id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
13020	CKEditor exception in Firefox	Alan		"Our web app has been generating countless exceptions in CKEditor. I 
have finally been able to reproduce one of them. For the demo please 
visit 'http://jsfiddle.net/ftey46fc/3/' and follow these steps in the 
editor in the lower right:

1) Type three lines of text with the letters a, b, and c on them (one
   letter per line).
2) Select the first two lines and make that a numbered list.
3) Select all three lines and change to a bulleted list.

An exception is generated ""TypeError: a is null"".

This error is caused because when bookmarks are selected/restored
in the selectBookmarks function the starting bookmark has been
removed thus it fails to select it in the moveToBookmark function 
so startNode is null and the setStartBefore call will a null 
parameters throws an exception. I changed said function during
me debugging to:

setStartBefore: function (node) {
    if (node == null) {
        console.log('*** About to throw an exception');
    }
    this.setStart( node.getParent(), node.getIndex() );
}

to better illustrate that.

Why has the bookmark been purged? Well the long story is that
a <li> with the start bookmark gets added before the two existing
<li>s and so the first <li> has no text in it and it's purged
by the 'changeListType' function, but it all seems to come down to
the getNative function that looks kind of (this is my debug
version now) like this:

getNative: function() {
    if ( this._.cache.nativeSel !== undefined ){
        return this._.cache.nativeSel;
    }
    if(isMSSelection){
        this._.cache.nativeSel = this.document.$.selection;
    }else{
        var win = this.document.getWindow();
        this._.cache.nativeSel = win.$.getSelection();
    }

    console.log('*** new native selection =  anchor = ' + this._.cache.nativeSel.anchorNode.nodeName + '  focus node = ' + this._.cache.nativeSel.focusNode.nodeName);
    return ( this._.cache.nativeSel );
}

which I have modified to break complex lines into pieces and add 
the logging. When this returns the selection via getSelection the 
focus node SHOULD be on the 'a' #text node, but it's actually on 
the OL node. This works fine in Chrome and usually works fine in
FireFox, but the CSS I inject into the document seems to trigger
this problem. Remove that and it works fine.

That makes me question whether this is actually a Firefox bug that
needs to be worked around, but I don't know my browser specs.
In any event one quick fix I've done to code around this was a patch
to the moveToBookmark function that basically verifies that the
startBookmark was found but

a) I don't know the extent that this kind of bug is going to have
   on the rest of the system. If there are other places where
   the start bookmarks premature removal is going to wreak havoc
   then I'd like to know about it.
b) I don't know if there are other cases where we're going to see this
   type of problem because of other CSS that Firefox/CKEditor
   doesn't work with properly. Like I said we're seeing all kinds 
   of exceptions coming from CKEditor and it could all be
   permutations of this bug. I don't know yet.
c) When the exception occurs it leaves the end bookmark span in the
   HTML and it seems that that can cause later problems.

Let me know if there's any additional info I can provide. I'm just
glad to finally get this bug in a form reproducible outside of our
code base.

- Thanks, Alan

"	Bug	new	Normal		Core : Selection	4.4.7		Firefox, exception, CSS