Issue with Number/Bulleted list - Stack overflow at line: 27

[Rajendra]

I have very simple text in editor, when I press “Insert/Remove Numbered List” button on toolbar on 1st,2nd and 3rd line, then go back to 2nd line and press “Insert/Remove Bulleted List” button on toolbar, it is killing all IE browsers sessions.

Steps to reproduce:

1. Textarea "editor1" is associated with the instance of ckeditor, here is the text prepopulated in the textarea :

   <dl>
   	<dt>
   	Text1
   	</dt>
   	<dd>
   		<ul>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   		</ul>
   	</dd>
   </dl>
   

2. Click on first bulleted list make it to Numbered list
3. Click on second bulleted list make it to Numbered list
4. Click on third bulleted list make it to Numbered list
5. Click on forth bulleted list make it to Numbered list
6. Click on second numbered list which in done in point 3 above and make it to bulleted list

At this point all browser sessions get killed.

For the same above text loaded in editor if I use editor.getData() method, it is giving “Stack overflow at line: 27” error.

Browser: IE 7.0.5730.13 OS: Windows XP with SP3

Addtional info: Please note, this happnes on ​http://ckeditor.com/demo page also, if 4 numbered list items are created and then if clicked to 2nd numbered item and make it bulleted item, it kills all IE browser sessions.

[Krzysztof Studnik]

Confirmed on IE7
Similar issue on forums:
​http://cksource.com/forums/viewtopic.php?f=11&t=21785

[Krzysztof Studnik]

Under IE9b/IE8, console:

SCRIPT5007: Unable to get value of the property 'direction': object is null or undefined 
ckeditor.js, line 16 character 1466

[Rajasimhan]

I am also able to replicate this issue in our environmen on CK Editor release 3.5.2. Please provide a fix for the same.

[Rajendra]

Please let me know when this issue will be fixed, because we need to take a decision for using the editor ASAP and go for support contract.

[Krzysztof Studnik]

WFM under IE9 cke r6468

[Wiktor Walc]

Similar issue: #8043.

@krst - is the 3.5.2 version correct?

[Frederico Caldeira Knabben]

DUP of #6975.

[Garry Yao]

Bug is not fixed by #6975 thus still remains in trunk.

[Garry Yao]

​http://ckeditor.t/tt/7290/1.html

[Jakub Ś]

Checked with the latest trunk - IE7 still crashes on this TC.

[Jakub Ś]

IE7 is no longer supported and problem can't be reproduced in IE8+. I'm marking it as "won't fix".