IndexSizeError: DOM Exception 1: Index or size was negative, or greater than the allowed value.

[Mark Wade]

When using the divarea plugin, if you insert content (using insertHtml or insertElement) and then, without clicking the editor or typing anything else, submit, a JS error is logged and CKEditor submits a blank string as the value.

Steps to reproduce

1. Use the attached test.html file and set the ckeditor.js path to a CKEditor instance that has the divarea plugin.
2. Click the "Click Me" button - an image will be inserted into the editor and the cursor moved to after that image.
3. Hit backspace to delete the image.
4. Click the "Click Me" button again.
5. Click the "And Then Click Me" button.

Expected result

An alert containing the HTML appears.

Actual result

The following JS error is logged to the console and no alert appears:

[Error] IndexSizeError: DOM Exception 1: Index or size was negative, or greater than the allowed value.

extend (ckeditor.js, line 397) n (ckeditor.js, line 397) c (ckeditor.js, line 410) j (ckeditor.js, line 10) (anonymous function) (ckeditor.js, line 12) fire (ckeditor.js, line 13) getData (ckeditor.js, line 250) (anonymous function) (test.html, line 21) dispatch (jquery-2.1.4.min.js, line 3) handle (jquery-2.1.4.min.js, line 3)

Other details (browser, OS, CKEditor version, installed plugins)

Can reproduce in other scenarios, but am using the latest Safari for Mac (8.0.8) and the "Standard" CKEditor package with the divarea plugin added.

[Mark Wade]

For my own purposes, I've wrapped that final sel.extend( bm[ 1 ].node, bm[ 1 ].offset ); which triggers the error in a try/catch, but a proper solution would be appreciated.

[Jakub Ś]

Problem can be reproduced from CKEditor 4.4.6 in Blink and Webkit browsers on Windows and Mac.

I have removed the jQuery from the sample (please see test2.html file) and added inline handlers for simplicity but error is still there.