REGRESSION(r135836): Invalid user input for input[type=number] should be cleared by input.value=""
https://bugs.webkit.org/show_bug.cgi?id=106284

Reviewed by Hajime Morita.

Source/WebCore:

No new tests. Updates fast/forms/number/number/validity-badinput.html.

* html/NumberInputType.cpp:
(WebCore::NumberInputType::setValue):
If the new sanitized value is empty and innerTextValue is a bad input
(it means !valueChanged && !innerTextValue().isEmpty() because the new
sanitized value is empty), we need to update innerTextValue with the
empty string.
* html/NumberInputType.h:
(NumberInputType): Declare setValue.

LayoutTests:

* fast/forms/number/number-validity-badinput.html:
Add a test case.
* fast/forms/number/number-validity-badinput-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139151 268f45cc-cd09-0410-ab3c-d52691b4dbfc