Created attachment 48174 [details]
See attached testcase; if the focus handler on a text field changes the text field's parent display to inline-block, then the text field loses the ability to receive key events (but it retains focus).
This affects the Facebook signup page.
The problem here is that VisibleSelection.start() keeps pointing to the old m_innerText of the RenderTextControlSingleLine, even after a new one gets created during layout.
Created attachment 48190 [details]
Comment on attachment 48190 [details]
Mitz points out that Element::attach() goes to some length to avoid calling updateFocusAppearance() directly.
Created attachment 48196 [details]