Inline styles are being applied to outside of selected area in IE.

[Martin Kou]

To reproduce:

1. Open replacebyclass.html in IE.
2. Double click "You" in the editing area.
3. Click the Bold button.
4. "You are using " is bolded.

The bug can be reproduced across IE6, 7 and 8.

[Garry Yao]

WFM, can you re-verify it?

[Martin Kou]

I can still reproduce it in IE8, in both compatibility mode and standards mode.

Screencast here: ​http://screencast.com/t/pujottPWZ

[Martin Kou]

After some rechecking, the problem is specific to IE8. And the culprit seems to be the selection plugin. Still investigating for the fix.

[Martin Kou]

Added unit test case, it passes in IE6 and IE7, but fails in IE8. The bug is definitely in the selection plugin.

[Garry Yao]

A while ago when I tested on IE8 FC, it's shown that the native selection range reporting is incorrect, not sure but probably browser bug somehow.

[Martin Kou]

Ok, this is a really hideous browser DOM bug. The problem (as in the test case) happens like this:

1. A DOM range object is obtained in L31 of the test case, and the range's positions are actually correct.
2. range.select() is called.
3. range.select() inserts bookmark nodes into the document. The bookmark at the end point is inserted first. This end point is right after the string "This".
4. range.createBookmark() is called.
5. range.createBookmark() calls trim() to split "This" from " is some " on a cloned range object whose position is collapsed right after "This".
6. So cloned.trim() calls textNode.split(4). So the text node "This is some " is split into "This" and " is some ". So far so good.
7. So cloned.trim() updates the startParent to the parent P node and startOffset to 1. Which means the collapsed range's position is now theoretically at "This^ is some".
8. But no... IE8 thinks the range's position is actually at "This is some^<strong>sample text</strong>" despite we've got the correct startContainer and the correct startOffset! See next point for the reason.
9. Apparently IE8 thinks P.childNodes[0] is "This" - that's correct. But P.childNodes[1] is the STRONG tag! Despite the fact that it will report correctly to you that STRONG.previousSibling is " is some " and "This".nextSibling is " is some ".

Alfonso has already reported this bug to Microsoft here: ​http://connect.microsoft.com/IE/feedback/ViewFeedback.aspx?FeedbackID=426520.

[Martin Kou]

Fixed with [3470].

Click here for more info about our SVN system.