The cause is that, CompositeEditCommand::apply() enstacks the undo step (via Editor::appliedEditing) outside the EventQueueScope.

If the command triggers an event handler that creates another command, the new command is enstacked earlier than the old command, causing the issue.

Note: haven't fully understood what happens when the first command is a TypingCommand, whose enstacking is different from other commands.

Investigation on typing command:

If there is no open typing command, typing is done by CEC::apply() and appliedEditing() is called within the EventQueueScope, which doesn't introduce any buggy behavior.

However, if there already exists an open typing command, then the handling of typing is not in any event queue! Any buggy behavior can happen...

Repro case for typing: https://jsfiddle.net/kn22vmyo/1/

Type 'a\n' in the first <div>, and then undo for twice. The undo ordering is wrong

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/91ce4c5c6b3c38b5291c94d897f691b30282cd79

commit 91ce4c5c6b3c38b5291c94d897f691b30282cd79
Author: xiaochengh <xiaochengh@chromium.org>
Date: Wed Feb 22 17:01:53 2017

Fix undo stack ordering for all-but-typing commands

When one top-level editing command triggers another command via
event handlers, Blink used to have their undo ordering reversed.
The reason is that the enstacking of commands is not protected
by EventQueueScope; consequently, the commands are executed in
a nested manner, making the first command end later than the
second command.

This patch protects everything in CompositeEditCommand::apply
with EventQueueScope, so that the nesting behavior for all
commands (except TypingCommand) is eliminated.

BUG= 685975 
TEST=editing/undo/drag_with_mutation_event_undo_order.html

Review-Url: https://codereview.chromium.org/2674173002
Cr-Commit-Position: refs/heads/master@{#452095}

[add] https://crrev.com/91ce4c5c6b3c38b5291c94d897f691b30282cd79/third_party/WebKit/LayoutTests/editing/undo/paste_with_mutation_event_undo_order.html
[modify] https://crrev.com/91ce4c5c6b3c38b5291c94d897f691b30282cd79/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7a5e5d369147c5ce7977ebf1d5ae97d4c572abb4

commit 7a5e5d369147c5ce7977ebf1d5ae97d4c572abb4
Author: xiaochengh <xiaochengh@chromium.org>
Date: Thu Feb 23 03:26:05 2017

Fix undo stack ordering with TypingCommand

This patch guards certain parts in TypingCommand by EventQueueScope,
so that when adding to an open typing command, if MutationEvent is
triggered, the undo stack ordering is still maintained.

BUG= 685975 
TEST=editing/undo/type_with_mutation_event_undo_order.html

Review-Url: https://codereview.chromium.org/2700913002
Cr-Commit-Position: refs/heads/master@{#452373}

[add] https://crrev.com/7a5e5d369147c5ce7977ebf1d5ae97d4c572abb4/third_party/WebKit/LayoutTests/editing/undo/type_with_mutation_event_undo_order.html
[modify] https://crrev.com/7a5e5d369147c5ce7977ebf1d5ae97d4c572abb4/third_party/WebKit/Source/core/editing/commands/TypingCommand.cpp