Code: void ImageInputType::ensurePrimaryContent()
{
     if (!m_useFallbackContent)
         return;
     m_useFallbackContent = false;
     reattachFallbackContent();
 }

Vulnerability Type: DoS 
CWE ID: CWE-361
Summary: The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage *type confusion.*
Commit Message: ImageInputType::ensurePrimaryContent should recreate UA shadow tree.

Once the fallback shadow tree was created, it was never recreated even if
ensurePrimaryContent was called.  Such situation happens by updating |src|
attribute.

BUG=589838

Review URL: https://codereview.chromium.org/1732753004

Cr-Commit-Position: refs/heads/master@{#377804}