mUseImeApiW ? mIMECompUnicode->Length() :
       ::MultiByteToWideChar(gCurrentKeyboardCP,MB_PRECOMPOSED,
 				mIMECompString->get(), maxlen,NULL,0);
 		(*textRangeListResult)[0].mEndOffset = substringLength;
 		(*textRangeListResult)[0].mRangeType = NS_TEXTRANGE_RAWINPUT;
-		substringLength = nsToolkit::mIsNT ? cursor :
+		substringLength = nsToolkit::mUseImeApiW ? cursor :
       ::MultiByteToWideChar(gCurrentKeyboardCP,MB_PRECOMPOSED,mIMECompString->get(),
 								cursor,NULL,0);
 		(*textRangeListResult)[1].mStartOffset=substringLength;
@@ -5341,7 +5341,7 @@ nsWindow::MapDBCSAtrributeArrayToUnicodeOffsets(PRUint32* textRangeListLengthRes
 		// figure out the cursor position
 		//
 		
-		substringLength =  nsToolkit::mIsNT ? cursor :
+		substringLength =  nsToolkit::mUseImeApiW ? cursor :
       ::MultiByteToWideChar(gCurrentKeyboardCP,
           MB_PRECOMPOSED,mIMECompString->get(),cursor,NULL,0);
 		(*textRangeListResult)[0].mStartOffset=substringLength;
@@ -5364,7 +5364,7 @@ nsWindow::MapDBCSAtrributeArrayToUnicodeOffsets(PRUint32* textRangeListLengthRes
         PlatformToNSAttr(mIMEAttributeString[lastMBCSOffset]);
 			(*textRangeListResult)[rangePointer].mStartOffset = lastUnicodeOffset;
 
-			lastUnicodeOffset += nsToolkit::mIsNT ? current - lastMBCSOffset :
+			lastUnicodeOffset += nsToolkit::mUseImeApiW ? current - lastMBCSOffset :
         ::MultiByteToWideChar(gCurrentKeyboardCP,
           MB_PRECOMPOSED,mIMECompString->get()+lastMBCSOffset,
 				current-lastMBCSOffset,NULL,0);
@@ -5462,7 +5462,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
     //
 
 		long compStrLen;
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       // Imm* Unicode API works on Windows NT / 2000.
       NS_IMM_GETCOMPOSITIONSTRINGW(hIMEContext, GCS_RESULTSTR, NULL, 0, compStrLen);
 
@@ -5511,7 +5511,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 		// This provides us with the attribute string necessary 
 		// for doing hiliting
 		long attrStrLen;
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       // Imm* Unicode API works on Windows NT / 2000.
       NS_IMM_GETCOMPOSITIONSTRINGW(hIMEContext, GCS_COMPATTR, NULL, 0, attrStrLen);
       if (attrStrLen > mIMEAttributeStringSize) {
@@ -5541,7 +5541,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 		//--------------------------------------------------------
 		long compClauseLen;
     long compClauseLen2;
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       // Imm* Unicode API works on Windows NT / 2000.
       NS_IMM_GETCOMPOSITIONSTRINGW(hIMEContext,
         GCS_COMPCLAUSE, NULL, 0, compClauseLen);
@@ -5587,7 +5587,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 		//--------------------------------------------------------
 		// 3. Get GCS_CURSOPOS
 		//--------------------------------------------------------
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       // Imm* Unicode API works on Windows NT / 2000.
       NS_IMM_GETCOMPOSITIONSTRINGW(hIMEContext, GCS_CURSORPOS, NULL, 0, mIMECursorPosition);
     } else {
@@ -5598,7 +5598,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 		// 4. Get GCS_COMPSTR
 		//--------------------------------------------------------
 		long compStrLen;
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       // Imm* Unicode API works on Windows NT / 2000.
       NS_IMM_GETCOMPOSITIONSTRINGW(hIMEContext, GCS_COMPSTR, NULL, 0, compStrLen);
 
@@ -5628,7 +5628,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 #ifdef DEBUG
                 for(int kk=0;kk<mIMECompClauseStringLength;kk++)
                 {
-                  NS_ASSERTION(mIMECompClauseString[kk] <= (nsToolkit::mIsNT ? mIMECompUnicode->Length() : mIMECompString->Length()), "illegal pos");
+                  NS_ASSERTION(mIMECompClauseString[kk] <= (nsToolkit::mUseImeApiW ? mIMECompUnicode->Length() : mIMECompString->Length()), "illegal pos");
                 }
 #endif
 		//--------------------------------------------------------
@@ -5645,7 +5645,7 @@ BOOL nsWindow::OnIMEComposition(LPARAM  aGCS)
 		if(! mIMEIsComposing) 
 			HandleStartComposition(hIMEContext);
 
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       mIMECompUnicode->Truncate();
     } else {
       mIMECompString->Truncate();
@@ -5689,7 +5689,7 @@ BOOL nsWindow::OnIMEEndComposition()
 		// first when we hit space in composition mode
 		// we need to clear out the current composition string 
 		// in that case. 
-    if (nsToolkit::mIsNT) {
+    if (nsToolkit::mUseImeApiW) {
       mIMECompUnicode->Truncate(0);
     } else {
       mIMECompString->Truncate(0);