INPUT/TEXTAREA elements: Dispatch 'change' event even if a user-edit value is overwritten by JS

third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
index 28f1b5d6a5a7a96f271aaa7f89b60bf385fc7565..8c6d287c782fa58b250c34beed1c8051da66197d 100644
--- a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
@@ -216,8 +216,16 @@ void HTMLTextFormControlElement::setChangedSinceLastFormControlChangeEvent(
 void HTMLTextFormControlElement::setFocused(bool flag) {
   HTMLFormControlElementWithState::setFocused(flag);
 
-  if (!flag && wasChangedSinceLastFormControlChangeEvent())
-    dispatchFormControlChangeEvent();
+  if (!flag) {
+    if (wasChangedSinceLastFormControlChangeEvent()) {
+      dispatchFormControlChangeEvent();
+    } else {
+      // |value| IDL attribute setter haven't updated
+      // textAsOfLastFormControlChangeEvent while this is focused. So we
+      // synchronize now.
+      setTextAsOfLastFormControlChangeEvent(value());
+    }
+  }
 }
 
 bool HTMLTextFormControlElement::shouldDispatchFormControlChangeEvent(