I pushed branch:t/13568 with a fix and a test.
There was an oversight in execContentsAction() algorithm that was causing a bug in a special case. The bug was concerning only browsers that appended bogus br to the p. We had code similiar to:
<html><body><p> Foo bar<br /></p></body></html>
And the range was from body#0 to p#1. In execContentsAction() we build startParents and endParents arrays. p was shared node in both arrays and it was the node pointed by minLevel so it was processed in "left branch loop". Then levelParent was set back to docFrag. After that, p node was attempted to process in "right branch loop" but the algorithm noticed that it was already processed so it skiped that one loop. But then the endNode (Foo bar) was appended to levelParent that was still set to docFrag.
The solution was to updated levelParent when we detect that a node was already processed in "left branch loop".
Edit: I also removed a block of code that was signed as redundant. From what I analyzed, it seems it really was.