IE10 crashes after deleting certain content

[Axel Nerlich]

• Open source code view
• Insert the attached html code snippet
• Switch back to wysiwyg view
• Select all content
• Press 'Del' key

IE10 crashes, IE9 is fine. This is also reproducible with the current demo.

[Axel Nerlich]

Selection should be done by dragging mouse from end to start

[Jakub Ś]

Problem can be reproduced from CKEditor 3.4.3 in both CKE 3.x and 4.x in IE10. Browser crashed after this TC.

NOTE: I was able to reproduce this problem from CKE 3.4.3 because this is first version that works with IE10. In reality (since this is browser bug) problem can be reproduced from CKEditor 3.0.

Another TC that was reported by one of our users:

1. Pase below and switch to WYSIWYG

   <p>tttt</p>
   <ol>
   	<li>fdsgfds
   	<ol>
   		<li>dsfdsf</li>
   	</ol>
   	</li>
   	<li>dsfds
   	<ol>
   		<li>dsfds</li>
   	</ol>
   	</li>
   </ol>
   <p>ttttt</p>
   

2. Select list (start to end or end to start - doesn't matter)
3. Press Ctrl+X

Result Browser Crashes.

[Zoltan Koszegi]

I added "ORACLE" keyword because this issue takes high severity on our side. Our related question was this: [​http://helpdesk.cksource.com/view.php?ticketref=1458-UODX-8309&pass=xyz Version 4.1.1 also affected.

[Jakub Ś]

Problem can be reproduced in latest master and latest stable CKEditor 4.1.2 as well IE10 only (IE11 seem to work fine)

[Piotr Jasiun]

I've investigated this problem. It crashes also in plain contenteditable, without CKEditor (see attachment).

The problem, in general, appears when you remove (cut or delete) selection which ends inside nested list.

The problem is already reported to Microsoft: ​​https://connect.microsoft.com/IE/feedback/details/796187/internet-explorer-10-crash-with-contenteditable-list

[Piotrek Koszuliński]

Since this is a very broad case which is fully handled by native code I don't see a way to prevent from crashes. We'll investigate this problem further and see what we can do.

[Frederico Caldeira Knabben]

This is clearly a browser bug and no reasonable workaround can be produced for it (especially considering that there may be unknown cases affected by the same bug). Therefore we need to wait for a position from MS.