ASSERT_WITH_SECURITY_IMPLICATION hit when removing an <input type="range"> while...

ASSERT_WITH_SECURITY_IMPLICATION hit when removing an <input type="range"> while dragging on iOS
https://bugs.webkit.org/show_bug.cgi?id=165535
<rdar://problem/29559749>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Utimately we should prevent SliderThumbElement::unregisterForTouchEvents() being called while
updating render tree. A quick fix for this is to move dispatchFormControlChangeEvent for input
from stopDragging up to the callers which really needs to dispatch this event, i.e., finishing
dragging the slider. It is clear that not every caller of stopDragging wants to
dispatchFormControlChangeEvent.

Test: fast/forms/range/range-remove-on-drag.html

* html/shadow/SliderThumbElement.cpp:
(WebCore::SliderThumbElement::stopDragging):
(WebCore::SliderThumbElement::defaultEventHandler):
(WebCore::SliderThumbElement::handleTouchEndAndCancel):

LayoutTests:

This test case is only enabled in iOS simulator WK2.

* TestExpectations:
* fast/forms/range/range-remove-on-drag-expected.txt: Added.
* fast/forms/range/range-remove-on-drag.html: Added.
* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@214291 268f45cc-cd09-0410-ab3c-d52691b4dbfc