Merge 139151

Merge 139151

> REGRESSION(r135836): Invalid user input for input[type=number] should be cleared by input.value=""
> https://bugs.webkit.org/show_bug.cgi?id=106284
> 
> Reviewed by Hajime Morita.
> 
> Source/WebCore:
> 
> No new tests. Updates fast/forms/number/number/validity-badinput.html.
> 
> * html/NumberInputType.cpp:
> (WebCore::NumberInputType::setValue):
> If the new sanitized value is empty and innerTextValue is a bad input
> (it means !valueChanged && !innerTextValue().isEmpty() because the new
> sanitized value is empty), we need to update innerTextValue with the
> empty string.
> * html/NumberInputType.h:
> (NumberInputType): Declare setValue.
> 
> LayoutTests:
> 
> * fast/forms/number/number-validity-badinput.html:
> Add a test case.
> * fast/forms/number/number-validity-badinput-expected.txt:
> 

TBR=tkent@chromium.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=139720