From 75c3be2a1e884c7cb6a95aa040350ca6b8e6fa29 Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jkew@mozilla.com>
Date: Sat, 19 Nov 2022 21:06:04 +0000
Subject: [PATCH] Bug 1801380 - Don't call RecomputeDirectionality() if the
 element has dir=auto. r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D162462
---
 dom/html/HTMLInputElement.cpp       | 4 ++--
 dom/html/crashtests/1801380.html    | 1 +
 dom/html/crashtests/crashtests.list | 1 +
 3 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 dom/html/crashtests/1801380.html

diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index 2440fcba8713..ddc05389227e 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -4485,8 +4485,8 @@ void HTMLInputElement::HandleTypeChange(FormControlType aNewType,
   // Changing type may affect directionality because of the special-case for
   // <input type=tel>, as specified in
   // https://html.spec.whatwg.org/multipage/dom.html#the-directionality
-  if (oldType == FormControlType::InputTel ||
-      mType == FormControlType::InputTel) {
+  if (!HasDirAuto() && (oldType == FormControlType::InputTel ||
+                        mType == FormControlType::InputTel)) {
     RecomputeDirectionality(this, aNotify);
   }
 
diff --git a/dom/html/crashtests/1801380.html b/dom/html/crashtests/1801380.html
new file mode 100644
index 000000000000..f4ce3e109fa5
--- /dev/null
+++ b/dom/html/crashtests/1801380.html
@@ -0,0 +1 @@
+<input dir="auto" type="tel">
diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list
index 99c949457dd2..915b00ac5aa6 100644
--- a/dom/html/crashtests/crashtests.list
+++ b/dom/html/crashtests/crashtests.list
@@ -95,3 +95,4 @@ load 1724816.html
 load 1785933.html
 load 1787671.html
 load 1789475.html
+load 1801380.html