Merge 123187 - [Chromium] Fix an assertion failure in TextFieldDecorationElement::hostInput()

Source/WebCore/html/shadow/TextFieldDecorationElement.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 98 matching lines @@
     ASSERT(existingRoot->childNodeCount() == 1);
     toHTMLElement(existingRoot->firstChild())->setInlineStyleProperty(CSSPropertyWebkitBoxFlex, 1.0, CSSPrimitiveValue::CSS_NUMBER);
     box->appendChild(HTMLShadowElement::create(HTMLNames::shadowTag, input->document()));
 
     setInlineStyleProperty(CSSPropertyDisplay, visible ? CSSValueBlock : CSSValueNone);
     box->appendChild(this);
 }
 
 inline HTMLInputElement* TextFieldDecorationElement::hostInput()
 {
-    ASSERT(shadowAncestorNode());
-    ASSERT(shadowAncestorNode()->hasTagName(inputTag));
-    return static_cast<HTMLInputElement*>(shadowAncestorNode());
+    // TextFieldDecorationElement is created only by C++ code, and it is always
+    // in <input> shadow.
+    ASSERT(!shadowHost() || shadowHost()->hasTagName(inputTag));
+    return static_cast<HTMLInputElement*>(shadowHost());
 }
 
 bool TextFieldDecorationElement::isTextFieldDecoration() const
 {
     return true;
 }
 
 void TextFieldDecorationElement::updateImage()
 {
     if (!renderer() || !renderer()->isImage())
@@ skipping 42 matching lines @@
 }
 
 bool TextFieldDecorationElement::isMouseFocusable() const
 {
     return false;
 }
 
 void TextFieldDecorationElement::defaultEventHandler(Event* event)
 {
     RefPtr<HTMLInputElement> input(hostInput());
-    if (input->disabled() || input->readOnly() || !event->isMouseEvent()) {
+    if (!input || input->disabled() || input->readOnly() || !event->isMouseEvent()) {
         if (!event->defaultHandled())
             HTMLDivElement::defaultEventHandler(event);
         return;
     }
 
     RefPtr<TextFieldDecorationElement> protector(this);
     if (event->type() == eventNames().clickEvent) {
         m_textFieldDecorator->handleClick(input.get());
         event->setDefaultHandled();
     }
 
     if (!event->defaultHandled())
         HTMLDivElement::defaultEventHandler(event);
 }
 
 } // namespace WebCore