A quick fix for Issue 9762 and 9763....

chrome/browser/renderer_host/render_widget_host.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_H_
 #define CHROME_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_H_
 
 #include <queue>
 #include <vector>
 
@@ skipping 220 matching lines @@
   // Becauses of auto-repeat, we may receive the same key-press event many
   // times while we presses the keys and it is nonsense to send the same IPC
   // messsage every time when we receive a key-press event.
   // To suppress the number of IPC messages, we just update the text direction
   // when receiving a key-press event and send an IPC message when we release
   // the keys as listed in the following snippet.
   //   if (key_event.type == WebKeyboardEvent::KEY_DOWN) {
   //     if (key_event.windows_key_code == 'A' &&
   //         key_event.modifiers == WebKeyboardEvent::CTRL_KEY) {
   //       UpdateTextDirection(dir);
+  //     } else {
+  //       CancelUpdateTextDirection();
   //     }
   //   } else if (key_event.type == WebKeyboardEvent::KEY_UP) {
   //     NotifyTextDirection();
   //   }
+  // Once we cancel updating the text direction, we have to ignore all
+  // succeeding UpdateTextDirection() requests until calling
+  // NotifyTextDirection(). (We may receive keydown events even after we
+  // canceled updating the text direction because of auto-repeat.)
   // Note: we cannot undo this change for compatibility with Firefox and IE.
   void UpdateTextDirection(WebTextDirection direction);
+  void CancelUpdateTextDirection();
   void NotifyTextDirection();
 
   // This is for derived classes to give us access to the resizer rect.
   // And to also expose it to the RenderWidgetHostView.
   virtual gfx::Rect GetRootWindowResizerRect() const;
 
  protected:
   // Internal implementation of the public Forward*Event() methods.
   void ForwardInputEvent(
       const WebKit::WebInputEvent& input_event, int event_size);
@@ skipping 139 matching lines @@
 
   // A queue of keyboard events. We can't trust data from the renderer so we
   // stuff key events into a queue and pop them out on ACK, feeding our copy
   // back to whatever unhandled handler instead of the returned version.
   KeyQueue key_queue_;
 
   // Set when we update the text direction of the selected input element.
   bool text_direction_updated_;
   WebTextDirection text_direction_;
 
+  // Set when we cancel updating the text direction.
+  // This flag also ignores succeeding update requests until we call
+  // NotifyTextDirection().
+  bool text_direction_canceled_;
+
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHost);
 };
 
 #endif  // CHROME_BROWSER_RENDERER_HOST_RENDER_WIDGET_HOST_H_