Fix a crash when 'input' event handler for input[type=color] change the input type.

third_party/WebKit/Source/core/html/HTMLInputElement.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 118 matching lines @@
     void setEditingValue(const String&);
 
     double valueAsDate(bool& isNull) const;
     void setValueAsDate(double, ExceptionState&);
 
     double valueAsNumber() const;
     void setValueAsNumber(double, ExceptionState&, TextFieldEventBehavior = DispatchNoEvent);
 
     String valueWithDefault() const;
 
+    // This function dispatches 'input' event for non-textfield types. Callers
+    // need to handle any DOM structure changes by event handlers, or need to
+    // delay the 'input' event with EventQueueScope.
     void setValueFromRenderer(const String&);
 
     int selectionStartForBinding(ExceptionState&) const;
     int selectionEndForBinding(ExceptionState&) const;
     String selectionDirectionForBinding(ExceptionState&) const;
     void setSelectionStartForBinding(int, ExceptionState&);
     void setSelectionEndForBinding(int, ExceptionState&);
     void setSelectionDirectionForBinding(const String&, ExceptionState&);
     void setSelectionRangeForBinding(int start, int end, ExceptionState&);
     void setSelectionRangeForBinding(int start, int end, const String& direction, ExceptionState&);
@@ skipping 244 matching lines @@
     // The ImageLoader must be owned by this element because the loader code assumes
     // that it lives as long as its owning element lives. If we move the loader into
     // the ImageInput object we may delete the loader while this element lives on.
     OwnPtrWillBeMember<HTMLImageLoader> m_imageLoader;
     OwnPtrWillBeMember<ListAttributeTargetObserver> m_listAttributeTargetObserver;
 };
 
 } // namespace blink
 
 #endif // HTMLInputElement_h