Don't mutate the DOM from inside an Element's constructor

Source/core/html/HTMLAudioElement.cpp

Index: Source/core/html/HTMLAudioElement.cpp
diff --git a/Source/core/html/HTMLAudioElement.cpp b/Source/core/html/HTMLAudioElement.cpp
index ba03326322e4ad62404e8cc8dbf27d11a5b23d1c..a241c4927cfccd65c3cd73ba77954d16ef60d385 100644
--- a/Source/core/html/HTMLAudioElement.cpp
+++ b/Source/core/html/HTMLAudioElement.cpp
@@ -27,6 +27,7 @@
 #include "core/html/HTMLAudioElement.h"
 
 #include "HTMLNames.h"
+#include "core/dom/shadow/ShadowRoot.h"
 
 namespace WebCore {
 
@@ -40,14 +41,16 @@ HTMLAudioElement::HTMLAudioElement(Document& document)
 
 PassRefPtrWillBeRawPtr<HTMLAudioElement> HTMLAudioElement::create(Document& document)
 {
-    RefPtrWillBeRawPtr<HTMLAudioElement> audioElement(adoptRefWillBeRefCountedGarbageCollected(new HTMLAudioElement(document)));
-    audioElement->suspendIfNeeded();
-    return audioElement.release();
+    RefPtrWillBeRawPtr<HTMLAudioElement> audio = adoptRefWillBeRefCountedGarbageCollected(new HTMLAudioElement(document));
+    audio->ensureUserAgentShadowRoot();
+    audio->suspendIfNeeded();
+    return audio.release();
 }
 
 PassRefPtrWillBeRawPtr<HTMLAudioElement> HTMLAudioElement::createForJSConstructor(Document& document, const AtomicString& src)
 {
     RefPtrWillBeRawPtr<HTMLAudioElement> audio = adoptRefWillBeRefCountedGarbageCollected(new HTMLAudioElement(document));
+    audio->ensureUserAgentShadowRoot();
     audio->setPreload(AtomicString("auto", AtomicString::ConstructFromLiteral));
     if (!src.isNull())
         audio->setSrc(src);