Index: /CKEditor/branches/versions/3.4.x/_source/plugins/specialchar/dialogs/specialchar.js
===================================================================
--- /CKEditor/branches/versions/3.4.x/_source/plugins/specialchar/dialogs/specialchar.js	(revision 5772)
+++ /CKEditor/branches/versions/3.4.x/_source/plugins/specialchar/dialogs/specialchar.js	(revision 5773)
@@ -30,6 +30,9 @@
 		}
 
-		range.moveToPosition( textNode, CKEDITOR.POSITION_AFTER_END );
-		range.select();
+		if ( range )
+		{
+			range.moveToPosition( textNode, CKEDITOR.POSITION_AFTER_END );
+			range.select();
+		}
 
 		editor.fire( 'saveSnapshot' );
Index: /CKEditor/branches/versions/3.4.x/_source/plugins/wysiwygarea/plugin.js
===================================================================
--- /CKEditor/branches/versions/3.4.x/_source/plugins/wysiwygarea/plugin.js	(revision 5772)
+++ /CKEditor/branches/versions/3.4.x/_source/plugins/wysiwygarea/plugin.js	(revision 5773)
@@ -21,5 +21,8 @@
 	function checkReadOnly( selection )
 	{
-		return selection.getCommonAncestor().isReadOnly();
+		if ( selection.getType() == CKEDITOR.SELECTION_ELEMENT )
+			return selection.getSelectedElement().isReadOnly();
+		else
+			return selection.getCommonAncestor().isReadOnly();
 	}