Have HTMLElements / SVGElements constructors take a Document reference in argument

Source/core/html/InputType.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2009, 2010, 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
  *
@@ skipping 378 matching lines @@
         return;
 
     root->removeChildren();
 
     // It's ok to clear contents of all other ShadowRoots because they must have
     // been created by InputFieldPasswordGeneratorButtonElement, and we don't allow adding
     // AuthorShadowRoot to HTMLInputElement.
     // FIXME: Remove the PasswordGeneratorButtonElement's shadow root and then remove this loop.
     while ((root = root->youngerShadowRoot())) {
         root->removeChildren();
-        root->appendChild(HTMLShadowElement::create(shadowTag, &element()->document()));
+        root->appendChild(HTMLShadowElement::create(shadowTag, element()->document()));
     }
 }
 
 Decimal InputType::parseToNumber(const String&, const Decimal& defaultValue) const
 {
     ASSERT_NOT_REACHED();
     return defaultValue;
 }
 
 Decimal InputType::parseToNumberOrNaN(const String& string) const
@@ skipping 548 matching lines @@
 
 void InputType::observeFeatureIfVisible(UseCounter::Feature feature) const
 {
     if (RenderStyle* style = element()->renderStyle()) {
         if (style->visibility() != HIDDEN)
             UseCounter::count(&element()->document(), feature);
     }
 }
 
 } // namespace WebCore