In Source/WebKit/ios/DefaultDelegates/WebDefaultUIKitDelegate.m, this method is defined as:

- (void)deleteFromInputwithFlags:(NSUInteger)flags
{
}

However, in Source/WebKit/ios/WebView/WebUIKitDelegate.h, it's defined in a category (not a protocol) as:

- (void)deleteFromInputWithFlags:(NSUInteger)flags;

This causes problems in Source/WebKit/mac/WebView/WebHTMLView.mm in -_handleEditingKeyEvent: where we use -_UIKitDelegateForwarder to forward the method:

        switch ([s characterAtIndex:0]) {
        case kWebBackspaceKey:
        case kWebDeleteKey:
            [[webView _UIKitDelegateForwarder] deleteFromInputWithFlags:event.keyboardFlags];
            return YES;

This was recently changed for Bug 157689 in r200979 from this:

        switch ([s characterAtIndex:0]) {
        case kWebBackspaceKey:
        case kWebDeleteKey:
            // FIXME: remove the call to deleteFromInput when UIKit implements deleteFromInputWithFlags.
            if ([webView respondsToSelector:@selector(deleteFromInputWithFlags:)])
                [[webView _UIKitDelegateForwarder] deleteFromInputWithFlags:event.keyboardFlags];
            else
                [[webView _UIKitDelegateForwarder] deleteFromInput];
            return YES;

Finally, since the _UIKitDelegateForwarded always uses the WebDefaultUIKitDelegate to check whether the method exists, -[_WebSafeForwarder methodSignatureForSelector:] in Source/WebKit/mac/WebView/WebView.mm would return NO, which results in the NSException being thrown, leading to the crash:

- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector
{
    return [defaultTarget methodSignatureForSelector:aSelector];
}

The fix is trivial--fix the typo in WebDefaultUIKitDelegate.m.