Switching list type at the end of documet crashes IE8.

[Martin Kou]

This issue affects only IE8. To reproduce:

1. Open replacebyclass.html in IE8.
2. Press Enter a few times to create some empty paragraphs, and type some text at the last paragraph created.
3. Make sure your caret is now at the end of the last paragraph - the bug only occurs when the caret is at the end of the document.
4. Click "Insert/Remove Numbered List".
5. Click "Insert/Remove Bulleted List".
6. IE8 crashes.

[Garry Yao]

WFM with IE8, could you please provide the editor content for reproducing this?

[Martin Kou]

I could reproduce the problem here:

​http://screencast.com/t/Oc9CnjPdP

[Martin Kou]

The problem occurs when the list command is trying to restore the previous selection. It happens with the indent command as well.

[Martin Kou]

This is caused by the collapsed selection fix for IE related to the isStartMarkerAlone flag. The flag is commented out and assumed to be always true (i.e. the hack fix is always applied in IE) because it was found that the flag somehow doesn't work after it's ported from v2 to v3. The problem is, when the fix is applied to cases where it is not needed, it might crash IE8.

The reason this flag doesn't work is due to #3880 - actually the evaluation statement has a hidden typo in v2, but somehow the typo-ed statement actually gives the correct results. When the same statement is ported to v3, there's no such typo, and corrected statement gave the wrong result instead. The typo-ed part of the evaluation statement in v2 is found to be redundant in #3880, the correct fix is to remove that part of the statement in both v2 and v3.

So I have re-enabled the isStartMarkerAlone check in v3, and the browser crash issue seems to go away.

[Garry Yao]

Plz append changlog on commit.

[Martin Kou]

Fixed with [3808].

Click here for more info about our SVN system.