Chrome Version: 60 canary
OS: All

What steps will reproduce the problem?
(1) Load a page like:

<input>
<script>
document.querySelector('input').addEventListener('keypress', function (e) {
  if (e.key == 't') {
    if (e.target.type == 'text') {
      e.target.type = 'button';
      e.target.type = 'text';
      console.log(e.target.selectionStart);
    }
  }
});
</script>

(2) Open DevTools console.
(3) Click on the INPUT field, then type 'foot'.

What is the expected result?
The console shows "3", which is the length of 'foo'.

What happens instead?
The console shows "0".

Please use labels and text to provide additional information.

HTMLTInputElement::UpdateType():

  // UA Shadow tree was recreated. We need to set selection again. We do it
  // later in order to avoid force layout.
  if (GetDocument().FocusedElement() == this)
    GetDocument().UpdateFocusAppearanceLater();

So the INPUT element doesn't return correct selection values until UpdateFocusAppearance() is called.