Don't mutate the DOM from inside an Element's constructor

Source/core/html/HTMLKeygenElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 28 matching lines @@
 using namespace WebCore;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
 HTMLKeygenElement::HTMLKeygenElement(Document& document, HTMLFormElement* form)
     : HTMLFormControlElementWithState(keygenTag, document, form)
 {
     ScriptWrappable::init(this);
-    ensureUserAgentShadowRoot();
+}
+
+PassRefPtrWillBeRawPtr<HTMLKeygenElement> HTMLKeygenElement::create(Document& document, HTMLFormElement* form)
+{
+    RefPtrWillBeRawPtr<HTMLKeygenElement> keygen = adoptRefWillBeRefCountedGarbageCollected(new HTMLKeygenElement(document, form));
+    keygen->ensureUserAgentShadowRoot();
+    return keygen.release();
 }
 
 void HTMLKeygenElement::didAddUserAgentShadowRoot(ShadowRoot& root)
 {
     DEFINE_STATIC_LOCAL(AtomicString, keygenSelectPseudoId, ("-webkit-keygen-select", AtomicString::ConstructFromLiteral));
 
     Vector<String> keys;
     getSupportedKeySizes(locale(), keys);
 
     // Create a select element with one option element for each key size.
@@ skipping 51 matching lines @@
 {
     return true;
 }
 
 bool HTMLKeygenElement::supportsAutofocus() const
 {
     return true;
 }
 
 } // namespace