Bug 981248 - Rewrite <input type=number> to avoid an anonymous input. r=masayuki,surkov,jwatt,ntim,jfkthame,smaug

Instead, subclass nsTextControlFrame. This simplifies the code and avoids
correctness issues.

I kept the localization functionality though it is not spec compliant. But I
filed a bug to remove it in a followup.

Differential Revision: https://phabricator.services.mozilla.com/D57193

dom/html/HTMLInputElement.h

@@ -206,11 +206,6 @@ class HTMLInputElement final : public TextControlElement,
 
   virtual EventStates IntrinsicState() const override;
 
-  // Element
- private:
-  virtual void AddStates(EventStates aStates) override;
-  virtual void RemoveStates(EventStates aStates) override;
-
  public:
   // TextControlElement
   virtual nsresult SetValueChanged(bool aValueChanged) override;
@@ -808,8 +803,6 @@ class HTMLInputElement final : public TextControlElement,
   double GetMinimumAsDouble() { return GetMinimum().toDouble(); }
   double GetMaximumAsDouble() { return GetMaximum().toDouble(); }
 
-  HTMLInputElement* GetOwnerNumberControl();
-
   void StartNumberControlSpinnerSpin();
   enum SpinnerStopState { eAllowDispatchingEvents, eDisallowDispatchingEvents };
   void StopNumberControlSpinnerSpin(
@@ -1394,6 +1387,13 @@ class HTMLInputElement final : public TextControlElement,
    */
   static bool IsDateTimeInputType(uint8_t aType);
 
+  /**
+   * Returns whether getting `.value` as a string should sanitize the value.
+   *
+   * See SanitizeValue.
+   */
+  bool SanitizesOnValueGetter() const;
+
   /**
    * Returns true if the element should prevent dispatching another DOMActivate.
    * This is used in situations where the anonymous subtree should already have