Following two tests are effective for other input types: 1. number-change-type-on-focus.html Change input type during event handling 2. number-crash.html Get rid renderer object during event handling
Created attachment 154002 [details] Patch 1
Created attachment 154003 [details] Patch 2
Comment on attachment 154003 [details] Patch 2 Could you review this patch? Thanks in advance.
Comment on attachment 154003 [details] Patch 2 View in context: https://bugs.webkit.org/attachment.cgi?id=154003&action=review > LayoutTests/fast/forms/resources/common-change-type-on-focus.js:3 > +function doTest(sampleId) should have more descriptive function name. > LayoutTests/fast/forms/resources/common-losing-renderer-on-click.js:1 > +function test() ditto.
Created attachment 154215 [details] Patch 3
Comment on attachment 154215 [details] Patch 3 ok
Comment on attachment 154215 [details] Patch 3 Clearing flags on attachment: 154215 Committed r123563: <http://trac.webkit.org/changeset/123563>
All reviewed patches have been landed. Closing bug.