Fix a crash when 'input' event handler for input[type=color] change the input type.
Delaying 'input' event dispatched by HTMLInputElement::setValueFromRenderer().
BUG=569170
TEST=automated
Review URL: https://codereview.chromium.org/1523633002
Cr-Commit-Position: refs/heads/master@{#364979}
diff --git a/third_party/WebKit/LayoutTests/fast/forms/color/color-type-change-on-input-crash.html b/third_party/WebKit/LayoutTests/fast/forms/color/color-type-change-on-input-crash.html
new file mode 100644
index 0000000..5bfa915
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/color/color-type-change-on-input-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<body>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+test(function() {
+ var input = document.createElement('input');
+ input.type = 'color';
+ input.oninput = function() {
+ this.type = 'text';
+ };
+ internals.selectColorInColorChooser(input, '#ff0000');
+}, 'Changing the input type from "color" to another in "input" event handler should not crash.');
+</script>
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElement.h b/third_party/WebKit/Source/core/html/HTMLInputElement.h
index 2d28e4b..9227523 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLInputElement.h
@@ -136,6 +136,9 @@
String valueWithDefault() const;
+ // This function dispatches 'input' event for non-textfield types. Callers
+ // need to handle any DOM structure changes by event handlers, or need to
+ // delay the 'input' event with EventQueueScope.
void setValueFromRenderer(const String&);
int selectionStartForBinding(ExceptionState&) const;
diff --git a/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp b/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
index 25c73d7..efab8d9 100644
--- a/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
@@ -206,6 +206,7 @@
{
if (element().isDisabledFormControl() || color == valueAsColor())
return;
+ EventQueueScope scope;
element().setValueFromRenderer(color.serialized());
element().updateView();
if (!LayoutTheme::theme().isModalColorChooser())
