Product / Component: Jira Cloud & Confluence Cloud / Core Shared UI Components (@atlaskit /user-picker)
Impact: Medium/High — Workflow Integrity & Accidental Data Assignment
Summary of the Issue
There is a noticeable race condition between human reaction/click execution time and asynchronous state transitions within the shared user-picker dropdown component.
When clicking into an assignee or user-mention field, the dropdown immediately renders local static options (Assign to me, Unassigned, Automatic). In everyday usage, this menu often remains static just long enough (~300ms–600ms) for a user to read the option, commit to an action, and initiate a physical mouse click.
However, once the background directory query resolves, the component destroys the initial layout and re-renders the global directory results right as the mouse click lands. Because click events register sequentially, the click coordinate hits an injected directory user rather than the intended target, leading to accidental reassignments and permissions changes.
Steps to Reproduce
- Focus an assignee field, page restriction modal, or inline task user-mention box.
- Notice the initial static placeholders (Assign to me / Unassigned) appear immediately.
- Pause for ~300ms–500ms (standard cognitive read-and-click time).
- Move the cursor and click Assign to me.
- Observe the background directory query payload resolve and re-render the dropdown contents right as the click registers.
Actual vs. Expected Behavior
- Actual Behavior: The layout shuffles underneath the mouse pointer mid-click, causing the user to accidentally select a directory user injected into those exact pixel coordinates a split-second prior.
- Expected Behavior: The visual positions of default actions should remain stable and uninterrupted while interacting with the menu.
Suggested Technical Mitigations
- Static Placeholder Locking: Lock early-rendering default elements (Assign to me / Unassigned) into a permanent, immutable top row so late-arriving asynchronous results append strictly below them.
- Click-Blanking Safety Buffer: Introduce a brief input-blocking buffer (100ms–150ms) following an asynchronous DOM layout shift to discard unintentional mis-clicks.
- Hover-Freeze State: If the cursor is actively hovering inside the dropdown bounding box, delay rendering incoming asynchronous search results until the cursor becomes stationary or exits.
Has anyone else encountered this race condition or found workarounds? Hoping the Atlassian frontend / design system team can review this component behavior.
