ImageInputType::ensurePrimaryContent should recreate UA shadow tree.

third_party/WebKit/Source/core/html/forms/ImageInputType.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 253 matching lines @@
     if (ShadowRoot* root = element().userAgentShadowRoot())
         root->removeChildren();
     createShadowSubtree();
 }
 
 void ImageInputType::ensurePrimaryContent()
 {
     if (!m_useFallbackContent)
         return;
     m_useFallbackContent = false;
+    if (ShadowRoot* root = element().userAgentShadowRoot())
+        root->removeChildren();
+    createShadowSubtree();
     reattachFallbackContent();
 }
 
 void ImageInputType::reattachFallbackContent()
 {
     // This can happen inside of attach() in the middle of a recalcStyle so we need to
     // reattach synchronously here.
     if (element().document().inStyleRecalc())
         element().reattach();
     else
@@ skipping 11 matching lines @@
 
 PassRefPtr<ComputedStyle> ImageInputType::customStyleForLayoutObject(PassRefPtr<ComputedStyle> newStyle)
 {
     if (!m_useFallbackContent)
         return newStyle;
 
     return HTMLImageFallbackHelper::customStyleForAltText(element(), newStyle);
 }
 
 } // namespace blink