Try to fix a renderer crash.

content/renderer/render_view_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 4286 matching lines @@
            it != plugin_delegates_.end(); ++it) {
         (*it)->ImeCompositionCompleted(text, focused_plugin_id_);
       }
       return;
     }
 #endif
     if (replacement_range.IsValid() && webview()) {
       // Select the text in |replacement_range|, it will then be replaced by
       // text added by the call to RenderWidget::OnImeConfirmComposition().
       if (WebFrame* frame = webview()->focusedFrame()) {
-        frame->setSelectionToRange(
-            WebRange::fromDocumentRange(frame,
-                                        replacement_range.start(),
-                                        replacement_range.length()));
+        WebRange webrange = WebRange::fromDocumentRange(
+            frame, replacement_range.start(), replacement_range.length());
+        if (!webrange.isNull())
+          frame->setSelectionToRange(webrange);
       }
     }
     RenderWidget::OnImeConfirmComposition(text, replacement_range);
   }
 }
 
 ui::TextInputType RenderViewImpl::GetTextInputType() {
   return pepper_delegate_.IsPluginFocused() ?
       pepper_delegate_.GetTextInputType() : RenderWidget::GetTextInputType();
 }
@@ skipping 351 matching lines @@
   return webview()->settings()->useThreadedCompositor();
 }
 
 void RenderViewImpl::OnJavaBridgeInit(
     const IPC::ChannelHandle& channel_handle) {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this, channel_handle));
 #endif
 }