Index: /CKEditor/branches/features/pasting/_source/core/htmlparser/fragment.js
===================================================================
--- /CKEditor/branches/features/pasting/_source/core/htmlparser/fragment.js	(revision 4230)
+++ /CKEditor/branches/features/pasting/_source/core/htmlparser/fragment.js	(revision 4231)
@@ -347,4 +347,5 @@
 		parser.onComment = function( comment )
 		{
+			checkPending();
 			currentNode.add( new CKEDITOR.htmlParser.comment( comment ) );
 		};
Index: /CKEditor/branches/features/pasting/_source/plugins/clipboard/plugin.js
===================================================================
--- /CKEditor/branches/features/pasting/_source/plugins/clipboard/plugin.js	(revision 4230)
+++ /CKEditor/branches/features/pasting/_source/plugins/clipboard/plugin.js	(revision 4231)
@@ -245,16 +245,9 @@
 					toHtml : function( data )
 					{
-						var oldDtd = CKEDITOR.dtd.ul;
-						CKEDITOR.dtd.ul = CKEDITOR.dtd.ol =
-						    CKEDITOR.tools.extend( CKEDITOR.tools.clone( oldDtd ), { ol : 1, ul : 1 } );
-
 						var fragment = CKEDITOR.htmlParser.fragment.fromHtml( data, false ),
 							writer = new CKEDITOR.htmlParser.basicWriter();
 
-						CKEDITOR.dtd.ul = CKEDITOR.dtd.ol = oldDtd;
-
 						fragment.writeHtml( writer, this.dataFilter );
-						// Go through the default processor at last.
-						return this.editor.dataProcessor.toHtml( writer.getHtml( true ) );
+						return writer.getHtml( true );
 					}
 				};
@@ -266,5 +259,5 @@
 					// 'paste' event since the processing rules will be added
 					// on demand accordingly to clipboard data flavor.
-					editor.pasteProcessor = new CKEDITOR.pasteProcessor( editor );
+					evt.data.processor = new CKEDITOR.pasteProcessor( editor );
 					
 				}, null, null, 1 );
@@ -273,12 +266,11 @@
 				editor.on( 'paste', function( evt )
 				{
-					var data = evt.data;
-
-					if ( data[ 'html'] )
-						editor.insertHtml(editor.pasteProcessor.toHtml(data[ 'html' ], false));
-					else if ( data[ 'text'] )
-						editor.insertText(data[ 'text' ]);
-
-					delete editor.pasteProcessor;
+					var data = evt.data,
+						processor = data.processor;
+
+					if ( data[ 'html' ] )
+						editor.insertHtml( processor.toHtml( data[ 'html' ], false ) );
+					else if ( data[ 'text' ] )
+						editor.insertText( data[ 'text' ] );
 
 					editor.fire( 'saveSnapshot' ); // Save after inserted.
Index: /CKEditor/branches/features/pasting/_source/plugins/pastefromword/plugin.js
===================================================================
--- /CKEditor/branches/features/pasting/_source/plugins/pastefromword/plugin.js	(revision 4230)
+++ /CKEditor/branches/features/pasting/_source/plugins/pastefromword/plugin.js	(revision 4231)
@@ -27,23 +27,24 @@
 			editor.on( 'paste', function( evt )
 			{
-				var mswordHtml;
+				var data = evt.data,
+					mswordHtml;
 				// MS-WORD format sniffing.
-				if ( ( mswordHtml = evt.data[ 'html' ] )
+				if ( ( mswordHtml = data[ 'html' ] )
 					 && /(class=\"?Mso|style=\"[^\"]*\bmso\-|w:WordDocument)/.test( mswordHtml ) )
 				{
-					// 1. Pre fixing downlevel-revealed IE conditional comments for the parser.
-					//    e.g. <!--[if !vml]--><img ... /><!--[endif]-->
-					// 2. Join consequent IE comments into one for easy handling.
-					if( !CKEDITOR.env.ie )
-						evt.data[ 'html' ] =
-							mswordHtml.replace( /(<!--\[if[^<]*?\])-->([\S\s]*?)<!--(\[endif\]-->)/gi, '$1$2$3' )
-									  .replace( /(\[endif\])--(>\s*<)!--(\[if)/gi, '$1$2$3' );
-
-					var filter = editor.pasteProcessor.dataFilter;
+					// Firefox will be confused by those downlevel-revealed IE conditional
+					// comments, revealing them first.
+					// e.g. <![if !vml]>...<![endif]>
+					if( CKEDITOR.env.gecko )
+					{
+						data[ 'html' ] =
+							mswordHtml.replace( /<!--\[if[^<]*?\]-->([\S\s]*?)<!--\[endif\]-->/gi, '$1' );
+					}
+
+					var filter = data.processor.dataFilter;
 					// These rules will have higher priorities than default ones.
 					filter.addRules( CKEDITOR.plugins.pastefromword.getRules( editor ), 5 );
 				}
 			} );
-
 		}
 	} );
@@ -251,23 +252,4 @@
 								 : false;
 					 };
-				},
-
-				listFilter : function( element )
-				{
-					var children = element.children,
-						length = children.length,
-						child, previousChild;
-					for( var i = 0 ; i < length; i++ )
-					{
-						child = children[ i ];
-
-						// Wrap nested list root with the previous list item.
-						if ( child.name && child.name in { ul : 1, ol : 1 } )
-						{
-							children.splice( i, 1 );
-							previousChild.children.push( child );
-						}
-						previousChild = child;
-					}
 				}
 
