Keyboard event should not insert a character at selection if selection doesn't have focus

third_party/WebKit/Source/core/editing/EditorKeyBindings.cpp

 /*
  * Copyright (C) 2006, 2007 Apple, Inc.  All rights reserved.
  * Copyright (C) 2012 Google, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 42 matching lines @@
       return false;
     return command.execute(evt);
   }
 
   if (command.execute(evt))
     return true;
 
   if (!behavior().shouldInsertCharacter(*evt) || !canEdit())
     return false;
 
+  const Element* const focusedElement = m_frame->document()->focusedElement();
+  if (!focusedElement) {
+    // We may lose focused element by |command.execute(evt)|.
+    return false;
+  }
+  if (!focusedElement->containsIncludingHostElements(
+          *m_frame->selection().start().computeContainerNode())) {
+    // We should not insert text at selection start if selection doesn't have
+    // focus. See http://crbug.com/89026
+    return false;
+  }
+
   // Return true to prevent default action. e.g. Space key scroll.
   if (dispatchBeforeInputInsertText(evt->target(), keyEvent->text) !=
       DispatchEventResult::NotCanceled)
     return true;
 
   return insertText(keyEvent->text, evt);
 }
 
 void Editor::handleKeyboardEvent(KeyboardEvent* evt) {
   // Give the embedder a chance to handle the keyboard event.
   if (client().handleKeyboardEvent(m_frame) || handleEditingKeyboardEvent(evt))
     evt->setDefaultHandled();
 }
 
 }  // namespace blink