Set value of m_textAsOfLastFormControlChangeEvent before triggering change event

LayoutTests/fast/events/onchange-js.html

Index: LayoutTests/fast/events/onchange-js.html
diff --git a/LayoutTests/fast/events/onchange-js.html b/LayoutTests/fast/events/onchange-js.html
new file mode 100644
index 0000000000000000000000000000000000000000..3c24a0a7b074f300155e5a4a9a9e1c8dd977d9e3
--- /dev/null
+++ b/LayoutTests/fast/events/onchange-js.html
@@ -0,0 +1,31 @@
+<p>This test verifies that the change event is fired, when value is changed in change event handler.</p>
+<hr>
+<input id="input" type="text" onchange="changeHandler()"></input>

[keishi, 2014/06/04 21:26:22]

nit: input doesn't need end tag in html

[Habib Virji, 2014/06/05 08:43:23]

Done.

+<pre id="console"></pre>
+
+<script>
+function log(s)
+{
+    document.getElementById('console').appendChild(document.createTextNode(s + "\n"));
+}
+
+function changeHandler()
+{
+    log('change event fired');

[keishi, 2014/06/04 20:43:54]

nit: inconsistent string literal quotes. You used double quotes before.

[Habib Virji, 2014/06/05 08:43:23]

Done.

+    document.getElementById('input').value = ' ';

[keishi, 2014/06/04 21:26:22]

nit: use input variable

+}
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+    
+var input = document.getElementById('input');
+
+input.focus();
+document.execCommand("InsertText", false, "foo bar baz");
+input.blur();
+
+input.focus();
+document.execCommand("InsertText", false, "foo bar baz");

[keishi, 2014/06/04 20:43:54]

This test is not reproducing the bug.
InsertText just inserts the text at the caret so the value becomes " foo bar
baz" and m_textAsOfLastFormControlChangeEvent is "foo bar baz".

[Habib Virji, 2014/06/05 08:43:23]

Not sure, what I am trying to do with test is put same text as before change
event to see if change event triggers when blur is called.  Without the change
on second blur, change event is not fired. 

In the bug too out of focus is used to simulate. 

[keishi, 2014/06/05 09:02:17]

I tried this test on Chrome Canary and it passes so this test isn't triggering
the bug.
In order to trigger the bug, input.value after calling InsertText needs to
match.
The input.value after line 24 is "foo bar baz" but the input.value after line 28
is " foo bar baz" (notice the space before foo).

You should set the value to "" (empty string) inside changeHandler() in order to
fix this (just like the original bug).

[Habib Virji, 2014/06/05 09:33:31]

Thanks Keishi, I have updated test to now check strings at all points. Last
changeEventCounter should fail in latest canary and with the patch will pass. 

+input.blur();
+
+</script>