Removing bookmark around a widget causes an runtime error

[XipanXiao]

Steps to reproduce

1. Open the attached ckeditor.html
2. click the testWidget button
3. click the bookmark button
4. click the bookmark button again

Expected result

No errors.

Actual result

Error printed to console: Uncaught TypeError: Cannot read property 'type' of nulla @ ckeditor.js:126window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.dom.range.createBookmark2 @ ckeditor.js:128window.CKEDITOR.window.CKEDITOR.dom.e.createBookmarks2 @ ckeditor.js:452window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.dom.selection.createBookmarks2 @ ckeditor.js:409window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.plugins.undo.Image @ ckeditor.js:954window.CKEDITOR.window.CKEDITOR.dom.b.save @ ckeditor.js:948d @ ckeditor.js:943h @ ckeditor.js:10window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.event.CKEDITOR.event.a.fire @ ckeditor.js:11window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.editor.CKEDITOR.editor.fire @ ckeditor.js:13window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.tools.extend.execCommand @ ckeditor.js:235window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.ui.button.CKEDITOR.tools.extend.click @ ckeditor.js:740window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.ui.button.render.n.execute @ ckeditor.js:741(anonymous function) @ ckeditor.js:742(anonymous function) @ ckeditor.js:29window.CKEDITOR.window.CKEDITOR.dom.CKEDITOR.tools.callFunction @ ckeditor.js:29onclick @ ckeditor.html:1

Other details (browser, OS, CKEditor version, installed plugins)

Chrome, Linux, 4.5.4, only one plugin in the html installed ==

[XipanXiao]

The offending line:

f = f.type != CKEDITOR.NODE_ELEMENT || e === 0 || 
e == f.getChildCount() ? 0 : f.getChild(e - 1).type == CKEDITOR.NODE_TEXT &&
 f.getChild(e).type == CKEDITOR.NODE_TEXT;

Here when 'e > f.getChildCount()' the code fails.

[Jakub Ś]

First of all, I'm sorry for late reply. Second, could you tell us exactly what you are trying to do?

When you create intrusive bookmark which inserts spans into the code, you remove them with this method - ​http://docs.ckeditor.com/#!/api/CKEDITOR.dom.range-method-moveToBookmark. Range will be moved to correct position and spans will be removed.
Playing with ranges can be very tricky and produce many unexpected errors. I believe this is what is happening here.

I have changed your example a little bit (please see attached file) and now it works without any error. Is this what you were trying to do?

NOTE: You can't put DIV inside P. The other way around is ok but DIV inside P is disallowed.