Cursor jumps to the end of line in Blink and Webkit

[Jakub Ś]

1. Go to ​http://ckeditor.com/demo
2. Clear the contents of the CKEditor
3. Type the following:
   1. "random text"
   2. hit Shift+Enter to create a BR tag
   3. type the following on the next line "11111 111111111"
4. Click somewhere in the "1111 111111" line

Result: cursor jumps to the end of the text.

Problem can be reproduced from CKEditor 4.4.4 in Blink and Webkit.

[Piotrek Koszuliński]

First bad commit is ​git:13ac023. And that made me curious what's going on there :D.

[Piotrek Koszuliński]

I started debugging this and my initial impression that it must be related to the filling char was right. There's code in the selection.js file that removes the filling char from DOM before snapshot is taken and restore it afterwards. It turns out that this code tries to restore selection when filling char is restored even though the selection was in a different place of the anchor node at the moment of removing the filling char.

[Piotrek Koszuliński]

Pushed ​branch:t/12489.

[Piotrek Koszuliński]

Let's review this ticket in #12491, because I working on #12491 I found a case which wasn't even taken into consideration by ​branch:t/12489.

[Piotrek Koszuliński]

Fixed by #12491.