Bug 261941 added some invalidation logic, but it seems it's not being hit for a number of cases. This might be related to InputType::createIfDifferent() as that is the only thing that can cause HTMLInputElement::updateType() to return early, but I was not able to figure it out in the time I gave myself for this. The test in LayoutTests/imported/w3c/web-platform-tests/css/selectors/dir-pseudo-on-input-element.html for dynamic changes can easily be made more general by setting input.type to each of the types in the for of loop surrounding the next test.