Divarea and getData throw error when image is only data in editor.

[Jakub Ś]

Use attached sample to reproduce the problem.

1. Copy image from some webpage
2. Paste it into editor with Ctrl+V
3. Click Clear
4. Paste image into editor with Ctrl+V
5. Click getData

Result: In Webkit and Blink JS error is thrown.

Message: Uncaught IndexSizeError - Failed to execute 'extend' on 'Selection': 1 is larger than the given node's length.
Line: 224
URI: core/selection.js

[Jonathan]

Tracking.

[Jonathan]

We are seeing this exact same stack trace from users about 20 times a day from Chrome users. All of them occur in the context of calling editor.getData(). We do not allow pasting images in production yet, but these errors may share a root cause. Production is running CKEditor 4.4.7.

[Piotrek Koszuliński]

OK, this is another ticket pointing to the same extend(). We've already worked on some fixes around it, so I don't know if one of the patches on review does not fix it, but to remember to check I'm adding this ticket to 4.5.2 too.

[Szymon Cofalik]

Fixed by #13284.

[Jonathan]

The workflow above appears to be fixed by #13284, but there is a related workflow that still causes the error. These two workflows only happen with the 'image2' plugin enabled.

1. Copy image from some webpage
2. Paste it into editor with Ctrl+V
3. Delete the image.
4. Type some text without a space
5. Click getData

Another workflow:

1. Copy image from some webpage
2. Paste it into the editor with Ctrl+V
3. Hit the right arrow button to place the caret right next to the image.
4. Type some text without a space.
5. Click getData

Removing the 'image2' plugin, the error manifests itself differently:

1. Copy image from some webpage
2. Paste it into the editor with Ctrl+V
3. Hit the right arrow button to place the caret right next to the image.
4. Type some text without a space.
5. Click getData
6. Click clear

You can see the issue with the 'image2' plugin here. If you want, I can remove the plugin so that you can see the other issue. ​Example

[Szymon Cofalik]

@jbalinski: thanks for providing test cases!

I've pushed ​branch:t/13513 with additional fix. It seems like a weird bug on Chrome's end but I can't reproduce it outside CKEditor "environment". The fix is separate from #13284 and ​branch:t/13284 but both are connected to similar issues.

[Jonathan]

The latest fix appears to prevent the error from occurring.

[Piotrek Koszuliński]

See ​http://dev.ckeditor.com/ticket/13284#comment:14

[Szymon Cofalik]

I rebased ​branch:t/13513 with master and pushed tests.

I narrowed test cases to two, simpler scenarios. Errors are caused by ZWS, so any command that inserts ZWS into editor results in same error, it doesn't have to be an image. I used bold. Instead messing with image, now I just use bold command to insert strong element with ZWS in it. I also reduced plugins set to a minimal group that is needed to reproduce the error.

@jbalinski provided 3 test cases. TC1 and TC2 are basically same, and TC3 is the same thing but we fire setData( '' ) instead of getData(). I was able to automate the tests. While writing tests I noticed that the error is thrown only when getData/setData is fired after click the button, which lead me to discover that it, in fact, is only thrown if editor is blurred before getData/setData. Maybe this information will be useful during review. I simulated this by firing blur() directly on editable().$ element.

[Piotrek Koszuliński]

Small note here - instead of blurring editable, focus some other field (e.g. <input>). This is more predictable.

[Szymon Cofalik]

Fixes also #13389 - I pushed a test that checks that case.

[Szymon Cofalik]

@Reinmar: It seems that, because of unknown reason, it crashes only if I use blur() on contenteditable. focus() on another field does not make the code to throw an error.

[Piotrek Koszuliński]

Another related ticket #12727.

[Piotrek Koszuliński]

I'd wait with this for results of @a.nowodzinski's work on a complete filling char rewrite. Perhaps all this won't be necessary after that.

[Marek Lewandowski]

This issue will be fixed by #13816 in the next milestone.

[Marek Lewandowski]

Fixed with ​git:2d078ff42a by #13816.