Bug 825247 - Fix unsafe use of JS::Value::toNumber in nsHTMLInputElement. r=bz a=bajaj