Avoid unchecked casts in UA shadow DOM.

third_party/WebKit/Source/core/html/forms/FileInputType.cpp

Index: third_party/WebKit/Source/core/html/forms/FileInputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
index e6f85ffc67cc144c69103e1f5188b9ed3a0a7fed..70eb51205910cc1ba3927cc6cc278df25f619a59 100644
--- a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
@@ -274,7 +274,7 @@ void FileInputType::createShadowSubtree() {
 void FileInputType::disabledAttributeChanged() {
   DCHECK(element().shadow());
   if (Element* button =
-          toElement(element().userAgentShadowRoot()->firstChild()))
+          toElementOrDie(element().userAgentShadowRoot()->firstChild()))
     button->setBooleanAttribute(disabledAttr,
                                 element().isDisabledFormControl());
 }
@@ -282,7 +282,7 @@ void FileInputType::disabledAttributeChanged() {
 void FileInputType::multipleAttributeChanged() {
   DCHECK(element().shadow());
   if (Element* button =
-          toElement(element().userAgentShadowRoot()->firstChild()))
+          toElementOrDie(element().userAgentShadowRoot()->firstChild()))
     button->setAttribute(
         valueAttr,
         AtomicString(locale().queryString(