Input element: Fix the dirty value flag after type change.

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved.
@@ skipping 413 matching lines @@
   lazyReattachIfAttached();
 
   m_inputType = newType;
   m_inputTypeView = m_inputType->createView();
   m_inputTypeView->createShadowSubtree();
 
   setNeedsWillValidateCheck();
 
   bool willStoreValue = m_inputType->storesValueSeparateFromAttribute();
 
+  // https://html.spec.whatwg.org/multipage/forms.html#input-type-change
+  //
+  // 1. If the previous state of the element's type attribute put the value IDL
+  // attribute in the value mode, and the element's value is not the empty
+  // string, and the new state of the element's type attribute puts the value
+  // IDL attribute in either the default mode or the default/on mode, then set
+  // the element's value content attribute to the element's value.
   if (didStoreValue && !willStoreValue && hasDirtyValue()) {
     setAttribute(valueAttr, AtomicString(m_valueIfDirty));
     m_valueIfDirty = String();
     m_hasDirtyValue = false;
   }
+  // 2. Otherwise, if the previous state of the element's type attribute put the
+  // value IDL attribute in any mode other than the value mode, and the new
+  // state of the element's type attribute puts the value IDL attribute in the
+  // value mode, then set the value of the element to the value of the value
+  // content attribute, if there is one, or the empty string otherwise, and then
+  // set the control's dirty value flag to false.
   if (!didStoreValue && willStoreValue) {
     AtomicString valueString = fastGetAttribute(valueAttr);
     m_inputType->warnIfValueIsInvalid(valueString);
-    m_valueIfDirty = sanitizeValue(valueString);
-    m_hasDirtyValue = !m_valueIfDirty.isNull();
+    m_valueIfDirty = String();
+    m_hasDirtyValue = false;
   } else {
     if (!hasDirtyValue())
       m_inputType->warnIfValueIsInvalid(
           fastGetAttribute(valueAttr).getString());
     updateValueIfNeeded();
   }
 
   m_needsToUpdateViewValue = true;
   m_inputTypeView->updateView();
 
@@ skipping 1460 matching lines @@
 
 bool HTMLInputElement::hasFallbackContent() const {
   return m_inputTypeView->hasFallbackContent();
 }
 
 void HTMLInputElement::setFilesFromPaths(const Vector<String>& paths) {
   return m_inputType->setFilesFromPaths(paths);
 }
 
 }  // namespace blink