Still happens, but less often, since c04d8c0b9d0bec52cd95bfa0b533b6b97e8ca23a .

Steps to reproduce:

1. On Chromium, edit <h1>1 <span dir="rtl">2 3</span> 4</h1> (and see that it renders like "1 (3 2) 4" with the "3 2" shaded)
2. Place the cursor to the right of the "3 2".
3. Hold down shift and press Left three times (and see the logical bidi selection cover the '2 3' from the *left*)
4. Start an IME composition and then remove the candidate (e.g. on most Linux keyboard layouts, press Ctrl+Shift+u then Backspace)
5. Note the shaded text has completely disappeared
6. Type '2 3'.

Expected behaviour: The '2 3' appears as unannotated text (or alternatively, as shaded RTL), and agrees with the model.

Actual behaviour: The '2 3' appears shaded but in LTR, in fact in a <span style="background-color: rgb(235, 243, 245);">2 3</span>. The model has unannotated text.

This is really due to https://bugs.chromium.org/p/chromium/issues/detail?id=546461 ("No way to stop contenteditable inserting quirky style tags").