Avoid unchecked casts in UA shadow DOM.

third_party/WebKit/Source/core/html/TextControlElement.cpp

Index: third_party/WebKit/Source/core/html/TextControlElement.cpp
diff --git a/third_party/WebKit/Source/core/html/TextControlElement.cpp b/third_party/WebKit/Source/core/html/TextControlElement.cpp
index 309427990f1212e56ab1413748eca60b3f9a0132..45ad336016f88854fadcafba42d86fab1b5a543f 100644
--- a/third_party/WebKit/Source/core/html/TextControlElement.cpp
+++ b/third_party/WebKit/Source/core/html/TextControlElement.cpp
@@ -163,7 +163,7 @@ bool TextControlElement::placeholderShouldBeVisible() const {
 }
 
 HTMLElement* TextControlElement::placeholderElement() const {
-  return toHTMLElement(
+  return toHTMLElementOrDie(
       userAgentShadowRoot()->getElementById(ShadowElementNames::placeholder()));
 }
 
@@ -900,7 +900,7 @@ String TextControlElement::directionForFormData() const {
 }
 
 HTMLElement* TextControlElement::innerEditorElement() const {
-  return toHTMLElement(
+  return toHTMLElementOrDie(
       userAgentShadowRoot()->getElementById(ShadowElementNames::innerEditor()));
 }