Fix a crash when 'input' event handler for input[type=color] change the input type.

third_party/WebKit/Source/core/html/forms/ColorInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 188 matching lines @@
 void ColorInputType::valueAttributeChanged()
 {
     if (!element().hasDirtyValue())
         element().updateView();
 }
 
 void ColorInputType::didChooseColor(const Color& color)
 {
     if (element().isDisabledFormControl() || color == valueAsColor())
         return;
+    EventQueueScope scope;
     element().setValueFromRenderer(color.serialized());
     element().updateView();
     if (!LayoutTheme::theme().isModalColorChooser())
         element().dispatchFormControlChangeEvent();
 }
 
 void ColorInputType::didEndChooser()
 {
     EventQueueScope scope;
     if (LayoutTheme::theme().isModalColorChooser())
@@ skipping 67 matching lines @@
 {
     return m_chooser ? m_chooser->rootAXObject() : nullptr;
 }
 
 ColorChooserClient* ColorInputType::colorChooserClient()
 {
     return this;
 }
 
 } // namespace blink