Created attachment 327427 [details] Screenshot showing cursor blinking outside of input box This bug was originally reported by folks from http://n26.com. See http://crbug.com/781297 for original repro steps. I created a minimal example that reproduces the problem: http://output.jsbin.com/cabejez Steps to reproduce: 1. On an iOS device, visit http://output.jsbin.com/cabejez in Safari 2. Tab on input box 3. Scroll the page up Expected result: Cursor blinks inside the input box Actual result: Cursor blinks below and outside the input box. See screenshot attached. The key ingredient for exposing the bug seems to be the <div> that contains the input box having position:fixed. Normally this <div> is not scrollable. But when the <input> is focused, it seems that the view is scrolled in UIProcess, but the WebProcess didn't get the update.
I can confirm the bug on trunk. @Danyao: I've actually been studying stack traces to re-position the fixed node for other bugs and it is: WebCore::ScrollingStateFixedNode::reconcileLayerPositionForViewportRect WebCore::AsyncScrollingCoordinator::reconcileViewportConstrainedLayerPositions WebCore::AsyncScrollingCoordinator::reconcileScrollingState WebKit::WebPage::updateVisibleContentRects Also IIRC AsyncScrollingCoordinator::reconcileScrollingState is called from WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll if you perform a programmatic scroll of the main frame (instead of user interaction). WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll is also called when doing user interaction in "overflow: auto; webkit-overflow-scrolling: touch" nodes and interestingly in that case we tell WebEditorClient that the overflow scroll position has changed. Maybe you can try to compare your testcase using scrollingElement.scrollTop = ... or "overflow: auto; webkit-overflow-scrolling: touch" nodes and see whether you get the same issue?
@Danyao: It seems that this bug is fixed in WebKit trunk (I tried the testcase with the simulator), can you please try again?
*** This bug has been marked as a duplicate of bug 176896 ***