Backed out 2 changesets (bug 981248) for causing multiple failures.

CLOSED TREE

Backed out changeset 7a96708cc8b7 (bug 981248)
Backed out changeset 1eace7bd28d9 (bug 981248)

dom/html/HTMLInputElement.h

@@ -206,6 +206,11 @@ class HTMLInputElement final : public TextControlElement,
 
   virtual EventStates IntrinsicState() const override;
 
+  // Element
+ private:
+  virtual void AddStates(EventStates aStates) override;
+  virtual void RemoveStates(EventStates aStates) override;
+
  public:
   // TextControlElement
   virtual nsresult SetValueChanged(bool aValueChanged) override;
@@ -803,6 +808,8 @@ class HTMLInputElement final : public TextControlElement,
   double GetMinimumAsDouble() { return GetMinimum().toDouble(); }
   double GetMaximumAsDouble() { return GetMaximum().toDouble(); }
 
+  HTMLInputElement* GetOwnerNumberControl();
+
   void StartNumberControlSpinnerSpin();
   enum SpinnerStopState { eAllowDispatchingEvents, eDisallowDispatchingEvents };
   void StopNumberControlSpinnerSpin(
@@ -1387,13 +1394,6 @@ class HTMLInputElement final : public TextControlElement,
    */
   static bool IsDateTimeInputType(uint8_t aType);
 
-  /**
-   * Returns whether getting `.value` as a string should sanitize the value.
-   *
-   * See SanitizeValue.
-   */
-  bool SanitizesOnValueGetter() const;
-
   /**
    * Returns true if the element should prevent dispatching another DOMActivate.
    * This is used in situations where the anonymous subtree should already have