Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 6095)
+++ /CKEditor/trunk/CHANGES.html	(revision 6096)
@@ -121,4 +121,5 @@
 		<li><a href="http://dev.ckeditor.com/ticket/5730">#5730</a> : [Safari] Continual pastes (holding paste key) breaks document contents.</li>
 		<li><a href="http://dev.ckeditor.com/ticket/5850">#5850</a> : [IE] Inline style misbehaviors at the beginning of numbered/bulleted list.</li>
+		<li><a href="http://dev.ckeditor.com/ticket/6580">#6580</a> : [IE9] Flash dialog doesn't get filled up.</li>
 		<li>Updated the following language files:<ul>
 			<li><a href="http://dev.ckeditor.com/ticket/6427">#6427</a> : Ukrainian;</li>
Index: /CKEditor/trunk/_source/core/dom/document.js
===================================================================
--- /CKEditor/trunk/_source/core/dom/document.js	(revision 6095)
+++ /CKEditor/trunk/_source/core/dom/document.js	(revision 6096)
@@ -151,5 +151,5 @@
 		getElementsByTag : function( tagName, namespace )
 		{
-			if ( !CKEDITOR.env.ie && namespace )
+			if ( !( CKEDITOR.env.ie && ! ( document.documentMode > 8 ) ) && namespace )
 				tagName = namespace + ':' + tagName;
 			return new CKEDITOR.dom.nodeList( this.$.getElementsByTagName( tagName ) );
Index: /CKEditor/trunk/_source/core/dom/element.js
===================================================================
--- /CKEditor/trunk/_source/core/dom/element.js	(revision 6095)
+++ /CKEditor/trunk/_source/core/dom/element.js	(revision 6096)
@@ -255,4 +255,26 @@
 
 		/**
+		 * Retrieve block element's filler node if existed.
+		 */
+		getBogus : function()
+		{
+			if ( !this.isBlockBoundary() )
+				return;
+
+			var lastChild = this.getLast() ;
+
+			// Ignore empty/spaces text.
+			while ( lastChild && lastChild.type == CKEDITOR.NODE_TEXT && !CKEDITOR.tools.rtrim( lastChild.getText() ) )
+				lastChild = lastChild.getPrevious();
+
+			if ( lastChild &&
+				( CKEDITOR.env.ie && lastChild.type == CKEDITOR.NODE_TEXT && CKEDITOR.tools.trim( lastChild.getText() ).match( /^(?:&nbsp;|\xa0)$/ )
+				||	CKEDITOR.env.gecko && CKEDITOR.env.webkit && lastChild.is( 'br' ) ) )
+			{
+				return lastChild;
+			}
+		},
+
+		/**
 		 * Breaks one of the ancestor element in the element position, moving
 		 * this element between the broken parts.
@@ -614,5 +636,5 @@
 			var nodeName = this.$.nodeName.toLowerCase();
 
-			if ( CKEDITOR.env.ie )
+			if ( CKEDITOR.env.ie && ! ( document.documentMode > 8 ) )
 			{
 				var scopeName = this.$.scopeName;
@@ -722,10 +744,10 @@
 				otherLength = otherAttribs.length;
 
-			if ( !CKEDITOR.env.ie && thisLength != otherLength )
-				return false;
-
 			for ( var i = 0 ; i < thisLength ; i++ )
 			{
 				var attribute = thisAttribs[ i ];
+
+				if ( attribute.nodeName == '_moz_dirty' )
+					continue;
 
 				if ( ( !CKEDITOR.env.ie || ( attribute.specified && attribute.nodeName != '_cke_expando' ) ) && attribute.nodeValue != otherElement.getAttribute( attribute.nodeName ) )