diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index caebedc..3180c16 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2016-09-27  Nan Wang  <n_wang@apple.com>
+
+        AX: CrashTracer: com.apple.WebKit.WebContent at WebCore::AXObjectCache::localCaretRectForCharacterOffset(WebCore::RenderObject*&, WebCore::CharacterOffset const&) + 116
+        https://bugs.webkit.org/show_bug.cgi?id=162654
+
+        Reviewed by Chris Fleizach.
+
+        * accessibility/mac/bounds-for-range-crash-expected.txt: Added.
+        * accessibility/mac/bounds-for-range-crash.html: Added.
+
 2016-09-27  Ryosuke Niwa  <rniwa@webkit.org>
 
         Toggling display: none on a parent element of a slot which shares style with its parent doesn't update the slot's visibility
diff --git a/LayoutTests/accessibility/mac/bounds-for-range-crash-expected.txt b/LayoutTests/accessibility/mac/bounds-for-range-crash-expected.txt
new file mode 100644
index 0000000..ae85db0
--- /dev/null
+++ b/LayoutTests/accessibility/mac/bounds-for-range-crash-expected.txt
@@ -0,0 +1,10 @@
+Shop
+This tests that boundsForRange with invalid text marker is not causing crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/mac/bounds-for-range-crash.html b/LayoutTests/accessibility/mac/bounds-for-range-crash.html
new file mode 100644
index 0000000..aec3a99
--- /dev/null
+++ b/LayoutTests/accessibility/mac/bounds-for-range-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+
+<a id="link" href="">
+Shop<img alt="">
+</a>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("This tests that boundsForRange with invalid text marker is not causing crash.");
+    
+    if (window.accessibilityController) {
+        var textChild = accessibilityController.accessibleElementById("link").childAtIndex(0);
+        
+        // Make sure calling boundsForRange won't cause crash.
+        var bounds = textChild.boundsForRange(0, 5);
+    }
+</script>
+
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 2839345..f8f7ae7 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2016-09-27  Nan Wang  <n_wang@apple.com>
+
+        AX: CrashTracer: com.apple.WebKit.WebContent at WebCore::AXObjectCache::localCaretRectForCharacterOffset(WebCore::RenderObject*&, WebCore::CharacterOffset const&) + 116
+        https://bugs.webkit.org/show_bug.cgi?id=162654
+
+        Reviewed by Chris Fleizach.
+
+        rangeForUnorderedCharacterOffsets() can return a null Range but we failed to
+        do a null check in localCaretRectForCharacterOffset() before dereferencing it.
+
+        Test: accessibility/mac/bounds-for-range-crash.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::localCaretRectForCharacterOffset):
+
 2016-09-27  Alex Christensen  <achristensen@webkit.org>
 
         Inline critical functions in URLParser
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index 6516368..9d42cc6 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -2463,6 +2463,9 @@
     int caretOffset;
     // Use a collapsed range to get the position.
     RefPtr<Range> range = rangeForUnorderedCharacterOffsets(characterOffset, characterOffset);
+    if (!range)
+        return IntRect();
+    
     Position startPosition = range->startPosition();
     startPosition.getInlineBoxAndOffset(DOWNSTREAM, inlineBox, caretOffset);