This DOM Level 2 Method is very useful, very powerful, implemented in Mozilla... and unused. Nobody at all uses Range.surroundContents(). That's probably why nobody ever noticed what I think it a copy/paste error...

First, we split the start containing node of the range here if it's a characterData node. Text.splitText() returning the new text node, we keep track of it after zeroing the corresponding offset. Then we test the endContainer, and if it's a characterData node, we do the same. But here, to keep track of the end of the range, we need to preserve the original node and the original offset even after the call to splitText() instead of using the new node and zeroing the offset...

I think I have found another problem below in the same method. I am closely looking at it because I need this method to be working reliably for Composer.

Update: this is bug 135928 and peterv hit it before me.