blink::Editor::AppliedEditing triggers with 
   
   cmd->IsTypingCommand()==true

...in the InsertText scenario as well, meaning that we can't trivially use that as a means of rejecting non-user changes.

It's also worth noting that the treatment of execCommand('InsertText') as user-input confuses other logic, for instance, signals used as input into the tab-discarding algorithm:

 web_view_->PageImportanceSignals()->SetHadFormInteraction();

+mustaq, rbyers since one of the solutions being considering is to check for presence of a user gesture during execCommand, which seems reasonable enough to me at first blush.

Hotlist in #6 seems like a mistake?

Re #5: it turns out that Document trivially allows detection of an in progress ExecCommand so I plan to test that directly instead of looking at UserGestures. https://chromium-review.googlesource.com/666118

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7e05b5d9799fdb4f264592a25b5edc2a1a936935

commit 7e05b5d9799fdb4f264592a25b5edc2a1a936935
Author: Eric Lawrence <elawrence@chromium.org>
Date: Fri Sep 15 19:49:05 2017

Avoid triggering 'Not Secure' warning when execCommand changes input

HTTPBad Phase 2 calls for showing 'Not Secure' on pages where the user
edits an INPUT field on a non-secure page. Testing revealed that some
JavaScript libraries call execCommand("InsertText"...) during page load.
This bubbles up to ChromeClientImpl::DidChangeValueInTextField and
causes the Not Secure warning to appear prematurely.

This CL ignores value changes that occur due to an execCommand call.

Bug:  764760 
Change-Id: I3fc6a695ee314dc4c1941c3f2ddfa99053bcefad
Reviewed-on: https://chromium-review.googlesource.com/666118
Commit-Queue: Eric Lawrence <elawrence@chromium.org>
Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#502332}
[modify] https://crrev.com/7e05b5d9799fdb4f264592a25b5edc2a1a936935/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc
[modify] https://crrev.com/7e05b5d9799fdb4f264592a25b5edc2a1a936935/third_party/WebKit/Source/core/page/ChromeClientImpl.cpp

Verified fixed in 63.0.3217.0. I'll need to merge to m62

This bug requires manual review: M62 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Can you please indicate which OS this will impact?

Thanks for the fix. Can you please confirm if this is a safe merge overall and why can we not wait until M63? I see it's quite of a small patch and already verified in Canary; however, since it's touching all platforms and we're already few weeks after M62 branch, we'd like to ensure all fixes are truly necessary and safe merges.  

Yes, this should be an extremely safe merge; it doesn't introduce anything except an additional check of a boolean flag.

It can't wait to M63 because it scopes a feature launch; the bug incorrectly changes the behavior of webpages that use a popular JavaScript library. We need the new feature to match the public documentation and outreach: https://blog.chromium.org/2017/04/next-steps-toward-more-connection.html

Thanks for more details. Approving merge to M62. Branch: 3202

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cacea9d0352263678bf3b1e20ab257323fab4b4b

commit cacea9d0352263678bf3b1e20ab257323fab4b4b
Author: Eric Lawrence <elawrence@chromium.org>
Date: Tue Sep 19 18:51:14 2017

Avoid triggering 'Not Secure' warning when execCommand changes input

HTTPBad Phase 2 calls for showing 'Not Secure' on pages where the
user edits an INPUT field on a non-secure page. Testing revealed
that some JavaScript libraries call execCommand("InsertText"...)
during page load. This bubbles up to
ChromeClientImpl::DidChangeValueInTextField and causes the Not
Secure warning to appear prematurely.

This CL ignores value changes that occur due to an execCommand call.

Bug:  764760 
Change-Id: I3fc6a695ee314dc4c1941c3f2ddfa99053bcefad
Reviewed-on: https://chromium-review.googlesource.com/666118
Commit-Queue: Eric Lawrence <elawrence@chromium.org>
Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#502332}(cherry picked from commit 7e05b5d9799fdb4f264592a25b5edc2a1a936935)
Reviewed-on: https://chromium-review.googlesource.com/673007
Reviewed-by: Eric Lawrence <elawrence@chromium.org>
Cr-Commit-Position: refs/branch-heads/3202@{#328}
Cr-Branched-From: fa6a5d87adff761bc16afc5498c3f5944c1daa68-refs/heads/master@{#499098}
[modify] https://crrev.com/cacea9d0352263678bf3b1e20ab257323fab4b4b/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc
[modify] https://crrev.com/cacea9d0352263678bf3b1e20ab257323fab4b4b/third_party/WebKit/Source/core/page/ChromeClientImpl.cpp

Verified in 62; initially in 62.0.3202.29