Created attachment 103895 [details] A reduction. From http://code.google.com/p/chromium/issues/detail?id=89647 How to repro: - Open attached html - Focus the text area - Type something Typed text should appear but doesn't.
Created attachment 103900 [details] Patch
This is a kind of bandaid fix. Although an ideal prevention for this kind of error is to deploy many invariant assertions, that is another, tough story...
Comment on attachment 103900 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=103900&action=review > LayoutTests/editing/input/style-change-during-input-expected.txt:5 > +PASS successfullyParsed is true > + > +TEST COMPLETE > +PASS window.target.value is "hello" The order of these lines will be fixed if you make the following changes > LayoutTests/editing/input/style-change-during-input.html:26 > + layoutTestController.notifyDone(); Call finishJSTest instead here. > LayoutTests/editing/input/style-change-during-input.html:30 > +successfullyParsed = true; You should set window.jsTestIsAsync = true instead. > Source/WebCore/ChangeLog:11 > + dirty. But that is problematic since the editing code assumes > + style staying clean during sellchecking phase. Please elaborate more before you land; e.g. HTMLTextAreaElement's shadow DOM is re-created, etc...
Created attachment 104009 [details] Patch
Comment on attachment 104009 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=104009&action=review > LayoutTests/editing/input/style-change-during-input-expected.txt:3 > +PASS window.target.value is "hello" No blank line here?
Comment on attachment 104009 [details] Patch Clearing flags on attachment: 104009 Committed r93087: <http://trac.webkit.org/changeset/93087>
This bug has been fixed.