INPUT/TEXTAREA elements: Fix incorrect selectionStart/selectionEnd values after blur.

third_party/WebKit/Source/core/html/TextControlElement.cpp

Index: third_party/WebKit/Source/core/html/TextControlElement.cpp
diff --git a/third_party/WebKit/Source/core/html/TextControlElement.cpp b/third_party/WebKit/Source/core/html/TextControlElement.cpp
index 6eb7ed0df1f12ff32856e8de60e1df06cd67081e..e7e5ad0aac7f7b1094dec12d9ecc3770171f7abf 100644
--- a/third_party/WebKit/Source/core/html/TextControlElement.cpp
+++ b/third_party/WebKit/Source/core/html/TextControlElement.cpp
@@ -99,6 +99,18 @@ void TextControlElement::DefaultEventHandler(Event* event) {
   if (event->type() == EventTypeNames::webkitEditableContentChanged &&
       GetLayoutObject() && GetLayoutObject()->IsTextControl()) {
     last_change_was_user_edit_ = !GetDocument().IsRunningExecCommand();
+
+    if (IsFocused()) {
+      // Updating the cache in SelectionChanged() isn't enough because
+      // SelectionChanged() is not called if:
+      // - Text nodes in the inner-editor is split to multiple, and
+      // - The caret is on the beginning of a Text node, and its previous node
+      //   is updated, or
+      // - The caret is on the end of a text node, and its next node is updated.
+      CacheSelection(ComputeSelectionStart(), ComputeSelectionEnd(),
+                     ComputeSelectionDirection());
+    }
+
     SubtreeHasChanged();
     return;
   }