Fixed an IME bug due to a race in TextInputStateChanged

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 
 #include <set>
 #include <tuple>
@@ skipping 34 matching lines @@
 #include "content/browser/renderer_host/input/timeout_monitor.h"
 #include "content/browser/renderer_host/input/touch_emulator.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/render_widget_host_owner_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
+#include "content/browser/renderer_host/text_input_manager.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_switches_internal.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/drag_messages.h"
 #include "content/common/frame_messages.h"
 #include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/input_messages.h"
 #include "content/common/resize_params.h"
 #include "content/common/text_input_state.h"
@@ skipping 1969 matching lines @@
     }
     touch_emulator_->Enable(config_type);
   } else {
     if (touch_emulator_)
       touch_emulator_->Disable();
   }
 }
 
 void RenderWidgetHostImpl::OnTextInputStateChanged(
     const TextInputState& params) {
+  // TODO(ekaramad): Remove this with BrowserPlugin (https://crbug.com/533069).
+  if (delegate_ && delegate_->GetTextInputManager() &&
+      delegate_->GetTextInputManager()->GetTextInputState() &&
+      delegate_->GetTextInputManager()->GetTextInputState()->type !=
+          ui::TEXT_INPUT_TYPE_NONE &&
+      delegate_->HasFocusedGuests()) {
+    // There is a focused BrowserPlugin-based guest on the page, therefore do
+    // not forward any update to the |view_|. We reach here because focus has
+    // recently been passed on BrowserPlugin but at the same time, RenderWidget
+    // needed to update TextInputState (e.g., an <input> blurred before the
+    // plugin received focus). Since there is no guarantee on the order of the
+    // update IPCs received from the guest process and the embedder process,
+    // this update may be overwriting the correct update from the guest (
+    // https://crbug.com/546645).
+    return;
+  }
+
   if (view_)
     view_->TextInputStateChanged(params);
 }
 
 void RenderWidgetHostImpl::OnImeCompositionRangeChanged(
     const gfx::Range& range,
     const std::vector<gfx::Rect>& character_bounds) {
   if (view_)
     view_->ImeCompositionRangeChanged(range, character_bounds);
 }
@@ skipping 561 matching lines @@
     // different from the receiver's.
     file_system_file.url =
         GURL(storage::GetIsolatedFileSystemRootURIString(
                  file_system_url.origin(), filesystem_id, std::string())
                  .append(register_name));
     file_system_file.filesystem_id = filesystem_id;
   }
 }
 
 }  // namespace content