Input element: Fix the dirty value flag after type change.

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLInputElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
index 653a4dd7c2a744354bcc1e2ab51421b72d634dc4..7acf9f402fdb1a966113b2b3a293182c44865dd9 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp
@@ -431,16 +431,29 @@ void HTMLInputElement::updateType() {
 
   bool willStoreValue = m_inputType->storesValueSeparateFromAttribute();
 
+  // https://html.spec.whatwg.org/multipage/forms.html#input-type-change
+  //
+  // 1. If the previous state of the element's type attribute put the value IDL
+  // attribute in the value mode, and the element's value is not the empty
+  // string, and the new state of the element's type attribute puts the value
+  // IDL attribute in either the default mode or the default/on mode, then set
+  // the element's value content attribute to the element's value.
   if (didStoreValue && !willStoreValue && hasDirtyValue()) {
     setAttribute(valueAttr, AtomicString(m_valueIfDirty));
     m_valueIfDirty = String();
     m_hasDirtyValue = false;
   }
+  // 2. Otherwise, if the previous state of the element's type attribute put the
+  // value IDL attribute in any mode other than the value mode, and the new
+  // state of the element's type attribute puts the value IDL attribute in the
+  // value mode, then set the value of the element to the value of the value
+  // content attribute, if there is one, or the empty string otherwise, and then
+  // set the control's dirty value flag to false.
   if (!didStoreValue && willStoreValue) {
     AtomicString valueString = fastGetAttribute(valueAttr);
     m_inputType->warnIfValueIsInvalid(valueString);
-    m_valueIfDirty = sanitizeValue(valueString);
-    m_hasDirtyValue = !m_valueIfDirty.isNull();
+    m_valueIfDirty = String();
+    m_hasDirtyValue = false;
   } else {
     if (!hasDirtyValue())
       m_inputType->warnIfValueIsInvalid(