Currently in InputHandler::nodeFocused() we pass the currently focused node based on the call site. Testing has shown that the ChromeClientBlackBerry call site which is passed the node change can be stale if JS focus changes are also occurring. nodeFocused should always query the current focused node and use that.
Created attachment 130820 [details] Patch
Comment on attachment 130820 [details] Patch Clearing flags on attachment: 130820 Committed r110175: <http://trac.webkit.org/changeset/110175>
All reviewed patches have been landed. Closing bug.
Created attachment 130859 [details] Follow up patch
Re-opening as this can crash if toRange or fromRange is null.
Comment on attachment 130859 [details] Follow up patch Clearing flags on attachment: 130859 Committed r110230: <http://trac.webkit.org/changeset/110230>