[IE9-10] - Undo fails after 3+ consecutive paste actions with JS Error.

[Joel]

The undo function breaks after three or more consecutive paste actions when pasting as the last characters in a paragraph. Reproducible in [ckeditor.com/demo the demo] and in ​nightly.

Steps:

1. Go to ckeditor.com/demo
2. Click to focus to the editor
3. Ctrl+A and Del to clear editor
4. Copy some simple text, for example the URL of the page
5. Paste the text three times in a row
6. Ctrl+Z or click the undo icon --> Error

Error in Console (nightly): DOM Exception: INDEX_SIZE_ERR (1) ckeditor.js, rivi 339 merkki 374

If you type something after the pastes, undo works fine until it hits the pasted text, then the error is thrown.

BUT! If there is something after the caret when pasting it doesn't fail. For example after step 3, if you type in "foo" and move the caret to "|foo" or "fo|o" and then paste three times, undo keeps working fine and no errors.

[Jakub Ś]

Problem can be reproduced from CKEditor 4.0 in IE9 and IE10.

JS error that Ie reports: Message: SCRIPT5022: DOM Exception: INDEX_SIZE_ERR (1)
Line: 1577
URI: /ckeditor-git/core/selection.js

NOTE: Pasting can be done with Ctrl+v or paste button. It doesn't matter whihc you use.

[Jakub Ś]

#10648 was marked as duplicate

[Jakub Ś]

#10653 and #10667 were marked as duplicate.

Please check TCs described there.

[Jakub Ś]

#10686 was marked as duplicate.

[Piotr Jasiun]

There was a problem with normalization. Bug is fixed:

• source: ​t/10301
• tests: t/10301

[Piotrek Koszuliński]

I haven't done full review, but I have questions:

• why this fix landed in range.createBookmark2 and not in node.getIndex?
• why does it not cover endContainer?

[Piotr Jasiun]

Replying to Reinmar:

I haven't done full review, but I have questions:

• why this fix landed in range.createBookmark2 and not in node.getIndex?

Because there was a problem with normalization inside range.createBookmark2. startContainer should be moved to the end of last child element and it wasn't.

• why does it not cover endContainer?

Good point. I wasn't able to reproduce this bug with endContainer, but normalization was wrong. I've added fix and test for such case.

[Olek Nowodziński]

I pushed several commits to both dev and tests:

• Rebased branches.
• Added extra test.
• Updated and extended doc strings.
• Optimized the code so normalize() is defined once.
• Simplified conditions.

[Piotrek Koszuliński]

I'm repeating this question again:

why this fix landed in range.createBookmark2 and not in node.getIndex?

I don't understand previous answer.

[Olek Nowodziński]

Replying to Reinmar:

I'm repeating this question again:

why this fix landed in range.createBookmark2 and not in node.getIndex?

I don't understand previous answer.

This fix is about setting different container and offset of the "range". Not getting. Please refer to the code.

[Piotr Jasiun]

• ​git:872a95d
• tests:1bc5f0d