@@ -278,5 +260,4 @@
 			var falsyFilter = this.filters.falsyFilter,
 				stylesFilter = this.filters.stylesFilter,
-				listFilter = this.filters.listFilter,
 				createListBulletMarker = this.utils.createListBulletMarker,
 				config = editor.config,
@@ -335,5 +316,16 @@
 								 && tagName.indexOf( 'cke' ) == -1 )
 						{
-							delete element.name;
+							element.filterChildren();
+
+							// Restore img element from vml.
+							if( tagName == 'v:imagedata' )
+							{
+								var href = element.attributes[ 'o:href' ];
+								if ( href )
+									element.attributes.src = href;
+								element.name = 'img';
+							}
+							else
+								delete element.name;
 						}
 						// Any dtd-valid element which could contain a list.
@@ -398,6 +390,4 @@
 					},
 
-					'ul' : listFilter,
-					'ol' : listFilter,
 					'p' : function( element )
 					{
@@ -435,26 +425,52 @@
 						element.filterChildren();
 
-						var attrs = element.attributes,
-							styles = attrs && attrs.style;
-						if( styles )
-						{
-							var marker;
-							stylesFilter(
-							[
-								[ 'mso-list', 'Ignore', function( value, element )
-								{
-
-									var listType = element.firstTextChild().value.match( /([^\s])([.)]?)/ );
-									marker = createListBulletMarker( listType );
-								} ]
-							] )( styles, element );
-
-							if( marker )
-								return marker;
-						}
-
-						var onlyChild = element.onlyChild();
-						if( onlyChild && 'cke:listbullet' == onlyChild.name )
-							return onlyChild;
+						// For none-Firefox, list item bullet type is supposed to be indicated by
+						// the text of a span with style 'mso-list : Ignore'.
+						if( !CKEDITOR.env.gecko )
+						{
+							var attrs = element.attributes,
+									styles = attrs && attrs.style;
+							if( styles )
+							{
+								var marker;
+								stylesFilter(
+										[
+											[ 'mso-list', 'Ignore', function( value, element )
+											{
+												var listType = element.firstTextChild().value.match( /([^\s])([.)]?)/ );
+												marker = createListBulletMarker( listType );
+											} ]
+										] )( styles, element );
+
+								if( marker )
+									return marker;
+							}
+
+							// Kill an additional wrapping span.
+							var onlyChild = element.onlyChild();
+							if( onlyChild && 'cke:listbullet' == onlyChild.name )
+								return onlyChild;
+						}
+
+						// Update the src attribute of image element with href.
+						var children = element.children,
+							firstChild = children && children[ 0 ],
+							secondChild;
+						if( 'cke:imagesource' == firstChild.name )
+						{
+							secondChild = children[ 1 ];
+							if ( 'img' == secondChild.name )
+								secondChild.attributes.src = firstChild.attributes.src;
+							children.splice( 0, 1 );
+							delete element.name;
+						}
+					},
+
+					'v:imagedata' : function( element )
+					{
+						var href = element.attributes['o:href'];
+						if( href )
+							element.attributes.src = href;
+						element.name = 'img';
 					}
 				},
@@ -464,4 +480,6 @@
 					// Remove onmouseover and onmouseout events (from MS Word comments effect)
 					[ /^onmouse(:?out|over)/, '' ],
+					// Remove office and vml attribute from elements.
+					[ /(?:v|o):\w+/, '' ],
 					// Remove lang/language attributes.
 					[ /^lang/, '' ],
@@ -493,21 +511,17 @@
 					}
 				},
-				comment : function( value )
+
+				// Fore none-IE, some useful data might be buried under these IE-conditional
+				// comments where RegExp were the right approach to dig them. The usual approach
+				// here is transform it into a semantic element node.
+				comment : !CKEDITOR.env.ie ? function( value )
 				{
-					var imageSource = value.match( /<img.*?>/ ),
+					var imageSource = value.match( /<v:imagedata[^>]*o:href=['"](.*?)['"]/ ),
 						listInfo = value.match( /^\[if !supportLists\]([\s\S]*?)\[endif\]$/ );
 
-					// Image 'src' attribute might be embedded within vml.
+					// Try to reveal the real image 'src' attribute from vml elements.
 					if( imageSource )
 					{
-						var image = CKEDITOR.htmlParser.fragment.fromHtml( imageSource ).children[ 0 ],
-							attrs = image.attributes;
-						delete attrs[ 'v:shapes'];
-
-						// Try to reveal the real image source from vml elements.
-						var imageData = value.match( /<v:imagedata[^>]*o:href=['"](.*?)['"]/ ),
-							imageSrc = imageData && imageData[ 1 ];
-						imageSrc && ( attrs.src = imageSrc );
-						return image;
+						return new CKEDITOR.htmlParser.element( 'cke:imagesource', { src : imageSource[ 1 ] } );
 					}
 					// Seek for list bullet style indicator.
@@ -520,5 +534,5 @@
 					}
 					return false;
-				}
+				} : falsyFilter
 			};
 		}