ImageInputType::ensurePrimaryContent should recreate UA shadow tree.

third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/html/HTMLInputElement.h"
 
 #include "core/dom/Document.h"
 #include "core/html/HTMLBodyElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLHtmlElement.h"
@@ skipping 52 matching lines @@
     document->body()->appendChild(form.get());
     RefPtrWillBeRawPtr<HTMLInputElement> inputWithForm = HTMLInputElement::create(*document, nullptr, false);
     inputWithForm->setBooleanAttribute(HTMLNames::requiredAttr, true);
     form->appendChild(inputWithForm.get());
     EXPECT_EQ("<<ValidationValueMissing>>", inputWithForm->defaultToolTip());
 
     form->setBooleanAttribute(HTMLNames::novalidateAttr, true);
     EXPECT_EQ(String(), inputWithForm->defaultToolTip());
 }
 
+// crbug.com/589838
+TEST(HTMLInputElementTest, ImageTypeCrash)
+{
+    RefPtrWillBeRawPtr<Document> document = Document::create();
+    RefPtrWillBeRawPtr<HTMLInputElement> input = HTMLInputElement::create(*document, nullptr, false);
+    input->setAttribute(HTMLNames::typeAttr, "image");
+    input->ensureFallbackContent();
+    // Make sure ensurePrimaryContent() recreates UA shadow tree, and updating
+    // |value| doesn't crash.
+    input->ensurePrimaryContent();
+    input->setAttribute(HTMLNames::valueAttr, "aaa");
+}
+
 } // namespace blink