A null check was lost in selectedRange(), causing crashes.
Created attachment 90109 [details] proposed patch
An alternative would be to return false in TextIterator::locationAndLengthFromRange(), which is what WebPage::getLocationAndLengthFromRange used to do. Sorry that I introduced so many regressions :/
Comment on attachment 90109 [details] proposed patch r=me
Committed <http://trac.webkit.org/changeset/84202>.