Created attachment 244507 [details]
Creating range for text node in u HTML element and adding it to selection cause incorrectly range normalization to it's parent. See attached example for more details. Please note, that this bug occur not only for u element but for inline elements in general i.e. i, em, b. This bug does not occur for block elements like p or div.
This behaviour impact http://dev.ckeditor.com/ticket/12690 in CKEditor.
Reproduced on latest nightly r178314
Rephrasing the bug report: Selection anchored in a text node inside an inline element (e.g. <u>) is incorrectly normalised by Webkit - it is moved to a text node outside that <u> element.
While Webkit normalising an element-anchored selection to a closest text node is a fact (a sad one :)), I would expect that it does not affect selections anchored in text nodes. This looks like some pretty new regression, because I've never seen Webkit doing this.
Of course, none other browser behave this way, but that's due to the fact that none other browser normalise selection.
Can you figure out when this started? That would significantly increase the chances of this being fixed.