Originally reported as an issue with vendors (Chromium bug, Bugzilla):

Steps to reproduce:

1. Visit https://edg2s.github.io/rangefix/
2. Click the "Firefox triple click bug" button or triple click the paragraph which contains the inline image.

Actual results:

The rectangle for the tag does not include the full height of the image tag.

Expected results:

The computed rectangles are correct.

a Mozilla contributor suggested this is in fact an issue with the spec

Ah, this is about Range.getClientRects, not about Element.getClientRects, sorry...

So spec is in https://drafts.csswg.org/cssom-view-1/#dom-range-getclientrects:

For each element selected by the range, whose parent is not selected by the range, include the border areas returned by invoking getClientRects() on the element.

So it seems to me that if <u> is selected by the range completely, then we'd return an smaller rect than if it wasn't per the above definition (because when <u> is not fully selected, then we union the getClientRects() of the text and the image, instead of just returning the rects of the <u>). That seems unfortunate, though it's what the spec seems to call for.