Created attachment 531221 [details] [diff] [review] Patch v1.0 1. Open the URL (data:text/html,<input maxlength="1" value="a">). 2. Type something with IME. 3. Commit the composition string. Then, you can see uncommitted string on the <input> but actually, the composition string was committed. When editor discards all characters at committing the composition string, it doesn't clean up the textnode for composition string. See the patch for the detail. This is a regression between Fx3.6 and Fx4. The regression range is between 20101007 and 20101008. I'm not sure the actual bug#.
Comment on attachment 531221 [details] [diff] [review] Patch v1.0 Can you please change the comment to say something like: // If we're exceeding the maxlength when composing IME, we need to clean up // the composing text, so we shouldn't return early. r=me with that.