Renderer is recreated unexpectedly after detach in HTMLInputElement
https://bugs.webkit.org/show_bug.cgi?id=108150

Reviewed by Kent Tamura.

Source/WebCore:

After r140659, destoryShadowSubtree() may update style in removeChild(). It causes
attaching HTMLInputElement before creating shadowsubtree in HTMLInputElement::updateType().

For safe, destroyShadowSubtree() should be done before detach().

Test: fast/forms/number/number-change-type-on-focus-2.html

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateType):

LayoutTests:

* fast/forms/time-multiple-fields/time-multiple-fields-change-type-on-focus-2.html: Added.
* fast/forms/time-multiple-fields/time-multiple-fields-change-type-on-focus-2-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141228 268f45cc-cd09-0410-ab3c-d52691b4dbfc