http://trac.webkit.org/changeset/62136 and http://trac.webkit.org/changeset/63545 independently introduced wrong crash fixes to WebViewImpl::caretOrSelectionBounds, which were to check the existence of renderers at the start and the end of selection respectively.