#44371 SQL Lab: multi-cursor typing moves a cursor to the document end and inserts subsequent characters at the wrong position

Bug description

In Superset 6.0.0 SQL Lab, creating multiple cursors with Ctrl+left-click works, but typing can move a cursor to the end of the entire editor document. Subsequent characters are then inserted at the wrong position.

This was reproduced in the official Apache Superset 6.0.0 Docker image, as well as a separate custom-theme instance. The custom theme is not required to reproduce it. No query needs to be executed.

Steps to reproduce

Open SQL Lab in Superset 6.0.0 on Linux/Chromium.
Enter exactly these three lines, with no trailing newline:
```
abc
def
ghi
```
Click immediately after abc on line 1.
Hold Ctrl and left-click immediately after def on line 2 to add a second cursor.
Release Ctrl.
Type XY as two consecutive keystrokes (do not paste).

Expected result

abcXY
defXY
ghi

Both cursors should remain at their respective insertion positions.

Actual result

abcXY
defX
ghiY

The first character reaches both original insertion positions. A cursor then moves to the end of line 3, and the second character is inserted there.

Additional tested cases

Document / cursor positions	Result
Two lines; two cursors at both line ends	Appears to work
Three lines; two cursors at ends of lines 1 and 2	A cursor jumps to document end
Three lines; two cursors at ends of lines 1 and 3	Appears to work
Two lines; two cursors in the middle of the lines	Also fails: a cursor jumps to document end
Three lines; cursors at all three line ends	Selection collapses and typing produces incorrect content

The issue is not strictly a document line-count limit. The reset can be hidden when one cursor is already at the document end.

Environment

Superset: 6.0.0, official image apachesuperset.docker.scarf.sh/apache/superset:6.0.0 (also available locally as apache/superset:6.0.0).
Image revision: 6a1c30e5e7c3e28d0549c9c2ac0ff61607f26a2f.
Deployment: Docker Compose with the release's example setup and PostgreSQL.
Host: Debian 13, x86_64 Linux.
Python: 3.10.19 in the official Superset container.
Browser: Chromium 152.0.7977.82; reproduced using Playwright keyboard and mouse input against the running app.
Node: not used to build the official image locally.
Also reproduced in a separate custom-theme Superset 6.0.0 build; that build exposes Ace version 1.43.1 at runtime.
Latest Superset release/master: not tested. This report does not claim reproduction on those versions.

Diagnostic observations

On the custom-theme instance, browser instrumentation of the live editor showed this sequence during one multi-cursor keystroke:

editor.onTextInput("h")
  react-ace componentDidUpdate
    editor.setValue(intermediateText, 1)
      editor.navigateFileEnd()
  Ace forEachSelection / $onMultiSelectExec
  react-ace componentDidUpdate
    editor.setValue(updatedText, 1)
      editor.navigateFileEnd()
    selection.fromJSON(...)

By the time the selection is restored, one range already points to the document end. The same visible typing failure was independently reproduced in the official image. The trace suggests React/Ace value synchronization is resetting the selection during a multi-cursor operation; this is a diagnostic lead, not a confirmed upstream fix.

Temporary workaround

With two cursors, pasting the complete desired text once inserted that text at both intended locations in the tested case. Cursor positions still jumped afterward, so the cursors must be recreated before the next edit. Editing in an external editor and pasting the completed SQL is another workaround.

Related reports (not confirmed duplicates)

https://github.com/securingsincity/react-ace/issues/861 — cursor/text resets during debounced state updates.
https://github.com/securingsincity/react-ace/pull/122 — historical cursor preservation fix around setValue.
https://github.com/apache/superset/pull/30154 — historical SQL Lab cursor-update race condition fix.

The issue trackers were searched, but an exact match for this multi-cursor reproduction was not found. No screenshot or recording is attached; the examples above are actual observed input/output.

Screenshots/recordings

No response

Superset version

6.0.0

Python version

I don't know

Node version

I don't know

Browser

Chrome

Additional context

No response

Checklist

I have searched Superset docs and Slack and didn't find a solution to my problem.
I have searched the GitHub issue tracker and didn't find a similar bug report.
I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.