UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2749.0 Safari/537.36

Example URL:
https://jsfiddle.net/d_toybox/9uvbLzof/4/

Steps to reproduce the problem:
1. Load https://jsfiddle.net/d_toybox/9uvbLzof/4/
2. Move caret anywhere in <textarea> except end of its text
3. Type something with IME

What is the expected behavior?
I'm not sure where the composition string should be. However, at least, the unexpected commit string shouldn't be inserted by every key press.

What went wrong?
For example, if you type "123" with IME (just an example), the text will be:

abcdefghijklmnopqrstuvwx123y12z1

The scripf in the page moves caret position to the end of the text at first composition update of a composition. After that, decreases the caret offset at every compositionupdate.

In other words, when moving selection during composition, Chromium commits composition as is and continue the composition in new position.

Does it occur on multiple sites: Yes

Is it a problem with a plugin? No 

Did this work before? N/A 

Does this work in other browsers? Yes 

Chrome version: 53.0.2749.0  Channel: canary
OS Version: 10.0
Flash Version: Shockwave Flash 22.0 r0

On Firefox, composition string of IME isn't moved after a character inserted as a part of composition string. I'm not sure if this is the expected behavior for most web developers, however, under current design of Gecko, Firefox cannot change this behavior easily.