Text cursor blinks outside of input box after scrolling

[Danyao Wang]

Created attachment 327427 [details]
Screenshot showing cursor blinking outside of input box

This bug was originally reported by folks from http://n26.com. See http://crbug.com/781297 for original repro steps.

I created a minimal example that reproduces the problem: http://output.jsbin.com/cabejez

Steps to reproduce:
1. On an iOS device, visit http://output.jsbin.com/cabejez in Safari
2. Tab on input box
3. Scroll the page up

Expected result:
Cursor blinks inside the input box

Actual result:
Cursor blinks below and outside the input box. See screenshot attached.

The key ingredient for exposing the bug seems to be the <div> that contains the input box having position:fixed. Normally this <div> is not scrollable. But when the <input> is focused, it seems that the view is scrolled in UIProcess, but the WebProcess didn't get the update.

[Frédéric Wang (:fredw)]

I can confirm the bug on trunk.

@Danyao: I've actually been studying stack traces to re-position the fixed node for other bugs and it is:

WebCore::ScrollingStateFixedNode::reconcileLayerPositionForViewportRect
WebCore::AsyncScrollingCoordinator::reconcileViewportConstrainedLayerPositions
WebCore::AsyncScrollingCoordinator::reconcileScrollingState
WebKit::WebPage::updateVisibleContentRects

Also IIRC AsyncScrollingCoordinator::reconcileScrollingState is called 
from WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll if you perform a programmatic scroll of the main frame (instead of user interaction).

WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll is also called when doing user interaction in "overflow: auto; webkit-overflow-scrolling: touch" nodes and interestingly in that case we tell WebEditorClient that the overflow scroll position has changed.

Maybe you can try to compare your testcase using scrollingElement.scrollTop = ... or "overflow: auto; webkit-overflow-scrolling: touch" nodes and see whether you get the same issue?

[Frédéric Wang (:fredw)]

@Danyao: It seems that this bug is fixed in WebKit trunk (I tried the testcase with the simulator), can you please try again?

[Simon Fraser (smfr)]

*** This bug has been marked as a duplicate of bug 176896 ***