Steps to reproduce: 1) Open the attached document in Blot 2) Position the caret at the end of text 3) Press Shift+Left Arrow three times Resuls: Not only the three rightmost letters, but also the image gets selected. After pressing Shift+Left Arrow for the fourth time, the visible selection doesn't change Regression: works fine with MacOS X 10.4.2/Safari 2.0.1, broken in ToT.
Created attachment 4035 [details] test document
This can also be reproduced in Safari: just open the test case and drag-select from right to left. When only the three letters "def" should be selected, the image also gets selected.
I just tried, and I cannot reproduce this in my TOT build of Safari.
My mistake, I can reproduce this.
Note that bug 6451 is probably the same issue.
also see <rdar://problem/4402375>
*** Bug 6451 has been marked as a duplicate of this bug. ***
Created attachment 5713 [details] patch + layout tests This is a bug in the painting code. It seems like it's always existed, but some change(s) in the last 6-8 months caused more selections to start/end on replaced elements. Here's a fix and 3 layout tests. Also fixes: <rdar://problem/4364427> triple-click includes first item on next line (www.apple.com, but I think I've seen it elsewhere)
Comment on attachment 5713 [details] patch + layout tests Looks great. r=me
fixed