Created attachment 73569 [details]
Load the attached test case. Notice that there is no rect for the empty line in the middle (or the second rect is wrong).
Created attachment 76807 [details]
Here's a better example. Basically getClientRects() will return a rect positioned at the top left hand corner for each empty span that occurs in the range.
getClientRects is just one way to see the problem, which is that the spans are incorrectly positioned. Will attached a better reduction.
Created attachment 76810 [details]
In this reduction, an empty span just after a <br> is positioned at the top left hand corner of its containing block, instead of after the br.
(In reply to comment #4)
> Created an attachment (id=76810) [details]
This seems to work correctly in FireFox, by the way.
The new radar is <rdar://problem/8784036>.