[Backport] Merge: "INPUT element: Do not dispatch events in detachLayoutTree()." to M55 branch.

When a color chooser is closed, we dispatches a 'change' event asynchronously.
Some tests need to be updated due to this behavior change.

BUG=658535

Review-Url: https://codereview.chromium.org/2447653002
Cr-Commit-Position: refs/heads/master@{#427286}
(cherry picked from commit fbe37c7239e4a6e75f12c0d35e60987a6aa75ee0)

Review URL: https://codereview.chromium.org/2458743004 .

Change-Id: Icaa7e038198b8c41f98f02dd40910fbf4d1c8270
Cr-Commit-Position: refs/branch-heads/2883@{#353}
Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768}
(CVE-2016-5208)
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>

4 files changed, 17 insertions, 4 deletions

diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp b/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
index 1110e6f8d7f..b727fa5cf1e 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
@@ -207,6 +207,18 @@ void HTMLTextFormControlElement::dispatchFormControlChangeEvent()
     setChangedSinceLastFormControlChangeEvent(false);
 }
 
+void HTMLTextFormControlElement::enqueueChangeEvent() {
+  String newValue = value();
+  if (shouldDispatchFormControlChangeEvent(m_textAsOfLastFormControlChangeEvent,
+                                           newValue)) {
+    setTextAsOfLastFormControlChangeEvent(newValue);
+    WTF::RefPtr<Event> event = Event::createBubble(EventTypeNames::change);
+    event->setTarget(this);
+    document().enqueueAnimationFrameEvent(event);
+  }
+  setChangedSinceLastFormControlChangeEvent(false);
+}
+
 void HTMLTextFormControlElement::setRangeText(const String& replacement, ExceptionState& exceptionState)
 {
     setRangeText(replacement, selectionStart(), selectionEnd(), "preserve", exceptionState);
diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h b/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
index 1d1acee9e2b..36bbbf6614f 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.h
@@ -87,6 +87,7 @@ public:
     void setAutocapitalize(const AtomicString&);
 
     void dispatchFormControlChangeEvent() final;
+    void enqueueChangeEvent();
 
     virtual String value() const = 0;
     virtual void setValue(const String&, TextFieldEventBehavior = DispatchNoEvent) = 0;
diff --git a/chromium/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp b/chromium/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
index 4f3585c9516..6196e3189cb 100644
--- a/chromium/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
+++ b/chromium/third_party/WebKit/Source/core/html/forms/ColorInputType.cpp
@@ -214,9 +214,8 @@ void ColorInputType::didChooseColor(const Color& color)
 
 void ColorInputType::didEndChooser()
 {
-    EventQueueScope scope;
     if (LayoutTheme::theme().isModalColorChooser())
-        element().dispatchFormControlChangeEvent();
+        element().enqueueChangeEvent();
     m_chooser.clear();
 }
 
diff --git a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
index 541a2787747..9fecc3e0790 100644
--- a/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
+++ b/chromium/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
@@ -477,6 +477,7 @@ void WebPagePopupImpl::close()
 
 void WebPagePopupImpl::closePopup()
 {
+  {
     // This function can be called in EventDispatchForbiddenScope for the main
     // document, and the following operations dispatch some events.  It's safe
     // because web authors can't listen the events.
@@ -496,8 +497,8 @@ void WebPagePopupImpl::closePopup()
         // closeWidgetSoon() will call this->close() later.
         m_widgetClient->closeWidgetSoon();
     }
-
-    m_popupClient->didClosePopup();
+  }
+  m_popupClient->didClosePopup();
 }
 
 LocalDOMWindow* WebPagePopupImpl::window()