Load the attached test case Click into the text field Text field is focused but selection isn't placed into the field <rdar://problem/6748324>
Created attachment 29427 [details] test case
The bug appears to be in handleMousePressEvent. There, we refetch the target node if it's a shadow node inside of a form field, see EventHandler.cpp:1156. In the test case, when we do that refetch we hit test with a bad document point. The document point is bad because it's generated from the window coordinate of the mouse click pre-scroll/zoom. the fix is to cache the document point before we dispatch the mouse event (since the window can scroll/zoom there).
Created attachment 29432 [details] patch
http://trac.webkit.org/changeset/42456