ImageInputType::ensurePrimaryContent should recreate UA shadow tree.

third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp

Index: third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
index ce818dfd24e17cb7f3871fad940f40706733abed..d08fff37583d05b585cc69ff32455230aa952898 100644
--- a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp
@@ -70,4 +70,17 @@ TEST(HTMLInputElementTest, DefaultToolTip)
     EXPECT_EQ(String(), inputWithForm->defaultToolTip());
 }
 
+// crbug.com/589838
+TEST(HTMLInputElementTest, ImageTypeCrash)
+{
+    RefPtrWillBeRawPtr<Document> document = Document::create();
+    RefPtrWillBeRawPtr<HTMLInputElement> input = HTMLInputElement::create(*document, nullptr, false);
+    input->setAttribute(HTMLNames::typeAttr, "image");
+    input->ensureFallbackContent();
+    // Make sure ensurePrimaryContent() recreates UA shadow tree, and updating
+    // |value| doesn't crash.
+    input->ensurePrimaryContent();
+    input->setAttribute(HTMLNames::valueAttr, "aaa");
+}
+
 } // namespace blink