Undo causes javascript errors

[Arne]

1. Go to CK editor demo page.
   
2. Clear editor content
   
3. Type a word
   
4. Select and copy the word
   
5. Paste it several times on the same line.
   
6. Hit Ctrl-Z to undo.
   
7. Javascript errors should be generated. Probably related to range code.
   

Tested on Windows, Firefox 3.6.3
Editor version : 3.3.1

[Jakub Ś]

Reproducible in Firefox and Webkit from CKEditor 3.1.

FF Error:
Message: Index or size is negative or greater than the allowed amount" code: "1
URI: /3.6.2/ckeditor/_source/core/dom/domobject.js
Line: 209

Webkit Error:
Message:Uncaught Error: INDEX_SIZE_ERR: DOM Exception 1
URI:

1. CKEDITOR.dom.selection.selectRanges:8080/ckeditor_trunk/_source/plugins/selection/plugin.js:1492
2. CKEDITOR.dom.selection.selectBookmarks:8080/ckeditor_trunk/_source/plugins/selection/plugin.js:1567
3. UndoManager.restoreImage:8080/ckeditor_trunk/_source/plugins/undo/plugin.js:416
4. UndoManager.undo:8080/ckeditor_trunk/_source/plugins/undo/plugin.js:504
5. CKEDITOR.plugins.add.init.editor.addCommand.exec:8080/ckeditor_trunk/_source/plugins/undo/plugin.js:25
6. execcommand.js:52
7. CKEDITOR.tools.extend.execCommandeditor.js:600
8. CKEDITOR.tools.extend.click:8080/ckeditor_trunk/_source/plugins/button/plugin.js:38
9. instance.execute:8080/ckeditor_trunk/_source/plugins/button/plugin.js:96
10. CKEDITOR.tools.addFunctiontools.js:641
11. CKEDITOR.tools.callFunctiontools.js:674
12. (anonymous function)replacebycode.html:1
13. onclickreplacebycode.html:2

[Jakub Ś]

The same result can be achieved with Undo button.