[IE] Unable to change list type

[Garry Yao]

Reproducing Procedures

1. Open the replace by class example page;
2. Make the following content along with selection:

   <ol>
   	<li>
   		^text</li>
   </ol>
   

3. Click on 'Bullet List' command to change list type;
   • Expected Result:

     <ul>
     	<li>
     		^text</li>
     </ul>
     

   • Actual Result: Javascript error thrown.

[Garry Yao]

Lint shows that the evil global object 'length' has been masked by window.length which is an read-only variable under IE.

[Garry Yao]

Fixed with [3381].