insertElement table into table range crashes page

[Ben Duncan]

The browser/page crashes while inserting a table inside of another table if a selection spans outside of the table row.

To reproduce: In a ckeditor instance with the table plugin, insert a table. Then highlight multiple cells of the new table and click the toolbar button to insert a table again. When you click "ok" in the internal table's dialog to insert it, the page crashes.

Browser and OS: This has been reported in a plethora of browsers in both Windows and OSX. I personally confirmed it on Chrome (28.0.1500.72 m), Windows 7.

Test case: This can easily be reproduced in /samples/divreplace.html within the CKEditor samples.

Build Configuration: any build with the table plugin, including standard.

Possible Fix: I've looked into some fixes for this. Since an inserted table needs to go somewhere, and it can't span multiple table cells or rows anyway, I think it's appropriate to disable the table button in this situation. For this I made the 'table' command context sensitive using the following code in \plugins\table\plugin.js (near line 17):

			lang = editor.lang.table;

		editor.addCommand( 'table', new CKEDITOR.dialogCommand( 'table', {
+			contextSensitive: 1,
+			refresh: function(editor, path) {
+				if ( editor.getSelection().getRanges()[0].getCommonAncestor().is( 'table', 'tbody', 'thead' ) )
+					this.setState( CKEDITOR.TRISTATE_DISABLED );
+				else
+					this.setState( CKEDITOR.TRISTATE_OFF );
+			},
			context: 'table',
			allowedContent: 'table{width,height}[align,border,cellpadding,cellspacing,summary];' +
				'caption tbody thead tfoot;' +

[Jakub Ś]

Problem can be reproduced from CKEditor 4.0 beta in all browsers.

This is a continuation of ticket #7021. In version 3 this caused JS error while in version 4 browser hangs.

Browers hangs here:
URI: /ckeditor4-git/core/dom/node.js
Line:288[[BR]]

NOTE: I'm closing ticket #7021.

[Piotr Jasiun]

Still available on 4.3 beta. On Opera, Chrome and IE10.

[Piotrek Koszuliński]

DUP of #11183.