Crash when 'input' event handler for input[type=color] changes the input type.
This is the same issue as described in this Blink security bug:
Heap-use-after-free in blink::ColorInputType::didChooseColor
Reproduced under ASan using Blink's layout test.
Created attachment 282345 [details]
Comment on attachment 282345 [details]
This looks sane to me.
Committed r202626: <http://trac.webkit.org/changeset/202626>