Focus the box below with a CJK IME active. The page tells the browser the caret/control rect is far outside the content area (negative y, huge x). These coordinates flow unclamped through the browser process to the OS IME's candidate-window positioning API (TSF GetTextExt / IMM32 IMR_QUERYCHARPOSITION / IBus SetCursorLocation / ChromeOS SetCursorAndCompositionBounds).