Bug 1588745 - part 3: Make TextControlState not deleted actually while it handles something r=Ehsan

Currently, nobody guarantees that `TextControlState` won't be deleted while
it handles something with `MOZ_CAN_RUN_SCRIPT` methods.

This patch hides its destructor (and constructor) for making only
`TextControlState` itself can delete its instances.  Then, if instance owner
wants to delete it while handling action(s), the oldest `AutoHandlingState`
will delete the `TextControlState`.

Depends on D51392

Differential Revision: https://phabricator.services.mozilla.com/D51393

dom/html/HTMLInputElement.cpp

@@ -942,19 +942,21 @@ bool HTMLInputElement::sShutdown = false;
 
 /* static */
 void HTMLInputElement::ReleaseTextControlState(TextControlState* aState) {
-  if (!sShutdown && !sCachedTextControlState) {
+  if (!sShutdown && !sCachedTextControlState && !aState->IsBusy()) {
     aState->PrepareForReuse();
     sCachedTextControlState = aState;
   } else {
-    delete aState;
+    aState->Destroy();
   }
 }
 
 /* static */
 void HTMLInputElement::Shutdown() {
   sShutdown = true;
-  delete sCachedTextControlState;
-  sCachedTextControlState = nullptr;
+  if (sCachedTextControlState) {
+    sCachedTextControlState->Destroy();
+    sCachedTextControlState = nullptr;
+  }
 }
 
 //
@@ -2656,6 +2658,8 @@ nsresult HTMLInputElement::SetValueInternal(const nsAString& aValue,
         // automatically dispatched by TextControlState::SetValue().
         // If you'd change condition of calling this method, you need to
         // maintain SetUserInput() too.
+        // FYI: After calling SetValue(), the input type might have been
+        //      modified so that mInputData may not store TextControlState.
         if (!mInputData.mState->SetValue(value, aOldValue, aFlags)) {
           return NS_ERROR_OUT_OF_MEMORY;
         }