We are seeing that firstRectFromCharacterRange is sometimes called with an invalid range. <rdar://problem/16397583>
Created attachment 227535 [details] proposed fix
Comment on attachment 227535 [details] proposed fix Clearing flags on attachment: 227535 Committed r166115: <http://trac.webkit.org/changeset/166115>
All reviewed patches have been landed. Closing bug.