Bug 1343037 part 4. Fix type changes on an input to properly grab the selection offsets from the old editor before we ask the editor state for them. r=ehsan

MozReview-Commit-ID: IDdt0qedJpT

dom/html/HTMLInputElement.cpp

@@ -5136,6 +5136,7 @@ HTMLInputElement::HandleTypeChange(uint8_t aNewType)
   nsTextEditorState::SelectionProperties sp;
 
   if (GetEditorState()) {
+    mInputData.mState->SyncUpSelectionPropertiesBeforeDestruction();
     sp = mInputData.mState->GetSelectionProperties();
   }
 

dom/html/nsTextEditorState.cpp

@@ -1537,6 +1537,14 @@ nsTextEditorState::GetSelectionProperties()
   return mSelectionProperties;
 }
 
+void
+nsTextEditorState::SyncUpSelectionPropertiesBeforeDestruction()
+{
+  if (mBoundFrame) {
+    UnbindFromFrame(mBoundFrame);
+  }
+}
+
 void
 nsTextEditorState::SetSelectionProperties(nsTextEditorState::SelectionProperties& aProps)
 {

dom/html/nsTextEditorState.h

@@ -261,6 +261,10 @@ public:
   void SetSelectionProperties(SelectionProperties& aProps);
   void WillInitEagerly() { mSelectionRestoreEagerInit = true; }
   bool HasNeverInitializedBefore() const { return !mEverInited; }
+  // Sync up our selection properties with our editor prior to being destroyed.
+  // This will invoke UnbindFromFrame() to ensure that we grab whatever
+  // selection state may be at the moment.
+  void SyncUpSelectionPropertiesBeforeDestruction();
 
   // Get the selection range start and end points in our text.
   nsresult GetSelectionRange(int32_t* aSelectionStart, int32_t* aSelectionEnd);