LibWeb: Invalidate layout-transformed text on DOM text node change

This fixes an issue where programmatically changing the value of an
input element wasn't reflected visually.

Userland/Libraries/LibWeb/DOM/CharacterData.cpp

@@ -10,6 +10,7 @@
 #include <LibWeb/DOM/MutationType.h>
 #include <LibWeb/DOM/Range.h>
 #include <LibWeb/DOM/StaticNodeList.h>
+#include <LibWeb/Layout/TextNode.h>
 
 namespace Web::DOM {
 
@@ -108,6 +109,12 @@ WebIDL::ExceptionOr<void> CharacterData::replace_data(size_t offset, size_t coun
     if (parent())
         parent()->children_changed();
 
+    // NOTE: Since the text node's data has changed, we need to invalidate the text for rendering.
+    //       This ensures that the new text is reflected in layout, even if we don't end up
+    //       doing a full layout tree rebuild.
+    if (auto* layout_node = this->layout_node(); layout_node && layout_node->is_text_node())
+        static_cast<Layout::TextNode&>(*layout_node).invalidate_text_for_rendering();
+
     set_needs_style_update(true);
     document().set_needs_layout();
     return {};