Missing style invalidation for :in-range and :out-of-range.

third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 486 matching lines @@
 
 void TextFieldInputType::subtreeHasChanged() {
   bool wasChanged = element().wasChangedSinceLastFormControlChangeEvent();
   element().setChangedSinceLastFormControlChangeEvent(true);
 
   element().setValueFromRenderer(sanitizeUserInputValue(
       convertFromVisibleValue(element().innerEditorValue())));
   element().updatePlaceholderVisibility();
   element().pseudoStateChanged(CSSSelector::PseudoValid);
   element().pseudoStateChanged(CSSSelector::PseudoInvalid);
+  element().pseudoStateChanged(CSSSelector::PseudoInRange);
+  element().pseudoStateChanged(CSSSelector::PseudoOutOfRange);
 
   didSetValueByUserEdit(wasChanged ? ValueChangeStateChanged
                                    : ValueChangeStateNone);
 }
 
 void TextFieldInputType::didSetValueByUserEdit(ValueChangeState state) {
   if (!element().isFocused())
     return;
   if (ChromeClient* chromeClient = this->chromeClient())
     chromeClient->didChangeValueInTextField(element());
@@ skipping 36 matching lines @@
   return shouldSpinButtonRespondToMouseEvents() && element().isFocused();
 }
 
 void TextFieldInputType::spinButtonDidReleaseMouseCapture(
     SpinButtonElement::EventDispatch eventDispatch) {
   if (eventDispatch == SpinButtonElement::EventDispatchAllowed)
     element().dispatchFormControlChangeEvent();
 }
 
 }  // namespace blink