When asked for a substring of a contenteditable div, WebKit appends "\n" to it, thus returning a string of incorrect length; see the attached test case. I'm not sure if this is a regression, but it may well be. Evan, do you by chance have a simple way to check that?
Created attachment 14736 [details] test case (DRT-only)