Have ElementTraversal / NodeTraversal's next() methods take a reference

Source/core/html/HTMLObjectElement.h

Index: Source/core/html/HTMLObjectElement.h
diff --git a/Source/core/html/HTMLObjectElement.h b/Source/core/html/HTMLObjectElement.h
index e0a00261fd4de2f8e40682a7cae30d03bf434419..b02d38fab2a57da38c4101fa22cf9a95413f7d85 100644
--- a/Source/core/html/HTMLObjectElement.h
+++ b/Source/core/html/HTMLObjectElement.h
@@ -122,6 +122,16 @@ inline const HTMLObjectElement* toHTMLObjectElement(const FormAssociatedElement*
     return objectElement;
 }
 
+inline const HTMLObjectElement& toHTMLObjectElement(const FormAssociatedElement& element)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!element.isFormControlElement());
+    const HTMLObjectElement& objectElement = static_cast<const HTMLObjectElement&>(element);
+    // We need to assert after the cast because FormAssociatedElement doesn't
+    // have hasTagName.
+    ASSERT_WITH_SECURITY_IMPLICATION(objectElement.hasTagName(HTMLNames::objectTag));
+    return objectElement;
+}
+
 }
 
 #endif