Fixed an IME bug due to a race in TextInputStateChanged

content/browser/renderer_host/render_widget_host_impl.cc

Index: content/browser/renderer_host/render_widget_host_impl.cc
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 9914db5ce83b44decb9fab14cf8324256ae85c9c..f1d9828f380c01262626466c5b250351084b6c1f 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -52,6 +52,7 @@
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/render_widget_host_owner_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
+#include "content/browser/renderer_host/text_input_manager.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_switches_internal.h"
@@ -2041,6 +2042,23 @@ void RenderWidgetHostImpl::SetTouchEventEmulationEnabled(
 
 void RenderWidgetHostImpl::OnTextInputStateChanged(
     const TextInputState& params) {
+  // TODO(ekaramad): Remove this with BrowserPlugin (https://crbug.com/533069).
+  if (delegate_ && delegate_->GetTextInputManager() &&
+      delegate_->GetTextInputManager()->GetTextInputState() &&
+      delegate_->GetTextInputManager()->GetTextInputState()->type !=
+          ui::TEXT_INPUT_TYPE_NONE &&
+      delegate_->HasFocusedGuests()) {
+    // There is a focused BrowserPlugin-based guest on the page, therefore do
+    // not forward any update to the |view_|. We reach here because focus has
+    // recently been passed on BrowserPlugin but at the same time, RenderWidget
+    // needed to update TextInputState (e.g., an <input> blurred before the
+    // plugin received focus). Since there is no guarantee on the order of the
+    // update IPCs received from the guest process and the embedder process,
+    // this update may be overwriting the correct update from the guest (
+    // https://crbug.com/546645).
+    return;
+  }
+
   if (view_)
     view_->TextInputStateChanged(params);
 }