Crash when replacing parts of text inputs with content: url(...)
https://bugs.webkit.org/show_bug.cgi?id=101133

Reviewed by Kent Tamura.

Source/WebCore:

Disable directly setting content of elements in an input element's
shadow dom tree, because the setting breaks input element's behavior.

Tests: fast/forms/number/number-content-url-crash.html
       fast/forms/search/search-content-url-crash.html

* css/html.css:
(input::-webkit-textfield-decoration-container):
Use important to disable overriding an input element's content
property.
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::attach):
Added ASSERTION. No content should be applied to
input::-webkit-textfield-decoration-container.

LayoutTests:

* fast/forms/number/number-content-url-crash-expected.txt: Added.
* fast/forms/number/number-content-url-crash.html: Added.
* fast/forms/search/search-content-url-crash-expected.txt: Added.
* fast/forms/search/search-content-url-crash.html: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@134584 bbb929c8-8fbe-4397-9dbb-9b2b20218538
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index 36641c3..4a1e335 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -436,6 +436,7 @@
     display: -webkit-box;
     -webkit-box-align: center;
     -webkit-user-modify: read-only !important;
+    content: none !important;
 }
 
 input[type="search"]::-webkit-textfield-decoration-container {