What steps will reproduce the problem?

(1) Create HTML <pre contenteditable>foo\n\nbar\n\nbaz</pre> (available at https://jsfiddle.net/6yj5vwnx/1/)

(2) Select "foo\n\nbar\n\n"

(3) Run document.execCommand('formatBlock', false, 'div') (or press the "format" button)

What is the expected result?

The ending selection is "foo\nbar"

What happens instead?

The ending selection is "foo\nbar\nb"


The cause is that, ApplyBlockElementCommand::DoApply computes the plain text index range of the formatting range before inserting <div> with TextIterator, and applies the same plain text index range as the ending selection. However, 'formatblock div' removes some '\n' from the format range, shortening its plain text length.

The same pattern is observed in some other places in editing commands, all of which may have similar bugs.

The bug can be even worse if we start to change TextIterator's behavior to make it spec-compliant. We might also find a lot of similar failures when LayoutNG is enabled, where a different version of TextIterator is used.