Issue 876656  has been merged into this issue.

marcoditullio89@ Thanks for the update.

Able to reproduce this issue on Windows 10 and Ubuntu 17.10 on the reported version 68.0.3440.106 and latest Canary 70.0.3531.0 as per the original comment.
Note: Issue is not observed on Mac OS 10.13.3.

Bisect Information:
===================
Good Build: 68.0.3440.40
Bad Build : 68.0.3440.41

Unable to run the bisect as this is regressed in branch builds, hence below is the manual changelog URL from omahaproxy

https://chromium.googlesource.com/chromium/src/+log/68.0.3440.40..68.0.3440.41?pretty=fuller&n=10000

From the above Changelog, suspecting the below change:
Reviewed-on: https://chromium-review.googlesource.com/1099183

Assigning this issue to reviewer dcheng@ as the owner creis@ is out of office.
dcheng@ Please check and confirm if this issue is related to your change, else help us in assigning to the right owner.

Adding 'ReleaseBlock-Stable' for M-69 as this is a recent regression. Please feel free to remove if it is not applicable.

Thanks

(assigning to the author of the CL, since I was only a reviewer)

Thanks to all of you, I'm honestly impressed for the quick response.

This is another symptom of  issue 647378 . There had been a hacky workaround for that problem which had to be removed in M68, and I haven't written a proper fix for it. I will be getting to that soon.

The problem is that the part of the page containing the textareas doesn't see you release the mouse button, so it still thinks there is an active drag. The problem goes away immediately if you move the mouse cursor off of the PDF.

I didn't think we usually marked bugs ReleaseBlock-Stable when they are discovered after they have already made it to Stable channel.

Specifically it will happen whenever you are selecting text with a right-to-left mouse drag and the mouse crosses over a boundary of a PDF or a cross-origin iframe before you release the button.

The text appears to be entered backward because the mouse is effectively pinning the caret at the beginning of the input area. It behaves as it would normally if you didn't release the mouse button. I don't think we had considered this particular behavior, but it is the same underlying problem as with iframes or PDFs not auto-scrolling when you drag select text and move the mouse off the button of the iframe.

M69 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Merge has to happen latest by 1:00 PM PT Tuesday (08/28/18) in order to make it to next week stable cut. Thank you.

As this issue exists on M68 and we're very close to M69 stable promotion, we won't consider this as M69 stable blocker. Pls lets us know ASAP if there is any concern here. Thank you.

I agree this shouldn't be a stable blocker. It would be difficult to merge a fix in any case.

Targeting fix for M70 per comments #12 and #13.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/334029e1be165c014c310d2f371433eebc0ee7ff

commit 334029e1be165c014c310d2f371433eebc0ee7ff
Author: Ken Buchanan <kenrb@chromium.org>
Date: Fri Aug 31 19:29:00 2018

Capture mouse events to a widget during drag selection

Currently when the mouse cursor moves between OOPIF boundaries while
a selection is being dragged, the frame containing the selection stops
receiving mouse events. This causes a number of bugs such as the
relevant frame not being aware of when the mouse button is released.

This CL causes Blink's SelectionController to signal the browser
process for mouse capture to the current RenderWidgetHost.

Bug:  876662 ,  864957 ,  647378 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: Id9d4bb6bdb6a3fa33b4e15af35a0588e952755fe
Reviewed-on: https://chromium-review.googlesource.com/1197409
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#588115}
[modify] https://crrev.com/334029e1be165c014c310d2f371433eebc0ee7ff/content/browser/site_per_process_hit_test_browsertest.cc
[modify] https://crrev.com/334029e1be165c014c310d2f371433eebc0ee7ff/third_party/blink/renderer/core/editing/selection_controller.cc

Able to reproduce this issue on Ubuntu 17.10 on the reported version 68.0.3440.106 and the issue is fixed on the latest M-71 build 71.0.3541.0 as per comment #3.
Can observed that the Text area starts to type correctly after a text selection in PDF iframe.
Attached is the screen cast for reference.

Unable to provide the Windows behavior as the latest M-71 build is not available. 

Thanks..

Deleted: 876662-M71.webm 2.5 MB

	876662-M71.webm 2.5 MB View Download

[Auto-generated comment by a script] We noticed that this issue is targeted for M-70; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-70 label, otherwise remove Merge-TBD label. Thanks.

 Issue 880606  has been merged into this issue.

Ken, is this something we can safely merge to M70, per comment 18?  Thanks for the fix!

It should be okay to merge, but it caused an occasional browser process crash which was separately fixed in r588563. That would have to be merged also.

Thanks.  Looks like the crash fix you mention (for issue 880203) is simple as well, though it just landed yesterday.  Let's plan to let that bake one more day and then request merge for both together.  Thanks!

The NextAction date has arrived: 2018-09-06

No more reports of problems, requesting merge. If this is approved, then the fix on issue 880203 will also have to be approved for merge, because that fixes a regression that this CL caused.

Your change meets the bar and is auto-approved for M70. Please go ahead and merge the CL to branch 3538 manually. Please contact milestone owner if you have questions.
Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/71492bd2eba9f53ef41d54ac93aa7c7121928d6b

commit 71492bd2eba9f53ef41d54ac93aa7c7121928d6b
Author: Ken Buchanan <kenrb@chromium.org>
Date: Mon Sep 10 17:46:33 2018

Capture mouse events to a widget during drag selection

Currently when the mouse cursor moves between OOPIF boundaries while
a selection is being dragged, the frame containing the selection stops
receiving mouse events. This causes a number of bugs such as the
relevant frame not being aware of when the mouse button is released.

This CL causes Blink's SelectionController to signal the browser
process for mouse capture to the current RenderWidgetHost.

Bug:  876662 ,  864957 ,  647378 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: Id9d4bb6bdb6a3fa33b4e15af35a0588e952755fe
Reviewed-on: https://chromium-review.googlesource.com/1197409
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Ken Buchanan <kenrb@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#588115}(cherry picked from commit 334029e1be165c014c310d2f371433eebc0ee7ff)
Reviewed-on: https://chromium-review.googlesource.com/1216715
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/branch-heads/3538@{#226}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}
[modify] https://crrev.com/71492bd2eba9f53ef41d54ac93aa7c7121928d6b/content/browser/site_per_process_hit_test_browsertest.cc
[modify] https://crrev.com/71492bd2eba9f53ef41d54ac93aa7c7121928d6b/third_party/blink/renderer/core/editing/selection_controller.cc

 Issue 884702  has been merged into this issue.

 Issue 882491  has been merged into this issue.