Problem: It seems that, under circumstances I do not understand, some NaN value gets passed to getState and then on to $tokenizeRows which causes empty array to be returned. getState then tries to access element 0 of this array and ugly things start to happen.

Solution: never return empty array from $tokenizeRows

lib/ace/background_tokenizer.js

@@ -130,8 +130,8 @@ var BackgroundTokenizer = function(tokenizer, editor) {
     };
 
     this.$tokenizeRows = function(firstRow, lastRow) {
-        if (!this.doc)
-            return [];
+        if (!this.doc || isNaN(firstRow) || isNaN(lastRow))
+            return [{'state':'start','tokens':[]}];
             
         var rows = [];