As seen in bug 159062, DictionaryLookup::rangeAtHitTestResult returns a 1-character string when -[LULookupDefinitionModule tokenRangeForString:range:options:] returns (0, 0). This seems like a pretty crazy bug deep inside editing code - why do we do this? We pass (0, 0) to TextIterator::subrange, then it goes to characterSubrange, and it becomes 1-character when routed through a character iterator.