UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/48.0.2564.82 Chrome/48.0.2564.82 Safari/537.36

Example URL:
data:text/html,<h1 style="padding:0.5em" dir=rtl contenteditable>ABC<span contenteditable=false>XYZ</span>&#x05D0;&#x05D1;&#x05D2;</h1><script>document.body.firstChild.focus();s=window.getSelection();console.log(s.focusNode,s.focusOffset)</script>

Steps to reproduce the problem:
1. With the console visible, open the data URI above
2. Note that the focus position shown in the console is at the logical start of the text (at offset zero of the 'ABC' text node).
3. Note, however, that the cursor appears at the end of the paragraph (to the right of the 'Z'). It does not blink.

What is the expected behavior?
EITHER the position is { node: "ABC", offset: 0 } and the cursor displays to the left of the 'A',
OR the position is { node: h1, offset: 0 } and the cursor displays to the right of the 'Z'.
The cursor blinks normally.

What went wrong?
I guess that the cursor is displayed as if the position were { node: h1, offset: 0 }, but then Chromium's position normalization moves the cursor into the supposedly adjacent text node, i.e. to { node: "ABC", offset: 0 } . But because of bidirectionality, these positions are not actually equivalent -- they render in totally different places.

Does it occur on multiple sites: Yes

Is it a problem with a plugin? No 

Did this work before? N/A 

Does this work in other browsers? Yes 

Chrome version: 48.0.2564.82  Channel: n/a
OS Version: 
Flash Version: