Attachment 346667 Details for Bug 186321 – Patch

[patch] Patch

bug-186321-20180806172058.patch (text/plain), 114.15 KB, created by Brent Fulgham on 2018-08-06 17:20:59 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Brent Fulgham

Created: 2018-08-06 17:20:59 PDT

Size: 114.15 KB

patch

obsolete

>Subversion Revision: 234621
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index dd29f46a74d9e81bf2fd0d9326c53b9319689196..928ad335025dd8b5aa8b5278a2a4021dbcd20d55 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,232 @@
>+2018-08-06  Brent Fulgham  <bfulgham@apple.com>
>+
>+        Clean ups after r232496 and r232511
>+        https://bugs.webkit.org/show_bug.cgi?id=186321
>+        <rdar://problem/40822676>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Clean up the security changes made in r232495 and r232511 as Darin suggested.
>+        This change includes the following changes:
>+        1. Removes a set of ASSERTS in various InputType methods in favor of a single ASSERT in the accessor.
>+        2. Changes the accessor 'element()' to return a reference (rather than a pointer).
>+        3. Add a new method that returns a pointer for the handful of cases where we actually expect
>+           a possible nullptr return.
>+
>+        No new tests for this refactoring change, as there should not be any change in behavior.
>+
>+        * html/BaseButtonInputType.cpp:
>+        (WebCore::BaseButtonInputType::createInputRenderer):
>+        (WebCore::BaseButtonInputType::setValue):
>+        * html/BaseCheckableInputType.cpp:
>+        (WebCore::BaseCheckableInputType::saveFormControlState const):
>+        (WebCore::BaseCheckableInputType::restoreFormControlState):
>+        (WebCore::BaseCheckableInputType::appendFormData const):
>+        (WebCore::BaseCheckableInputType::handleKeydownEvent):
>+        (WebCore::BaseCheckableInputType::accessKeyAction):
>+        (WebCore::BaseCheckableInputType::setValue):
>+        * html/BaseChooserOnlyDateAndTimeInputType.cpp:
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleDOMActivateEvent):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::createShadowSubtree):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::updateInnerTextValue):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::didChooseValue):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleKeydownEvent):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::handleKeypressEvent):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::accessKeyAction):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::isMouseFocusable const):
>+        (WebCore::BaseChooserOnlyDateAndTimeInputType::attributeChanged):
>+        * html/BaseClickableWithKeyInputType.cpp:
>+        (WebCore::BaseClickableWithKeyInputType::handleKeydownEvent):
>+        (WebCore::BaseClickableWithKeyInputType::handleKeypressEvent):
>+        (WebCore::BaseClickableWithKeyInputType::accessKeyAction):
>+        * html/BaseDateAndTimeInputType.cpp:
>+        (WebCore::BaseDateAndTimeInputType::setValueAsDate const):
>+        (WebCore::BaseDateAndTimeInputType::valueAsDouble const):
>+        (WebCore::BaseDateAndTimeInputType::setValueAsDecimal const):
>+        (WebCore::BaseDateAndTimeInputType::typeMismatch const):
>+        (WebCore::BaseDateAndTimeInputType::attributeChanged):
>+        (WebCore::BaseDateAndTimeInputType::serializeWithComponents const):
>+        (WebCore::BaseDateAndTimeInputType::localizeValue const):
>+        (WebCore::BaseDateAndTimeInputType::visibleValue const):
>+        (WebCore::BaseDateAndTimeInputType::valueMissing const):
>+        (WebCore::BaseDateAndTimeInputType::isKeyboardFocusable const):
>+        * html/BaseTextInputType.cpp:
>+        (WebCore::BaseTextInputType::patternMismatch const):
>+        * html/CheckboxInputType.cpp:
>+        (WebCore::CheckboxInputType::valueMissing const):
>+        (WebCore::CheckboxInputType::willDispatchClick):
>+        (WebCore::CheckboxInputType::didDispatchClick):
>+        (WebCore::CheckboxInputType::shouldAppearIndeterminate const):
>+        * html/ColorInputType.cpp:
>+        (WebCore::ColorInputType::isMouseFocusable const):
>+        (WebCore::ColorInputType::isKeyboardFocusable const):
>+        (WebCore::ColorInputType::valueAsColor const):
>+        (WebCore::ColorInputType::createShadowSubtree):
>+        (WebCore::ColorInputType::handleDOMActivateEvent):
>+        (WebCore::ColorInputType::didChooseColor):
>+        (WebCore::ColorInputType::updateColorSwatch):
>+        (WebCore::ColorInputType::shadowColorSwatch const):
>+        (WebCore::ColorInputType::elementRectRelativeToRootView const):
>+        (WebCore::ColorInputType::shouldShowSuggestions const):
>+        (WebCore::ColorInputType::suggestions const):
>+        * html/DateInputType.cpp:
>+        (WebCore::DateInputType::createStepRange const):
>+        * html/DateTimeLocalInputType.cpp:
>+        (WebCore::DateTimeLocalInputType::createStepRange const):
>+        * html/EmailInputType.cpp:
>+        (WebCore::EmailInputType::typeMismatchFor const):
>+        (WebCore::EmailInputType::typeMismatch const):
>+        (WebCore::EmailInputType::typeMismatchText const):
>+        (WebCore::EmailInputType::sanitizeValue const):
>+        * html/FileInputType.cpp:
>+        (WebCore::FileInputType::appendFormData const):
>+        (WebCore::FileInputType::valueMissing const):
>+        (WebCore::FileInputType::valueMissingText const):
>+        (WebCore::FileInputType::handleDOMActivateEvent):
>+        (WebCore::FileInputType::createInputRenderer):
>+        (WebCore::FileInputType::setValue):
>+        (WebCore::FileInputType::createShadowSubtree):
>+        (WebCore::FileInputType::disabledStateChanged):
>+        (WebCore::FileInputType::attributeChanged):
>+        (WebCore::FileInputType::allowsDirectories const):
>+        (WebCore::FileInputType::setFiles):
>+        (WebCore::FileInputType::iconLoaded):
>+        (WebCore::FileInputType::receiveDroppedFiles):
>+        (WebCore::FileInputType::defaultToolTip const):
>+        * html/HiddenInputType.cpp:
>+        (WebCore::HiddenInputType::saveFormControlState const):
>+        (WebCore::HiddenInputType::restoreFormControlState):
>+        (WebCore::HiddenInputType::setValue):
>+        (WebCore::HiddenInputType::appendFormData const):
>+        * html/ImageInputType.cpp:
>+        (WebCore::ImageInputType::appendFormData const):
>+        (WebCore::ImageInputType::handleDOMActivateEvent):
>+        (WebCore::ImageInputType::createInputRenderer):
>+        (WebCore::ImageInputType::attributeChanged):
>+        (WebCore::ImageInputType::attach):
>+        (WebCore::ImageInputType::height const):
>+        (WebCore::ImageInputType::width const):
>+        * html/InputType.cpp:
>+        (WebCore::InputType::saveFormControlState const):
>+        (WebCore::InputType::restoreFormControlState):
>+        (WebCore::InputType::isFormDataAppendable const):
>+        (WebCore::InputType::appendFormData const):
>+        (WebCore::InputType::sizeShouldIncludeDecoration const):
>+        (WebCore::InputType::validationMessage const):
>+        (WebCore::InputType::createInputRenderer):
>+        (WebCore::InputType::blur):
>+        (WebCore::InputType::destroyShadowSubtree):
>+        (WebCore::InputType::dispatchSimulatedClickIfActive const):
>+        (WebCore::InputType::chrome const):
>+        (WebCore::InputType::isKeyboardFocusable const):
>+        (WebCore::InputType::isMouseFocusable const):
>+        (WebCore::InputType::accessKeyAction):
>+        (WebCore::InputType::setValue):
>+        (WebCore::InputType::visibleValue const):
>+        (WebCore::InputType::applyStep):
>+        (WebCore::InputType::stepUpFromRenderer):
>+        * html/InputType.h:
>+        (WebCore::InputType::elementPtr const):
>+        (WebCore::InputType::element const):
>+        * html/MonthInputType.cpp:
>+        (WebCore::MonthInputType::valueAsDate const):
>+        (WebCore::MonthInputType::createStepRange const):
>+        * html/NumberInputType.cpp:
>+        (WebCore::NumberInputType::setValue):
>+        (WebCore::NumberInputType::valueAsDouble const):
>+        (WebCore::NumberInputType::setValueAsDouble const):
>+        (WebCore::NumberInputType::setValueAsDecimal const):
>+        (WebCore::NumberInputType::typeMismatch const):
>+        (WebCore::NumberInputType::createStepRange const):
>+        (WebCore::NumberInputType::sizeShouldIncludeDecoration const):
>+        (WebCore::NumberInputType::decorationWidth const):
>+        (WebCore::NumberInputType::localizeValue const):
>+        (WebCore::NumberInputType::visibleValue const):
>+        (WebCore::NumberInputType::convertFromVisibleValue const):
>+        (WebCore::NumberInputType::hasBadInput const):
>+        (WebCore::NumberInputType::attributeChanged):
>+        * html/RadioInputType.cpp:
>+        (WebCore::RadioInputType::valueMissing const):
>+        (WebCore::RadioInputType::handleKeydownEvent):
>+        (WebCore::RadioInputType::handleKeyupEvent):
>+        (WebCore::RadioInputType::isKeyboardFocusable const):
>+        (WebCore::RadioInputType::shouldSendChangeEventAfterCheckedChanged):
>+        (WebCore::RadioInputType::willDispatchClick):
>+        (WebCore::RadioInputType::didDispatchClick):
>+        (WebCore::RadioInputType::matchesIndeterminatePseudoClass const):
>+        * html/RangeInputType.cpp:
>+        (WebCore::RangeInputType::valueAsDouble const):
>+        (WebCore::RangeInputType::setValueAsDecimal const):
>+        (WebCore::RangeInputType::createStepRange const):
>+        (WebCore::RangeInputType::handleMouseDownEvent):
>+        (WebCore::RangeInputType::handleTouchEvent):
>+        (WebCore::RangeInputType::handleKeydownEvent):
>+        (WebCore::RangeInputType::createShadowSubtree):
>+        (WebCore::RangeInputType::sliderTrackElement const):
>+        (WebCore::RangeInputType::createInputRenderer):
>+        (WebCore::RangeInputType::accessKeyAction):
>+        (WebCore::RangeInputType::attributeChanged):
>+        (WebCore::RangeInputType::setValue):
>+        (WebCore::RangeInputType::updateTickMarkValues):
>+        * html/ResetInputType.cpp:
>+        (WebCore::ResetInputType::handleDOMActivateEvent):
>+        * html/SearchInputType.cpp:
>+        (WebCore::SearchInputType::addSearchResult):
>+        (WebCore::SearchInputType::attributeChanged):
>+        (WebCore::SearchInputType::createInputRenderer):
>+        (WebCore::SearchInputType::createShadowSubtree):
>+        (WebCore::SearchInputType::handleKeydownEvent):
>+        (WebCore::SearchInputType::startSearchEventTimer):
>+        (WebCore::SearchInputType::searchEventTimerFired):
>+        (WebCore::SearchInputType::searchEventsShouldBeDispatched const):
>+        (WebCore::SearchInputType::didSetValueByUserEdit):
>+        (WebCore::SearchInputType::sizeShouldIncludeDecoration const):
>+        * html/SubmitInputType.cpp:
>+        (WebCore::SubmitInputType::appendFormData const):
>+        (WebCore::SubmitInputType::handleDOMActivateEvent):
>+        * html/TextFieldInputType.cpp:
>+        (WebCore::TextFieldInputType::isKeyboardFocusable const):
>+        (WebCore::TextFieldInputType::isMouseFocusable const):
>+        (WebCore::TextFieldInputType::valueMissing const):
>+        (WebCore::TextFieldInputType::setValue):
>+        (WebCore::TextFieldInputType::handleClickEvent):
>+        (WebCore::TextFieldInputType::handleKeydownEvent):
>+        (WebCore::TextFieldInputType::handleKeydownEventForSpinButton):
>+        (WebCore::TextFieldInputType::forwardEvent):
>+        (WebCore::TextFieldInputType::elementDidBlur):
>+        (WebCore::TextFieldInputType::handleFocusEvent):
>+        (WebCore::TextFieldInputType::handleBlurEvent):
>+        (WebCore::TextFieldInputType::createInputRenderer):
>+        (WebCore::TextFieldInputType::shouldHaveSpinButton const):
>+        (WebCore::TextFieldInputType::shouldHaveCapsLockIndicator const):
>+        (WebCore::TextFieldInputType::createShadowSubtree):
>+        (WebCore::TextFieldInputType::attributeChanged):
>+        (WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
>+        (WebCore::TextFieldInputType::updatePlaceholderText):
>+        (WebCore::TextFieldInputType::appendFormData const):
>+        (WebCore::TextFieldInputType::subtreeHasChanged):
>+        (WebCore::TextFieldInputType::didSetValueByUserEdit):
>+        (WebCore::TextFieldInputType::updateInnerTextValue):
>+        (WebCore::TextFieldInputType::focusAndSelectSpinButtonOwner):
>+        (WebCore::TextFieldInputType::shouldSpinButtonRespondToMouseEvents):
>+        (WebCore::TextFieldInputType::shouldSpinButtonRespondToWheelEvents):
>+        (WebCore::TextFieldInputType::shouldDrawCapsLockIndicator const):
>+        (WebCore::TextFieldInputType::shouldDrawAutoFillButton const):
>+        (WebCore::TextFieldInputType::autoFillButtonElementWasClicked):
>+        (WebCore::TextFieldInputType::createContainer):
>+        (WebCore::TextFieldInputType::createAutoFillButton):
>+        (WebCore::TextFieldInputType::updateAutoFillButton):
>+        (WebCore::TextFieldInputType::elementRectInRootViewCoordinates const):
>+        (WebCore::TextFieldInputType::suggestions const):
>+        (WebCore::TextFieldInputType::didSelectDataListOption):
>+        (WebCore::TextFieldInputType::displaySuggestions):
>+        * html/TimeInputType.cpp:
>+        (WebCore::TimeInputType::createStepRange const):
>+        * html/URLInputType.cpp:
>+        (WebCore::URLInputType::typeMismatch const):
>+        * html/WeekInputType.cpp:
>+        (WebCore::WeekInputType::createStepRange const):
>+
> 2018-08-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
> 
>         Remove the SVG elements' attributes macros
>diff --git a/Source/WebCore/html/BaseButtonInputType.cpp b/Source/WebCore/html/BaseButtonInputType.cpp
>index 2ddbaeb9a69a80c1b49c4926967e3ed304469f39..428e41a0fbcb1cfb0b99cb37a88b9dc0a4042963 100644
>--- a/Source/WebCore/html/BaseButtonInputType.cpp
>+++ b/Source/WebCore/html/BaseButtonInputType.cpp
>@@ -53,8 +53,7 @@ bool BaseButtonInputType::appendFormData(DOMFormData&, bool) const
> 
> RenderPtr<RenderElement> BaseButtonInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderButton>(*element(), WTFMove(style));
>+    return createRenderer<RenderButton>(element(), WTFMove(style));
> }
> 
> bool BaseButtonInputType::storesValueSeparateFromAttribute()
>@@ -64,8 +63,7 @@ bool BaseButtonInputType::storesValueSeparateFromAttribute()
> 
> void BaseButtonInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
> {
>-    ASSERT(element());
>-    element()->setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
>+    element().setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
>index bb1da0866bb69afad9d9a24a802a1ea757890c20..4051a594d6fb45b39779ed0e447dffc508cedda5 100644
>--- a/Source/WebCore/html/BaseCheckableInputType.cpp
>+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
>@@ -45,22 +45,19 @@ using namespace HTMLNames;
> 
> FormControlState BaseCheckableInputType::saveFormControlState() const
> {
>-    ASSERT(element());
>-    return { element()->checked() ? "on"_s : "off"_s };
>+    return { element().checked() ? "on"_s : "off"_s };
> }
> 
> void BaseCheckableInputType::restoreFormControlState(const FormControlState& state)
> {
>-    ASSERT(element());
>-    element()->setChecked(state[0] == "on");
>+    element().setChecked(state[0] == "on");
> }
> 
> bool BaseCheckableInputType::appendFormData(DOMFormData& formData, bool) const
> {
>-    ASSERT(element());
>-    if (!element()->checked())
>+    if (!element().checked())
>         return false;
>-    formData.append(element()->name(), element()->value());
>+    formData.append(element().name(), element().value());
>     return true;
> }
> 
>@@ -68,8 +65,7 @@ void BaseCheckableInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>     const String& key = event.keyIdentifier();
>     if (key == "U+0020") {
>-        ASSERT(element());
>-        element()->setActive(true, true);
>+        element().setActive(true, true);
>         // No setDefaultHandled(), because IE dispatches a keypress in this case
>         // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
>     }
>@@ -93,8 +89,7 @@ void BaseCheckableInputType::accessKeyAction(bool sendMouseEvents)
> {
>     InputType::accessKeyAction(sendMouseEvents);
> 
>-    ASSERT(element());
>-    element()->dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
>+    element().dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
> }
> 
> String BaseCheckableInputType::fallbackValue() const
>@@ -110,8 +105,7 @@ bool BaseCheckableInputType::storesValueSeparateFromAttribute()
> 
> void BaseCheckableInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
> {
>-    ASSERT(element());
>-    element()->setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
>+    element().setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
> }
> 
> bool BaseCheckableInputType::isCheckable()
>diff --git a/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp
>index 21fede101fb9a1c13ece1d748092f97c524828ae..47f75397952a2c46399790d5adeb9a765655edf6 100644
>--- a/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp
>+++ b/Source/WebCore/html/BaseChooserOnlyDateAndTimeInputType.cpp
>@@ -46,16 +46,15 @@ BaseChooserOnlyDateAndTimeInputType::~BaseChooserOnlyDateAndTimeInputType()
> 
> void BaseChooserOnlyDateAndTimeInputType::handleDOMActivateEvent(Event&)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledOrReadOnly() || !element()->renderer() || !UserGestureIndicator::processingUserGesture())
>+    if (element().isDisabledOrReadOnly() || !element().renderer() || !UserGestureIndicator::processingUserGesture())
>         return;
> 
>     if (m_dateTimeChooser)
>         return;
>-    if (!element()->document().page())
>+    if (!element().document().page())
>         return;
>     DateTimeChooserParameters parameters;
>-    if (!element()->setupDateTimeChooserParameters(parameters))
>+    if (!element().setupDateTimeChooserParameters(parameters))
>         return;
> }
> 
>@@ -63,17 +62,15 @@ void BaseChooserOnlyDateAndTimeInputType::createShadowSubtree()
> {
>     static NeverDestroyed<AtomicString> valueContainerPseudo("-webkit-date-and-time-value", AtomicString::ConstructFromLiteral);
> 
>-    ASSERT(element());
>-    auto valueContainer = HTMLDivElement::create(element()->document());
>+    auto valueContainer = HTMLDivElement::create(element().document());
>     valueContainer->setPseudo(valueContainerPseudo);
>-    element()->userAgentShadowRoot()->appendChild(valueContainer);
>+    element().userAgentShadowRoot()->appendChild(valueContainer);
>     updateInnerTextValue();
> }
> 
> void BaseChooserOnlyDateAndTimeInputType::updateInnerTextValue()
> {
>-    ASSERT(element());
>-    RefPtr<Node> node = element()->userAgentShadowRoot()->firstChild();
>+    RefPtr<Node> node = element().userAgentShadowRoot()->firstChild();
>     if (!is<HTMLElement>(node))
>         return;
>     String displayValue = visibleValue();
>@@ -98,8 +95,7 @@ void BaseChooserOnlyDateAndTimeInputType::detach()
> 
> void BaseChooserOnlyDateAndTimeInputType::didChooseValue(const String& value)
> {
>-    ASSERT(element());
>-    element()->setValue(value, DispatchInputAndChangeEvent);
>+    element().setValue(value, DispatchInputAndChangeEvent);
> }
> 
> void BaseChooserOnlyDateAndTimeInputType::didEndChooser()
>@@ -115,14 +111,12 @@ void BaseChooserOnlyDateAndTimeInputType::closeDateTimeChooser()
> 
> void BaseChooserOnlyDateAndTimeInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    BaseClickableWithKeyInputType::handleKeydownEvent(*element(), event);
>+    BaseClickableWithKeyInputType::handleKeydownEvent(element(), event);
> }
> 
> void BaseChooserOnlyDateAndTimeInputType::handleKeypressEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    BaseClickableWithKeyInputType::handleKeypressEvent(*element(), event);
>+    BaseClickableWithKeyInputType::handleKeypressEvent(element(), event);
> }
> 
> void BaseChooserOnlyDateAndTimeInputType::handleKeyupEvent(KeyboardEvent& event)
>@@ -133,20 +127,18 @@ void BaseChooserOnlyDateAndTimeInputType::handleKeyupEvent(KeyboardEvent& event)
> void BaseChooserOnlyDateAndTimeInputType::accessKeyAction(bool sendMouseEvents)
> {
>     BaseDateAndTimeInputType::accessKeyAction(sendMouseEvents);
>-    ASSERT(element());
>-    BaseClickableWithKeyInputType::accessKeyAction(*element(), sendMouseEvents);
>+    BaseClickableWithKeyInputType::accessKeyAction(element(), sendMouseEvents);
> }
> 
> bool BaseChooserOnlyDateAndTimeInputType::isMouseFocusable() const
> {
>-    ASSERT(element());
>-    return element()->isTextFormControlFocusable();
>+    return element().isTextFormControlFocusable();
> }
> 
> void BaseChooserOnlyDateAndTimeInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == valueAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             if (!element->hasDirtyValue())
>                 updateInnerTextValue();
>         }
>diff --git a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
>index 2c4dd55e9b038056728739afaa1124d10e51ed71..a253f886a22d9a75efe35e131703a8c4c58c576a 100644
>--- a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
>+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
>@@ -80,14 +80,12 @@ void BaseClickableWithKeyInputType::accessKeyAction(HTMLInputElement& element, b
> 
> void BaseClickableWithKeyInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    handleKeydownEvent(*element(), event);
>+    handleKeydownEvent(element(), event);
> }
> 
> void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    handleKeypressEvent(*element(), event);
>+    handleKeypressEvent(element(), event);
> }
> 
> void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent& event)
>@@ -98,8 +96,7 @@ void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent& event)
> void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
> {
>     InputType::accessKeyAction(sendMouseEvents);
>-    ASSERT(element());
>-    accessKeyAction(*element(), sendMouseEvents);
>+    accessKeyAction(element(), sendMouseEvents);
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/html/BaseDateAndTimeInputType.cpp b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
>index 9036e764676490118b89a84d9e862559b89a08cc..0e9f9dc5b66e3f4ca5bb77ebc0c0f6ca622f1df6 100644
>--- a/Source/WebCore/html/BaseDateAndTimeInputType.cpp
>+++ b/Source/WebCore/html/BaseDateAndTimeInputType.cpp
>@@ -57,22 +57,19 @@ double BaseDateAndTimeInputType::valueAsDate() const
> 
> ExceptionOr<void> BaseDateAndTimeInputType::setValueAsDate(double value) const
> {
>-    ASSERT(element());
>-    element()->setValue(serializeWithMilliseconds(value));
>+    element().setValue(serializeWithMilliseconds(value));
>     return { };
> }
> 
> double BaseDateAndTimeInputType::valueAsDouble() const
> {
>-    ASSERT(element());
>-    const Decimal value = parseToNumber(element()->value(), Decimal::nan());
>+    const Decimal value = parseToNumber(element().value(), Decimal::nan());
>     return value.isFinite() ? value.toDouble() : DateComponents::invalidMilliseconds();
> }
> 
> ExceptionOr<void> BaseDateAndTimeInputType::setValueAsDecimal(const Decimal& newValue, TextFieldEventBehavior eventBehavior) const
> {
>-    ASSERT(element());
>-    element()->setValue(serialize(newValue), eventBehavior);
>+    element().setValue(serialize(newValue), eventBehavior);
>     return { };
> }
> 
>@@ -83,8 +80,7 @@ bool BaseDateAndTimeInputType::typeMismatchFor(const String& value) const
> 
> bool BaseDateAndTimeInputType::typeMismatch() const
> {
>-    ASSERT(element());
>-    return typeMismatchFor(element()->value());
>+    return typeMismatchFor(element().value());
> }
> 
> Decimal BaseDateAndTimeInputType::defaultValueForStepUp() const
>@@ -102,7 +98,7 @@ bool BaseDateAndTimeInputType::isSteppable() const
> void BaseDateAndTimeInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == maxAttr || name == minAttr) {
>-        if (auto* element = this->element())
>+        if (auto* element = this->elementPtr())
>             element->invalidateStyleForSubtree();
>     }
>     InputType::attributeChanged(name);
>@@ -140,9 +136,8 @@ String BaseDateAndTimeInputType::serialize(const Decimal& value) const
> 
> String BaseDateAndTimeInputType::serializeWithComponents(const DateComponents& date) const
> {
>-    ASSERT(element());
>     Decimal step;
>-    if (!element()->getAllowedValueStep(&step))
>+    if (!element().getAllowedValueStep(&step))
>         return date.toString();
>     if (step.remainder(msecPerMinute).isZero())
>         return date.toString(DateComponents::None);
>@@ -162,15 +157,13 @@ String BaseDateAndTimeInputType::localizeValue(const String& proposedValue) cons
>     if (!parseToDateComponents(proposedValue, &date))
>         return proposedValue;
> 
>-    ASSERT(element());
>-    String localized = element()->locale().formatDateTime(date);
>+    String localized = element().locale().formatDateTime(date);
>     return localized.isEmpty() ? proposedValue : localized;
> }
> 
> String BaseDateAndTimeInputType::visibleValue() const
> {
>-    ASSERT(element());
>-    return localizeValue(element()->value());
>+    return localizeValue(element().value());
> }
> 
> String BaseDateAndTimeInputType::sanitizeValue(const String& proposedValue) const
>@@ -190,15 +183,13 @@ bool BaseDateAndTimeInputType::shouldRespectListAttribute()
> 
> bool BaseDateAndTimeInputType::valueMissing(const String& value) const
> {
>-    ASSERT(element());
>-    return element()->isRequired() && value.isEmpty();
>+    return element().isRequired() && value.isEmpty();
> }
> 
> #if PLATFORM(IOS)
> bool BaseDateAndTimeInputType::isKeyboardFocusable(KeyboardEvent*) const
> {
>-    ASSERT(element());
>-    return !element()->isReadOnly() && element()->isTextFormControlFocusable();
>+    return !element().isReadOnly() && element().isTextFormControlFocusable();
> }
> #endif
> 
>diff --git a/Source/WebCore/html/BaseTextInputType.cpp b/Source/WebCore/html/BaseTextInputType.cpp
>index b3685b91a9973b8311b1ca9cc80035f5fcfe51e8..815b717759178a5830891474faa2663962751dd3 100644
>--- a/Source/WebCore/html/BaseTextInputType.cpp
>+++ b/Source/WebCore/html/BaseTextInputType.cpp
>@@ -40,10 +40,9 @@ bool BaseTextInputType::isTextType() const
> 
> bool BaseTextInputType::patternMismatch(const String& value) const
> {
>-    ASSERT(element());
>     // FIXME: We should execute RegExp parser first to check validity instead of creating an actual RegularExpression.
>     // https://bugs.webkit.org/show_bug.cgi?id=183361
>-    const AtomicString& rawPattern = element()->attributeWithoutSynchronization(patternAttr);
>+    const AtomicString& rawPattern = element().attributeWithoutSynchronization(patternAttr);
>     if (rawPattern.isNull() || value.isEmpty() || !JSC::Yarr::RegularExpression(rawPattern, JSC::Yarr::TextCaseSensitive, JSC::Yarr::MultilineDisabled, JSC::Yarr::UnicodeAwareMode).isValid())
>         return false;
>     String pattern = "^(?:" + rawPattern + ")$";
>diff --git a/Source/WebCore/html/CheckboxInputType.cpp b/Source/WebCore/html/CheckboxInputType.cpp
>index 8937e5334dbdbd4cefb957b17ca040a4d4d9b320..4914dfbc0b2e66b81a85f4f0f20daf404c7f7d5f 100644
>--- a/Source/WebCore/html/CheckboxInputType.cpp
>+++ b/Source/WebCore/html/CheckboxInputType.cpp
>@@ -46,8 +46,7 @@ const AtomicString& CheckboxInputType::formControlType() const
> 
> bool CheckboxInputType::valueMissing(const String&) const
> {
>-    ASSERT(element());
>-    return element()->isRequired() && !element()->checked();
>+    return element().isRequired() && !element().checked();
> }
> 
> String CheckboxInputType::valueMissingText() const
>@@ -65,26 +64,23 @@ void CheckboxInputType::handleKeyupEvent(KeyboardEvent& event)
> 
> void CheckboxInputType::willDispatchClick(InputElementClickState& state)
> {
>-    ASSERT(element());
>-
>     // An event handler can use preventDefault or "return false" to reverse the checking we do here.
>     // The InputElementClickState object contains what we need to undo what we did here in didDispatchClick.
> 
>-    state.checked = element()->checked();
>-    state.indeterminate = element()->indeterminate();
>+    state.checked = element().checked();
>+    state.indeterminate = element().indeterminate();
> 
>     if (state.indeterminate)
>-        element()->setIndeterminate(false);
>+        element().setIndeterminate(false);
> 
>-    element()->setChecked(!state.checked, DispatchChangeEvent);
>+    element().setChecked(!state.checked, DispatchChangeEvent);
> }
> 
> void CheckboxInputType::didDispatchClick(Event& event, const InputElementClickState& state)
> {
>     if (event.defaultPrevented() || event.defaultHandled()) {
>-        ASSERT(element());
>-        element()->setIndeterminate(state.indeterminate);
>-        element()->setChecked(state.checked);
>+        element().setIndeterminate(state.indeterminate);
>+        element().setChecked(state.checked);
>     }
> 
>     // The work we did in willDispatchClick was default handling.
>@@ -103,8 +99,7 @@ bool CheckboxInputType::matchesIndeterminatePseudoClass() const
> 
> bool CheckboxInputType::shouldAppearIndeterminate() const
> {
>-    ASSERT(element());
>-    return element()->indeterminate();
>+    return element().indeterminate();
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
>index 2a135f977d2d520f0c0b727786e5acbed76a9c59..5afcb9cae4106b32ce25ec84cc0bec02384dd0b5 100644
>--- a/Source/WebCore/html/ColorInputType.cpp
>+++ b/Source/WebCore/html/ColorInputType.cpp
>@@ -83,18 +83,16 @@ ColorInputType::~ColorInputType()
> 
> bool ColorInputType::isMouseFocusable() const
> {
>-    ASSERT(element());
>-    return element()->isTextFormControlFocusable();
>+    return element().isTextFormControlFocusable();
> }
> 
> bool ColorInputType::isKeyboardFocusable(KeyboardEvent*) const
> {
>-    ASSERT(element());
> #if PLATFORM(IOS)
>-    if (element()->isReadOnly())
>+    if (element().isReadOnly())
>         return false;
> 
>-    return element()->isTextFormControlFocusable();
>+    return element().isTextFormControlFocusable();
> #endif
>     return false;
> }
>@@ -129,22 +127,20 @@ String ColorInputType::sanitizeValue(const String& proposedValue) const
> 
> Color ColorInputType::valueAsColor() const
> {
>-    ASSERT(element());
>-    return parseSimpleColorValue(element()->value()).value();
>+    return parseSimpleColorValue(element().value()).value();
> }
> 
> void ColorInputType::createShadowSubtree()
> {
>-    ASSERT(element());
>-    ASSERT(element()->shadowRoot());
>+    ASSERT(element().shadowRoot());
> 
>-    Document& document = element()->document();
>+    Document& document = element().document();
>     auto wrapperElement = HTMLDivElement::create(document);
>     wrapperElement->setPseudo(AtomicString("-webkit-color-swatch-wrapper", AtomicString::ConstructFromLiteral));
>     auto colorSwatch = HTMLDivElement::create(document);
>     colorSwatch->setPseudo(AtomicString("-webkit-color-swatch", AtomicString::ConstructFromLiteral));
>     wrapperElement->appendChild(colorSwatch);
>-    element()->userAgentShadowRoot()->appendChild(wrapperElement);
>+    element().userAgentShadowRoot()->appendChild(wrapperElement);
> 
>     updateColorSwatch();
> }
>@@ -163,8 +159,7 @@ void ColorInputType::setValue(const String& value, bool valueChanged, TextFieldE
> 
> void ColorInputType::handleDOMActivateEvent(Event& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl() || !element()->renderer())
>+    if (element().isDisabledFormControl() || !element().renderer())
>         return;
> 
>     if (!UserGestureIndicator::processingUserGesture())
>@@ -202,13 +197,12 @@ bool ColorInputType::shouldResetOnDocumentActivation()
> 
> void ColorInputType::didChooseColor(const Color& color)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl() || color == valueAsColor())
>+    if (element().isDisabledFormControl() || color == valueAsColor())
>         return;
>     EventQueueScope scope;
>-    element()->setValueFromRenderer(color.serialized());
>+    element().setValueFromRenderer(color.serialized());
>     updateColorSwatch();
>-    element()->dispatchFormControlChangeEvent();
>+    element().dispatchFormControlChangeEvent();
> }
> 
> void ColorInputType::didEndChooser()
>@@ -228,14 +222,12 @@ void ColorInputType::updateColorSwatch()
>     if (!colorSwatch)
>         return;
> 
>-    ASSERT(element());
>-    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element()->value(), false);
>+    colorSwatch->setInlineStyleProperty(CSSPropertyBackgroundColor, element().value(), false);
> }
> 
> HTMLElement* ColorInputType::shadowColorSwatch() const
> {
>-    ASSERT(element());
>-    RefPtr<ShadowRoot> shadow = element()->userAgentShadowRoot();
>+    RefPtr<ShadowRoot> shadow = element().userAgentShadowRoot();
>     if (!shadow)
>         return nullptr;
> 
>@@ -248,10 +240,9 @@ HTMLElement* ColorInputType::shadowColorSwatch() const
> 
> IntRect ColorInputType::elementRectRelativeToRootView() const
> {
>-    ASSERT(element());
>-    if (!element()->renderer())
>+    if (!element().renderer())
>         return IntRect();
>-    return element()->document().view()->contentsToRootView(element()->renderer()->absoluteBoundingBoxRect());
>+    return element().document().view()->contentsToRootView(element().renderer()->absoluteBoundingBoxRect());
> }
> 
> Color ColorInputType::currentColor()
>@@ -262,8 +253,7 @@ Color ColorInputType::currentColor()
> bool ColorInputType::shouldShowSuggestions() const
> {
> #if ENABLE(DATALIST_ELEMENT)
>-    ASSERT(element());
>-    return element()->hasAttributeWithoutSynchronization(listAttr);
>+    return element().hasAttributeWithoutSynchronization(listAttr);
> #else
>     return false;
> #endif
>@@ -273,8 +263,7 @@ Vector<Color> ColorInputType::suggestions() const
> {
>     Vector<Color> suggestions;
> #if ENABLE(DATALIST_ELEMENT)
>-    ASSERT(element());
>-    if (auto dataList = element()->dataList()) {
>+    if (auto dataList = element().dataList()) {
>         Ref<HTMLCollection> options = dataList->options();
>         unsigned length = options->length();
>         suggestions.reserveInitialCapacity(length);
>diff --git a/Source/WebCore/html/DateInputType.cpp b/Source/WebCore/html/DateInputType.cpp
>index c848a87dc670a79bb9a78918d032036712cd669c..3b5483960554313e2e61a9f19e49b4697c921474 100644
>--- a/Source/WebCore/html/DateInputType.cpp
>+++ b/Source/WebCore/html/DateInputType.cpp
>@@ -62,11 +62,10 @@ DateComponents::Type DateInputType::dateType() const
> 
> StepRange DateInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal stepBase = parseToNumber(element()->attributeWithoutSynchronization(minAttr), 0);
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumDate()));
>-    const Decimal maximum = parseToNumber(element()->attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumDate()));
>-    const Decimal step = StepRange::parseStep(anyStepHandling, dateStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal stepBase = parseToNumber(element().attributeWithoutSynchronization(minAttr), 0);
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumDate()));
>+    const Decimal maximum = parseToNumber(element().attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumDate()));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, dateStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(stepBase, RangeLimitations::Valid, minimum, maximum, step, dateStepDescription);
> }
> 
>diff --git a/Source/WebCore/html/DateTimeLocalInputType.cpp b/Source/WebCore/html/DateTimeLocalInputType.cpp
>index 7cac1d9cbd633b95419b8e1fbf21b9e21613c98d..f281f4a062de5b40f8056542e7d770478bc5694a 100644
>--- a/Source/WebCore/html/DateTimeLocalInputType.cpp
>+++ b/Source/WebCore/html/DateTimeLocalInputType.cpp
>@@ -70,11 +70,10 @@ ExceptionOr<void> DateTimeLocalInputType::setValueAsDate(double value) const
> 
> StepRange DateTimeLocalInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal stepBase = parseToNumber(element()->attributeWithoutSynchronization(minAttr), 0);
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumDateTime()));
>-    const Decimal maximum = parseToNumber(element()->attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumDateTime()));
>-    const Decimal step = StepRange::parseStep(anyStepHandling, dateTimeLocalStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal stepBase = parseToNumber(element().attributeWithoutSynchronization(minAttr), 0);
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumDateTime()));
>+    const Decimal maximum = parseToNumber(element().attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumDateTime()));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, dateTimeLocalStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(stepBase, RangeLimitations::Valid, minimum, maximum, step, dateTimeLocalStepDescription);
> }
> 
>diff --git a/Source/WebCore/html/EmailInputType.cpp b/Source/WebCore/html/EmailInputType.cpp
>index 42553693988b93dd1b5903f321181df9921293ae..de320b3392b9e519ef94f3c2fabd04e680d0783b 100644
>--- a/Source/WebCore/html/EmailInputType.cpp
>+++ b/Source/WebCore/html/EmailInputType.cpp
>@@ -59,10 +59,9 @@ const AtomicString& EmailInputType::formControlType() const
> 
> bool EmailInputType::typeMismatchFor(const String& value) const
> {
>-    ASSERT(element());
>     if (value.isEmpty())
>         return false;
>-    if (!element()->multiple())
>+    if (!element().multiple())
>         return !isValidEmailAddress(value);
>     for (auto& address : value.splitAllowingEmptyEntries(',')) {
>         if (!isValidEmailAddress(stripLeadingAndTrailingHTMLSpaces(address)))
>@@ -73,14 +72,12 @@ bool EmailInputType::typeMismatchFor(const String& value) const
> 
> bool EmailInputType::typeMismatch() const
> {
>-    ASSERT(element());
>-    return typeMismatchFor(element()->value());
>+    return typeMismatchFor(element().value());
> }
> 
> String EmailInputType::typeMismatchText() const
> {
>-    ASSERT(element());
>-    return element()->multiple() ? validationMessageTypeMismatchForMultipleEmailText() : validationMessageTypeMismatchForEmailText();
>+    return element().multiple() ? validationMessageTypeMismatchForMultipleEmailText() : validationMessageTypeMismatchForEmailText();
> }
> 
> bool EmailInputType::isEmailField() const
>@@ -96,8 +93,7 @@ bool EmailInputType::supportsSelectionAPI() const
> String EmailInputType::sanitizeValue(const String& proposedValue) const
> {
>     String noLineBreakValue = proposedValue.removeCharacters(isHTMLLineBreak);
>-    ASSERT(element());
>-    if (!element()->multiple())
>+    if (!element().multiple())
>         return stripLeadingAndTrailingHTMLSpaces(noLineBreakValue);
>     Vector<String> addresses = noLineBreakValue.splitAllowingEmptyEntries(',');
>     StringBuilder strippedValue;
>diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
>index 03af3a963494faf0012e21a938f5191780308508..9939d2f64863ead317300b95bb22a3bb9eeb98bc 100644
>--- a/Source/WebCore/html/FileInputType.cpp
>+++ b/Source/WebCore/html/FileInputType.cpp
>@@ -153,11 +153,10 @@ void FileInputType::restoreFormControlState(const FormControlState& state)
> 
> bool FileInputType::appendFormData(DOMFormData& formData, bool multipart) const
> {
>-    ASSERT(element());
>-    auto fileList = makeRefPtr(element()->files());
>+    auto fileList = makeRefPtr(element().files());
>     ASSERT(fileList);
> 
>-    auto name = element()->name();
>+    auto name = element().name();
> 
>     if (!multipart) {
>         // Send only the basenames.
>@@ -187,20 +186,17 @@ bool FileInputType::appendFormData(DOMFormData& formData, bool multipart) const
> 
> bool FileInputType::valueMissing(const String& value) const
> {
>-    ASSERT(element());
>-    return element()->isRequired() && value.isEmpty();
>+    return element().isRequired() && value.isEmpty();
> }
> 
> String FileInputType::valueMissingText() const
> {
>-    ASSERT(element());
>-    return element()->multiple() ? validationMessageValueMissingForMultipleFileText() : validationMessageValueMissingForFileText();
>+    return element().multiple() ? validationMessageValueMissingForMultipleFileText() : validationMessageValueMissingForFileText();
> }
> 
> void FileInputType::handleDOMActivateEvent(Event& event)
> {
>-    ASSERT(element());
>-    auto& input = *element();
>+    auto& input = element();
> 
>     if (input.isDisabledFormControl())
>         return;
>@@ -227,8 +223,7 @@ void FileInputType::handleDOMActivateEvent(Event& event)
> 
> RenderPtr<RenderElement> FileInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderFileUploadControl>(*element(), WTFMove(style));
>+    return createRenderer<RenderFileUploadControl>(element(), WTFMove(style));
> }
> 
> bool FileInputType::canSetStringValue() const
>@@ -272,8 +267,7 @@ void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
>     // FIXME: Should we clear the file list, or replace it with a new empty one here? This is observable from JavaScript through custom properties.
>     m_fileList->clear();
>     m_icon = nullptr;
>-    ASSERT(element());
>-    element()->invalidateStyleForSubtree();
>+    element().invalidateStyleForSubtree();
> }
> 
> bool FileInputType::isFileUpload() const
>@@ -283,28 +277,26 @@ bool FileInputType::isFileUpload() const
> 
> void FileInputType::createShadowSubtree()
> {
>-    ASSERT(element());
>-    ASSERT(element()->shadowRoot());
>-    element()->userAgentShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()));
>+    ASSERT(element().shadowRoot());
>+    element().userAgentShadowRoot()->appendChild(element().multiple() ? UploadButtonElement::createForMultiple(element().document()): UploadButtonElement::create(element().document()));
> }
> 
> void FileInputType::disabledStateChanged()
> {
>-    ASSERT(element());
>-    ASSERT(element()->shadowRoot());
>+    ASSERT(element().shadowRoot());
> 
>-    auto root = element()->userAgentShadowRoot();
>+    auto root = element().userAgentShadowRoot();
>     if (!root)
>         return;
>     
>     if (auto button = makeRefPtr(childrenOfType<UploadButtonElement>(*root).first()))
>-        button->setBooleanAttribute(disabledAttr, element()->isDisabledFormControl());
>+        button->setBooleanAttribute(disabledAttr, element().isDisabledFormControl());
> }
> 
> void FileInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == multipleAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             ASSERT(element->shadowRoot());
>             if (auto root = element->userAgentShadowRoot()) {
>                 if (auto button = makeRefPtr(childrenOfType<UploadButtonElement>(*root).first()))
>@@ -349,8 +341,7 @@ bool FileInputType::allowsDirectories() const
> {
>     if (!RuntimeEnabledFeatures::sharedFeatures().directoryUploadEnabled())
>         return false;
>-    ASSERT(element());
>-    return element()->hasAttributeWithoutSynchronization(webkitdirectoryAttr);
>+    return element().hasAttributeWithoutSynchronization(webkitdirectoryAttr);
> }
> 
> void FileInputType::setFiles(RefPtr<FileList>&& files)
>@@ -363,8 +354,7 @@ void FileInputType::setFiles(RefPtr<FileList>&& files, RequestIcon shouldRequest
>     if (!files)
>         return;
> 
>-    ASSERT(element());
>-    Ref<HTMLInputElement> protectedInputElement(*element());
>+    Ref<HTMLInputElement> protectedInputElement(element());
> 
>     unsigned length = files->length();
> 
>@@ -434,8 +424,7 @@ void FileInputType::iconLoaded(RefPtr<Icon>&& icon)
>         return;
> 
>     m_icon = WTFMove(icon);
>-    ASSERT(element());
>-    if (auto* renderer = element()->renderer())
>+    if (auto* renderer = element().renderer())
>         renderer->repaint();
> }
> 
>@@ -446,8 +435,7 @@ bool FileInputType::receiveDroppedFiles(const DragData& dragData)
>     if (paths.isEmpty())
>         return false;
> 
>-    ASSERT(element());
>-    if (element()->hasAttributeWithoutSynchronization(multipleAttr)) {
>+    if (element().hasAttributeWithoutSynchronization(multipleAttr)) {
>         Vector<FileChooserFileInfo> files;
>         files.reserveInitialCapacity(paths.size());
>         for (auto& path : paths)
>@@ -470,8 +458,7 @@ String FileInputType::defaultToolTip() const
> {
>     unsigned listSize = m_fileList->length();
>     if (!listSize) {
>-        ASSERT(element());
>-        if (element()->multiple())
>+        if (element().multiple())
>             return fileButtonNoFilesSelectedLabel();
>         return fileButtonNoFileSelectedLabel();
>     }
>diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
>index a882c8fc59394831ec804afa2c9c76b01e7bb766..69706e25a80d214241ca6cbd2fd66dada37ed7c2 100644
>--- a/Source/WebCore/html/HiddenInputType.cpp
>+++ b/Source/WebCore/html/HiddenInputType.cpp
>@@ -52,14 +52,12 @@ FormControlState HiddenInputType::saveFormControlState() const
> {
>     // valueAttributeWasUpdatedAfterParsing() never be true for form controls create by createElement() or cloneNode().
>     // It's OK for now because we restore values only to form controls created by parsing.
>-    ASSERT(element());
>-    return element()->valueAttributeWasUpdatedAfterParsing() ? FormControlState { { element()->value() } } : FormControlState { };
>+    return element().valueAttributeWasUpdatedAfterParsing() ? FormControlState { { element().value() } } : FormControlState { };
> }
> 
> void HiddenInputType::restoreFormControlState(const FormControlState& state)
> {
>-    ASSERT(element());
>-    element()->setAttributeWithoutSynchronization(valueAttr, state[0]);
>+    element().setAttributeWithoutSynchronization(valueAttr, state[0]);
> }
> 
> bool HiddenInputType::supportsValidation() const
>@@ -89,8 +87,7 @@ bool HiddenInputType::storesValueSeparateFromAttribute()
> 
> void HiddenInputType::setValue(const String& sanitizedValue, bool, TextFieldEventBehavior)
> {
>-    ASSERT(element());
>-    element()->setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
>+    element().setAttributeWithoutSynchronization(valueAttr, sanitizedValue);
> }
> 
> bool HiddenInputType::isHiddenType() const
>@@ -100,8 +97,7 @@ bool HiddenInputType::isHiddenType() const
> 
> bool HiddenInputType::appendFormData(DOMFormData& formData, bool isMultipartForm) const
> {
>-    ASSERT(element());
>-    auto name = element()->name();
>+    auto name = element().name();
> 
>     if (equalIgnoringASCIICase(name, "_charset_")) {
>         formData.append(name, String { formData.encoding().name() });
>diff --git a/Source/WebCore/html/ImageInputType.cpp b/Source/WebCore/html/ImageInputType.cpp
>index 2b0f1ed66828f126a7e159a04b1cba8c08c5aaa0..ac5d6b2670d4bfaf1136b6ae3e095d9a52fe4b64 100644
>--- a/Source/WebCore/html/ImageInputType.cpp
>+++ b/Source/WebCore/html/ImageInputType.cpp
>@@ -56,11 +56,10 @@ bool ImageInputType::isFormDataAppendable() const
> 
> bool ImageInputType::appendFormData(DOMFormData& formData, bool) const
> {
>-    ASSERT(element());
>-    if (!element()->isActivatedSubmit())
>+    if (!element().isActivatedSubmit())
>         return false;
> 
>-    auto& name = element()->name();
>+    auto& name = element().name();
>     if (name.isEmpty()) {
>         formData.append("x"_s, String::number(m_clickLocation.x()));
>         formData.append("y"_s, String::number(m_clickLocation.y()));
>@@ -70,7 +69,7 @@ bool ImageInputType::appendFormData(DOMFormData& formData, bool) const
>     formData.append(makeString(name, ".x"), String::number(m_clickLocation.x()));
>     formData.append(makeString(name, ".y"), String::number(m_clickLocation.y()));
> 
>-    auto value = element()->value();
>+    auto value = element().value();
>     if (!value.isEmpty())
>         formData.append(name, value);
> 
>@@ -84,8 +83,7 @@ bool ImageInputType::supportsValidation() const
> 
> void ImageInputType::handleDOMActivateEvent(Event& event)
> {
>-    ASSERT(element());
>-    Ref<HTMLInputElement> protectedElement(*element());
>+    Ref<HTMLInputElement> protectedElement(element());
>     if (protectedElement->isDisabledFormControl() || !protectedElement->form())
>         return;
> 
>@@ -116,20 +114,19 @@ void ImageInputType::handleDOMActivateEvent(Event& event)
> 
> RenderPtr<RenderElement> ImageInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderImage>(*element(), WTFMove(style));
>+    return createRenderer<RenderImage>(element(), WTFMove(style));
> }
> 
> void ImageInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == altAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             auto* renderer = element->renderer();
>             if (is<RenderImage>(renderer))
>                 downcast<RenderImage>(*renderer).updateAltText();
>         }
>     } else if (name == srcAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             if (element->renderer())
>                 element->ensureImageLoader().updateFromElementIgnoringPreviousError();
>         }
>@@ -141,11 +138,10 @@ void ImageInputType::attach()
> {
>     BaseButtonInputType::attach();
> 
>-    ASSERT(element());
>-    HTMLImageLoader& imageLoader = element()->ensureImageLoader();
>+    HTMLImageLoader& imageLoader = element().ensureImageLoader();
>     imageLoader.updateFromElement();
> 
>-    auto* renderer = downcast<RenderImage>(element()->renderer());
>+    auto* renderer = downcast<RenderImage>(element().renderer());
>     if (!renderer)
>         return;
> 
>@@ -188,8 +184,7 @@ bool ImageInputType::shouldRespectHeightAndWidthAttributes()
> 
> unsigned ImageInputType::height() const
> {
>-    ASSERT(element());
>-    Ref<HTMLInputElement> element(*this->element());
>+    Ref<HTMLInputElement> element(this->element());
> 
>     element->document().updateLayout();
> 
>@@ -210,8 +205,7 @@ unsigned ImageInputType::height() const
> 
> unsigned ImageInputType::width() const
> {
>-    ASSERT(element());
>-    Ref<HTMLInputElement> element(*this->element());
>+    Ref<HTMLInputElement> element(this->element());
> 
>     element->document().updateLayout();
> 
>diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
>index 9167fe9d922c52a5f8526c0243ed6b8403c99b5b..822b94a12a87eb3cd49ddcb3d8e6b93fb8b8e679 100644
>--- a/Source/WebCore/html/InputType.cpp
>+++ b/Source/WebCore/html/InputType.cpp
>@@ -193,31 +193,27 @@ bool InputType::shouldSaveAndRestoreFormControlState() const
> 
> FormControlState InputType::saveFormControlState() const
> {
>-    ASSERT(element());
>-    auto currentValue = element()->value();
>-    if (currentValue == element()->defaultValue())
>+    auto currentValue = element().value();
>+    if (currentValue == element().defaultValue())
>         return { };
>     return { { currentValue } };
> }
> 
> void InputType::restoreFormControlState(const FormControlState& state)
> {
>-    ASSERT(element());
>-    element()->setValue(state[0]);
>+    element().setValue(state[0]);
> }
> 
> bool InputType::isFormDataAppendable() const
> {
>-    ASSERT(element());
>     // There is no form data unless there's a name for non-image types.
>-    return !element()->name().isEmpty();
>+    return !element().name().isEmpty();
> }
> 
> bool InputType::appendFormData(DOMFormData& formData, bool) const
> {
>-    ASSERT(element());
>     // Always successful.
>-    formData.append(element()->name(), element()->value());
>+    formData.append(element().name(), element().value());
>     return true;
> }
> 
>@@ -323,8 +319,7 @@ double InputType::maximum() const
> 
> bool InputType::sizeShouldIncludeDecoration(int, int& preferredSize) const
> {
>-    ASSERT(element());
>-    preferredSize = element()->size();
>+    preferredSize = element().size();
>     return false;
> }
> 
>@@ -395,8 +390,7 @@ String InputType::valueMissingText() const
> 
> String InputType::validationMessage() const
> {
>-    ASSERT(element());
>-    String value = element()->value();
>+    String value = element().value();
> 
>     // The order of the following checks is meaningful. e.g. We'd like to show the
>     // badInput message even if the control has other validation errors.
>@@ -412,11 +406,11 @@ String InputType::validationMessage() const
>     if (patternMismatch(value))
>         return validationMessagePatternMismatchText();
> 
>-    if (element()->tooShort())
>-        return validationMessageTooShortText(numGraphemeClusters(value), element()->minLength());
>+    if (element().tooShort())
>+        return validationMessageTooShortText(numGraphemeClusters(value), element().minLength());
> 
>-    if (element()->tooLong())
>-        return validationMessageTooLongText(numGraphemeClusters(value), element()->effectiveMaxLength());
>+    if (element().tooLong())
>+        return validationMessageTooLongText(numGraphemeClusters(value), element().effectiveMaxLength());
> 
>     if (!isSteppable())
>         return emptyString();
>@@ -486,14 +480,12 @@ bool InputType::shouldSubmitImplicitly(Event& event)
> 
> RenderPtr<RenderElement> InputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return RenderPtr<RenderElement>(RenderElement::createFor(*element(), WTFMove(style)));
>+    return RenderPtr<RenderElement>(RenderElement::createFor(element(), WTFMove(style)));
> }
> 
> void InputType::blur()
> {
>-    ASSERT(element());
>-    element()->defaultBlur();
>+    element().defaultBlur();
> }
> 
> void InputType::createShadowSubtree()
>@@ -502,8 +494,7 @@ void InputType::createShadowSubtree()
> 
> void InputType::destroyShadowSubtree()
> {
>-    ASSERT(element());
>-    RefPtr<ShadowRoot> root = element()->userAgentShadowRoot();
>+    RefPtr<ShadowRoot> root = element().userAgentShadowRoot();
>     if (!root)
>         return;
> 
>@@ -542,16 +533,14 @@ DateComponents::Type InputType::dateType() const
> 
> void InputType::dispatchSimulatedClickIfActive(KeyboardEvent& event) const
> {
>-    ASSERT(element());
>-    if (element()->active())
>-        element()->dispatchSimulatedClick(&event);
>+    if (element().active())
>+        element().dispatchSimulatedClick(&event);
>     event.setDefaultHandled();
> }
> 
> Chrome* InputType::chrome() const
> {
>-    ASSERT(element());
>-    if (Page* page = element()->document().page())
>+    if (Page* page = element().document().page())
>         return &page->chrome();
>     return nullptr;
> }
>@@ -568,14 +557,12 @@ bool InputType::hasCustomFocusLogic() const
> 
> bool InputType::isKeyboardFocusable(KeyboardEvent* event) const
> {
>-    ASSERT(element());
>-    return !element()->isReadOnly() && element()->isTextFormControlKeyboardFocusable(event);
>+    return !element().isReadOnly() && element().isTextFormControlKeyboardFocusable(event);
> }
> 
> bool InputType::isMouseFocusable() const
> {
>-    ASSERT(element());
>-    return element()->isTextFormControlMouseFocusable();
>+    return element().isTextFormControlMouseFocusable();
> }
> 
> bool InputType::shouldUseInputMethod() const
>@@ -593,8 +580,7 @@ void InputType::handleBlurEvent()
> 
> void InputType::accessKeyAction(bool)
> {
>-    ASSERT(element());
>-    element()->focus(false);
>+    element().focus(false);
> }
> 
> void InputType::addSearchResult()
>@@ -665,19 +651,18 @@ bool InputType::storesValueSeparateFromAttribute()
> 
> void InputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
> {
>-    ASSERT(element());
>-    element()->setValueInternal(sanitizedValue, eventBehavior);
>-    element()->invalidateStyleForSubtree();
>+    element().setValueInternal(sanitizedValue, eventBehavior);
>+    element().invalidateStyleForSubtree();
>     if (!valueChanged)
>         return;
> 
>     switch (eventBehavior) {
>     case DispatchChangeEvent:
>-        element()->dispatchFormControlChangeEvent();
>+        element().dispatchFormControlChangeEvent();
>         break;
>     case DispatchInputAndChangeEvent:
>-        element()->dispatchFormControlInputEvent();
>-        if (auto element = this->element())
>+        element().dispatchFormControlInputEvent();
>+        if (auto element = this->elementPtr())
>             element->dispatchFormControlChangeEvent();
>         break;
>     case DispatchNoEvent:
>@@ -705,8 +690,7 @@ String InputType::localizeValue(const String& proposedValue) const
> 
> String InputType::visibleValue() const
> {
>-    ASSERT(element());
>-    return element()->value();
>+    return element().value();
> }
> 
> bool InputType::isEmptyValue() const
>@@ -962,8 +946,7 @@ ExceptionOr<void> InputType::applyStep(int count, AnyStepHandling anyStepHandlin
>     if (!stepRange.hasStep())
>         return Exception { InvalidStateError };
> 
>-    ASSERT(element());
>-    const Decimal current = parseToNumberOrNaN(element()->value());
>+    const Decimal current = parseToNumberOrNaN(element().value());
>     if (!current.isFinite())
>         return Exception { InvalidStateError };
>     Decimal newValue = current + stepRange.step() * count;
>@@ -976,7 +959,7 @@ ExceptionOr<void> InputType::applyStep(int count, AnyStepHandling anyStepHandlin
>     if (newValue < stepRange.minimum())
>         newValue = stepRange.minimum();
> 
>-    if (!equalLettersIgnoringASCIICase(element()->attributeWithoutSynchronization(stepAttr), "any"))
>+    if (!equalLettersIgnoringASCIICase(element().attributeWithoutSynchronization(stepAttr), "any"))
>         newValue = stepRange.alignValueForStep(current, newValue);
> 
>     if (newValue - stepRange.maximum() > acceptableErrorValue)
>@@ -988,8 +971,8 @@ ExceptionOr<void> InputType::applyStep(int count, AnyStepHandling anyStepHandlin
>     if (result.hasException())
>         return result;
> 
>-    if (AXObjectCache* cache = element()->document().existingAXObjectCache())
>-        cache->postNotification(element(), AXObjectCache::AXValueChanged);
>+    if (AXObjectCache* cache = element().document().existingAXObjectCache())
>+        cache->postNotification(elementPtr(), AXObjectCache::AXValueChanged);
> 
>     return result;
> }
>@@ -1076,8 +1059,7 @@ void InputType::stepUpFromRenderer(int n)
>     else
>         sign = 0;
> 
>-    ASSERT(element());
>-    String currentStringValue = element()->value();
>+    String currentStringValue = element().value();
>     Decimal current = parseToNumberOrNaN(currentStringValue);
>     if (!current.isFinite()) {
>         current = defaultValueForStepUp();
>@@ -1091,7 +1073,7 @@ void InputType::stepUpFromRenderer(int n)
>     if ((sign > 0 && current < stepRange.minimum()) || (sign < 0 && current > stepRange.maximum()))
>         setValueAsDecimal(sign > 0 ? stepRange.minimum() : stepRange.maximum(), DispatchInputAndChangeEvent);
>     else {
>-        if (stepMismatch(element()->value())) {
>+        if (stepMismatch(element().value())) {
>             ASSERT(!step.isZero());
>             const Decimal base = stepRange.stepBase();
>             Decimal newValue;
>diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
>index c994cce523cc86b66ce9ea8023847063629b2e8d..8eef492dd12233bdeab7a6655bd8f09da0528535 100644
>--- a/Source/WebCore/html/InputType.h
>+++ b/Source/WebCore/html/InputType.h
>@@ -306,7 +306,8 @@ public:
> protected:
>     explicit InputType(HTMLInputElement& element)
>         : m_element(makeWeakPtr(element)) { }
>-    HTMLInputElement* element() const { return m_element.get(); }
>+    HTMLInputElement& element() const;
>+    HTMLInputElement* elementPtr() const { return m_element.get(); }
>     Chrome* chrome() const;
>     Decimal parseToNumberOrNaN(const String&) const;
> 
>@@ -318,6 +319,13 @@ private:
>     WeakPtr<HTMLInputElement> m_element;
> };
> 
>+inline HTMLInputElement& InputType::element() const
>+{
>+    ASSERT(m_element.get());
>+    return *m_element.get();
>+}
>+
>+
> } // namespace WebCore
> 
> #define SPECIALIZE_TYPE_TRAITS_INPUT_TYPE(ToValueTypeName, predicate) \
>diff --git a/Source/WebCore/html/MonthInputType.cpp b/Source/WebCore/html/MonthInputType.cpp
>index f92b35535a1d6ea23367a696052f18a23f1e24e1..6c6d4f84176ef56e9c06db8ac187d62d9353ff1a 100644
>--- a/Source/WebCore/html/MonthInputType.cpp
>+++ b/Source/WebCore/html/MonthInputType.cpp
>@@ -60,9 +60,8 @@ DateComponents::Type MonthInputType::dateType() const
> 
> double MonthInputType::valueAsDate() const
> {
>-    ASSERT(element());
>     DateComponents date;
>-    if (!parseToDateComponents(element()->value(), &date))
>+    if (!parseToDateComponents(element().value(), &date))
>         return DateComponents::invalidMilliseconds();
>     double msec = date.millisecondsSinceEpoch();
>     ASSERT(std::isfinite(msec));
>@@ -92,11 +91,10 @@ Decimal MonthInputType::defaultValueForStepUp() const
> 
> StepRange MonthInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal stepBase = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(monthDefaultStepBase));
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumMonth()));
>-    const Decimal maximum = parseToNumber(element()->attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumMonth()));
>-    const Decimal step = StepRange::parseStep(anyStepHandling, monthStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal stepBase = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(monthDefaultStepBase));
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumMonth()));
>+    const Decimal maximum = parseToNumber(element().attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumMonth()));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, monthStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(stepBase, RangeLimitations::Valid, minimum, maximum, step, monthStepDescription);
> }
> 
>diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
>index 3a92afc1ac82296cd5e4de3e76d067af2d44e4d4..aef495c1d2e5dc1ef743fceba553ea9c100f884a 100644
>--- a/Source/WebCore/html/NumberInputType.cpp
>+++ b/Source/WebCore/html/NumberInputType.cpp
>@@ -93,16 +93,14 @@ const AtomicString& NumberInputType::formControlType() const
> 
> void NumberInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
> {
>-    ASSERT(element());
>-    if (!valueChanged && sanitizedValue.isEmpty() && !element()->innerTextValue().isEmpty())
>+    if (!valueChanged && sanitizedValue.isEmpty() && !element().innerTextValue().isEmpty())
>         updateInnerTextValue();
>     TextFieldInputType::setValue(sanitizedValue, valueChanged, eventBehavior);
> }
> 
> double NumberInputType::valueAsDouble() const
> {
>-    ASSERT(element());
>-    return parseToDoubleForNumberType(element()->value());
>+    return parseToDoubleForNumberType(element().value());
> }
> 
> ExceptionOr<void> NumberInputType::setValueAsDouble(double newValue, TextFieldEventBehavior eventBehavior) const
>@@ -111,8 +109,7 @@ ExceptionOr<void> NumberInputType::setValueAsDouble(double newValue, TextFieldEv
>     const double floatMax = std::numeric_limits<float>::max();
>     if (newValue < -floatMax || newValue > floatMax)
>         return Exception { InvalidStateError };
>-    ASSERT(element());
>-    element()->setValue(serializeForNumberType(newValue), eventBehavior);
>+    element().setValue(serializeForNumberType(newValue), eventBehavior);
>     return { };
> }
> 
>@@ -122,8 +119,7 @@ ExceptionOr<void> NumberInputType::setValueAsDecimal(const Decimal& newValue, Te
>     const Decimal floatMax = Decimal::fromDouble(std::numeric_limits<float>::max());
>     if (newValue < -floatMax || newValue > floatMax)
>         return Exception { InvalidStateError };
>-    ASSERT(element());
>-    element()->setValue(serializeForNumberType(newValue), eventBehavior);
>+    element().setValue(serializeForNumberType(newValue), eventBehavior);
>     return { };
> }
> 
>@@ -134,8 +130,7 @@ bool NumberInputType::typeMismatchFor(const String& value) const
> 
> bool NumberInputType::typeMismatch() const
> {
>-    ASSERT(element());
>-    ASSERT(!typeMismatchFor(element()->value()));
>+    ASSERT(!typeMismatchFor(element().value()));
>     return false;
> }
> 
>@@ -143,11 +138,10 @@ StepRange NumberInputType::createStepRange(AnyStepHandling anyStepHandling) cons
> {
>     static NeverDestroyed<const StepRange::StepDescription> stepDescription(numberDefaultStep, numberDefaultStepBase, numberStepScaleFactor);
> 
>-    ASSERT(element());
>-    const Decimal stepBase = parseToDecimalForNumberType(element()->attributeWithoutSynchronization(minAttr), numberDefaultStepBase);
>+    const Decimal stepBase = parseToDecimalForNumberType(element().attributeWithoutSynchronization(minAttr), numberDefaultStepBase);
>     // FIXME: We should use numeric_limits<double>::max for number input type.
>     const Decimal floatMax = Decimal::fromDouble(std::numeric_limits<float>::max());
>-    const Element& element = *this->element();
>+    const Element& element = this->element();
> 
>     RangeLimitations rangeLimitations = RangeLimitations::Invalid;
>     auto extractBound = [&] (const QualifiedName& attributeName, const Decimal& defaultValue) -> Decimal {
>@@ -170,16 +164,15 @@ bool NumberInputType::sizeShouldIncludeDecoration(int defaultSize, int& preferre
> {
>     preferredSize = defaultSize;
> 
>-    ASSERT(element());
>-    auto& stepString = element()->attributeWithoutSynchronization(stepAttr);
>+    auto& stepString = element().attributeWithoutSynchronization(stepAttr);
>     if (equalLettersIgnoringASCIICase(stepString, "any"))
>         return false;
> 
>-    const Decimal minimum = parseToDecimalForNumberType(element()->attributeWithoutSynchronization(minAttr));
>+    const Decimal minimum = parseToDecimalForNumberType(element().attributeWithoutSynchronization(minAttr));
>     if (!minimum.isFinite())
>         return false;
> 
>-    const Decimal maximum = parseToDecimalForNumberType(element()->attributeWithoutSynchronization(maxAttr));
>+    const Decimal maximum = parseToDecimalForNumberType(element().attributeWithoutSynchronization(maxAttr));
>     if (!maximum.isFinite())
>         return false;
> 
>@@ -195,10 +188,8 @@ bool NumberInputType::sizeShouldIncludeDecoration(int defaultSize, int& preferre
> 
> float NumberInputType::decorationWidth() const
> {
>-    ASSERT(element());
>-
>     float width = 0;
>-    RefPtr<HTMLElement> spinButton = element()->innerSpinButtonElement();
>+    RefPtr<HTMLElement> spinButton = element().innerSpinButtonElement();
>     if (RenderBox* spinRenderer = spinButton ? spinButton->renderBox() : 0) {
>         width += spinRenderer->borderAndPaddingLogicalWidth();
>         // Since the width of spinRenderer is not calculated yet, spinRenderer->logicalWidth() returns 0.
>@@ -244,14 +235,12 @@ String NumberInputType::localizeValue(const String& proposedValue) const
>     // We don't localize scientific notations.
>     if (proposedValue.find(isE) != notFound)
>         return proposedValue;
>-    ASSERT(element());
>-    return element()->locale().convertToLocalizedNumber(proposedValue);
>+    return element().locale().convertToLocalizedNumber(proposedValue);
> }
> 
> String NumberInputType::visibleValue() const
> {
>-    ASSERT(element());
>-    return localizeValue(element()->value());
>+    return localizeValue(element().value());
> }
> 
> String NumberInputType::convertFromVisibleValue(const String& visibleValue) const
>@@ -261,8 +250,7 @@ String NumberInputType::convertFromVisibleValue(const String& visibleValue) cons
>     // We don't localize scientific notations.
>     if (visibleValue.find(isE) != notFound)
>         return visibleValue;
>-    ASSERT(element());
>-    return element()->locale().convertFromLocalizedNumber(visibleValue);
>+    return element().locale().convertFromLocalizedNumber(visibleValue);
> }
> 
> String NumberInputType::sanitizeValue(const String& proposedValue) const
>@@ -274,8 +262,7 @@ String NumberInputType::sanitizeValue(const String& proposedValue) const
> 
> bool NumberInputType::hasBadInput() const
> {
>-    ASSERT(element());
>-    String standardValue = convertFromVisibleValue(element()->innerTextValue());
>+    String standardValue = convertFromVisibleValue(element().innerTextValue());
>     return !standardValue.isEmpty() && !std::isfinite(parseToDoubleForNumberType(standardValue));
> }
> 
>@@ -296,15 +283,14 @@ bool NumberInputType::isNumberField() const
> 
> void NumberInputType::attributeChanged(const QualifiedName& name)
> {
>-    ASSERT(element());
>     if (name == maxAttr || name == minAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             element->invalidateStyleForSubtree();
>             if (auto* renderer = element->renderer())
>                 renderer->setNeedsLayoutAndPrefWidthsRecalc();
>         }
>     } else if (name == stepAttr) {
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             if (auto* renderer = element->renderer())
>                 renderer->setNeedsLayoutAndPrefWidthsRecalc();
>         }
>diff --git a/Source/WebCore/html/RadioInputType.cpp b/Source/WebCore/html/RadioInputType.cpp
>index c11f6c956a1b553d397946e7e76299b5c69bbf60..7705fe4deecf6606635409636af21af5f15df0c3 100644
>--- a/Source/WebCore/html/RadioInputType.cpp
>+++ b/Source/WebCore/html/RadioInputType.cpp
>@@ -44,8 +44,7 @@ const AtomicString& RadioInputType::formControlType() const
> 
> bool RadioInputType::valueMissing(const String&) const
> {
>-    ASSERT(element());
>-    return element()->isInRequiredRadioButtonGroup() && !element()->checkedRadioButtonForGroup();
>+    return element().isInRequiredRadioButtonGroup() && !element().checkedRadioButtonForGroup();
> }
> 
> String RadioInputType::valueMissingText() const
>@@ -67,19 +66,18 @@ void RadioInputType::handleKeydownEvent(KeyboardEvent& event)
>     if (key != "Up" && key != "Down" && key != "Left" && key != "Right")
>         return;
> 
>-    ASSERT(element());
>     // Left and up mean "previous radio button".
>     // Right and down mean "next radio button".
>     // Tested in WinIE, and even for RTL, left still means previous radio button (and so moves
>     // to the right).  Seems strange, but we'll match it.
>     // However, when using Spatial Navigation, we need to be able to navigate without changing the selection.
>-    if (isSpatialNavigationEnabled(element()->document().frame()))
>+    if (isSpatialNavigationEnabled(element().document().frame()))
>         return;
>     bool forward = (key == "Down" || key == "Right");
> 
>     // We can only stay within the form's children if the form hasn't been demoted to a leaf because
>     // of malformed HTML.
>-    RefPtr<Node> node = element();
>+    RefPtr<Node> node = elementPtr();
>     while ((node = (forward ? NodeTraversal::next(*node) : NodeTraversal::previous(*node)))) {
>         // Once we encounter a form element, we know we're through.
>         if (is<HTMLFormElement>(*node))
>@@ -88,10 +86,10 @@ void RadioInputType::handleKeydownEvent(KeyboardEvent& event)
>         if (!is<HTMLInputElement>(*node))
>             continue;
>         RefPtr<HTMLInputElement> inputElement = downcast<HTMLInputElement>(node.get());
>-        if (inputElement->form() != element()->form())
>+        if (inputElement->form() != element().form())
>             break;
>-        if (inputElement->isRadioButton() && inputElement->name() == element()->name() && inputElement->isFocusable()) {
>-            element()->document().setFocusedElement(inputElement.get());
>+        if (inputElement->isRadioButton() && inputElement->name() == element().name() && inputElement->isFocusable()) {
>+            element().document().setFocusedElement(inputElement.get());
>             inputElement->dispatchSimulatedClick(&event, SendNoEvents, DoNotShowPressedLook);
>             event.setDefaultHandled();
>             return;
>@@ -105,10 +103,9 @@ void RadioInputType::handleKeyupEvent(KeyboardEvent& event)
>     if (key != "U+0020")
>         return;
> 
>-    ASSERT(element());
>     // If an unselected radio is tabbed into (because the entire group has nothing
>     // checked, or because of some explicit .focus() call), then allow space to check it.
>-    if (element()->checked())
>+    if (element().checked())
>         return;
>     dispatchSimulatedClickIfActive(event);
> }
>@@ -118,35 +115,32 @@ bool RadioInputType::isKeyboardFocusable(KeyboardEvent* event) const
>     if (!InputType::isKeyboardFocusable(event))
>         return false;
> 
>-    ASSERT(element());
>     // When using Spatial Navigation, every radio button should be focusable.
>-    if (isSpatialNavigationEnabled(element()->document().frame()))
>+    if (isSpatialNavigationEnabled(element().document().frame()))
>         return true;
> 
>     // Never allow keyboard tabbing to leave you in the same radio group.  Always
>     // skip any other elements in the group.
>-    RefPtr<Element> currentFocusedNode = element()->document().focusedElement();
>+    RefPtr<Element> currentFocusedNode = element().document().focusedElement();
>     if (is<HTMLInputElement>(currentFocusedNode)) {
>         HTMLInputElement& focusedInput = downcast<HTMLInputElement>(*currentFocusedNode);
>-        if (focusedInput.isRadioButton() && focusedInput.form() == element()->form() && focusedInput.name() == element()->name())
>+        if (focusedInput.isRadioButton() && focusedInput.form() == element().form() && focusedInput.name() == element().name())
>             return false;
>     }
> 
>     // Allow keyboard focus if we're checked or if nothing in the group is checked.
>-    return element()->checked() || !element()->checkedRadioButtonForGroup();
>+    return element().checked() || !element().checkedRadioButtonForGroup();
> }
> 
> bool RadioInputType::shouldSendChangeEventAfterCheckedChanged()
> {
>     // Don't send a change event for a radio button that's getting unchecked.
>     // This was done to match the behavior of other browsers.
>-    ASSERT(element());
>-    return element()->checked();
>+    return element().checked();
> }
> 
> void RadioInputType::willDispatchClick(InputElementClickState& state)
> {
>-    ASSERT(element());
>     // An event handler can use preventDefault or "return false" to reverse the selection we do here.
>     // The InputElementClickState object contains what we need to undo what we did here in didDispatchClick.
> 
>@@ -154,10 +148,10 @@ void RadioInputType::willDispatchClick(InputElementClickState& state)
>     // Therefore if nothing is currently selected, we won't allow the upcoming action to be "undone", since
>     // we want some object in the radio group to actually get selected.
> 
>-    state.checked = element()->checked();
>-    state.checkedRadioButton = element()->checkedRadioButtonForGroup();
>+    state.checked = element().checked();
>+    state.checkedRadioButton = element().checkedRadioButtonForGroup();
> 
>-    element()->setChecked(true, DispatchChangeEvent);
>+    element().setChecked(true, DispatchChangeEvent);
> }
> 
> void RadioInputType::didDispatchClick(Event& event, const InputElementClickState& state)
>@@ -166,8 +160,7 @@ void RadioInputType::didDispatchClick(Event& event, const InputElementClickState
>         // Restore the original selected radio button if possible.
>         // Make sure it is still a radio button and only do the restoration if it still belongs to our group.
>         auto& button = state.checkedRadioButton;
>-        ASSERT(element());
>-        if (button && button->isRadioButton() && button->form() == element()->form() && button->name() == element()->name())
>+        if (button && button->isRadioButton() && button->form() == element().form() && button->name() == element().name())
>             button->setChecked(true);
>     }
> 
>@@ -182,8 +175,7 @@ bool RadioInputType::isRadioButton() const
> 
> bool RadioInputType::matchesIndeterminatePseudoClass() const
> {
>-    ASSERT(element());
>-    const HTMLInputElement& element = *this->element();
>+    const HTMLInputElement& element = this->element();
>     if (const RadioButtonGroups* radioButtonGroups = element.radioButtonGroups())
>         return !radioButtonGroups->hasCheckedButton(&element);
>     return !element.checked();
>diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
>index 4460d71982d67b6f3c80f419c83fbc31c9c87fa0..68f6041628fa6cb15b1529e49a5932dc80cd3cbc 100644
>--- a/Source/WebCore/html/RangeInputType.cpp
>+++ b/Source/WebCore/html/RangeInputType.cpp
>@@ -92,14 +92,12 @@ const AtomicString& RangeInputType::formControlType() const
> 
> double RangeInputType::valueAsDouble() const
> {
>-    ASSERT(element());
>-    return parseToDoubleForNumberType(element()->value());
>+    return parseToDoubleForNumberType(element().value());
> }
> 
> ExceptionOr<void> RangeInputType::setValueAsDecimal(const Decimal& newValue, TextFieldEventBehavior eventBehavior) const
> {
>-    ASSERT(element());
>-    element()->setValue(serialize(newValue), eventBehavior);
>+    element().setValue(serialize(newValue), eventBehavior);
>     return { };
> }
> 
>@@ -115,17 +113,16 @@ bool RangeInputType::supportsRequired() const
> 
> StepRange RangeInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), rangeDefaultMinimum);
>-    const Decimal maximum = ensureMaximum(parseToNumber(element()->attributeWithoutSynchronization(maxAttr), rangeDefaultMaximum), minimum, rangeDefaultMaximum);
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), rangeDefaultMinimum);
>+    const Decimal maximum = ensureMaximum(parseToNumber(element().attributeWithoutSynchronization(maxAttr), rangeDefaultMaximum), minimum, rangeDefaultMaximum);
> 
>-    const AtomicString& precisionValue = element()->attributeWithoutSynchronization(precisionAttr);
>+    const AtomicString& precisionValue = element().attributeWithoutSynchronization(precisionAttr);
>     if (!precisionValue.isNull()) {
>         const Decimal step = equalLettersIgnoringASCIICase(precisionValue, "float") ? Decimal::nan() : 1;
>         return StepRange(minimum, RangeLimitations::Valid, minimum, maximum, step, rangeStepDescription);
>     }
> 
>-    const Decimal step = StepRange::parseStep(anyStepHandling, rangeStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, rangeStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(minimum, RangeLimitations::Valid, minimum, maximum, step, rangeStepDescription);
> }
> 
>@@ -138,15 +135,14 @@ bool RangeInputType::isSteppable() const
> 
> void RangeInputType::handleMouseDownEvent(MouseEvent& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl())
>+    if (element().isDisabledFormControl())
>         return;
> 
>     if (event.button() != LeftButton || !is<Node>(event.target()))
>         return;
>-    ASSERT(element()->shadowRoot());
>+    ASSERT(element().shadowRoot());
>     auto& targetNode = downcast<Node>(*event.target());
>-    if (&targetNode != element() && !targetNode.isDescendantOf(element()->userAgentShadowRoot().get()))
>+    if (&targetNode != &element() && !targetNode.isDescendantOf(element().userAgentShadowRoot().get()))
>         return;
>     auto& thumb = typedSliderThumbElement();
>     if (&targetNode == &thumb)
>@@ -162,8 +158,7 @@ void RangeInputType::handleTouchEvent(TouchEvent& event)
> #if PLATFORM(IOS)
>     typedSliderThumbElement().handleTouchEvent(event);
> #elif ENABLE(TOUCH_SLIDER)
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl())
>+    if (element().isDisabledFormControl())
>         return;
> 
>     if (event.type() == eventNames().touchendEvent) {
>@@ -196,13 +191,12 @@ void RangeInputType::disabledStateChanged()
> 
> void RangeInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl())
>+    if (element().isDisabledFormControl())
>         return;
> 
>     const String& key = event.keyIdentifier();
> 
>-    const Decimal current = parseToNumberOrNaN(element()->value());
>+    const Decimal current = parseToNumberOrNaN(element().value());
>     ASSERT(current.isFinite());
> 
>     StepRange stepRange(createStepRange(RejectAny));
>@@ -210,11 +204,11 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent& event)
> 
>     // FIXME: We can't use stepUp() for the step value "any". So, we increase
>     // or decrease the value by 1/100 of the value range. Is it reasonable?
>-    const Decimal step = equalLettersIgnoringASCIICase(element()->attributeWithoutSynchronization(stepAttr), "any") ? (stepRange.maximum() - stepRange.minimum()) / 100 : stepRange.step();
>+    const Decimal step = equalLettersIgnoringASCIICase(element().attributeWithoutSynchronization(stepAttr), "any") ? (stepRange.maximum() - stepRange.minimum()) / 100 : stepRange.step();
>     const Decimal bigStep = std::max((stepRange.maximum() - stepRange.minimum()) / 10, step);
> 
>     bool isVertical = false;
>-    if (auto* renderer = element()->renderer()) {
>+    if (auto* renderer = element().renderer()) {
>         ControlPart part = renderer->style().appearance();
>         isVertical = part == SliderVerticalPart || part == MediaVolumeSliderPart;
>     }
>@@ -245,8 +239,8 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent& event)
>         EventQueueScope scope;
>         setValueAsDecimal(newValue, DispatchInputAndChangeEvent);
> 
>-        if (AXObjectCache* cache = element()->document().existingAXObjectCache())
>-            cache->postNotification(element(), AXObjectCache::AXValueChanged);
>+        if (AXObjectCache* cache = element().document().existingAXObjectCache())
>+            cache->postNotification(elementPtr(), AXObjectCache::AXValueChanged);
>     }
> 
>     event.setDefaultHandled();
>@@ -254,27 +248,25 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent& event)
> 
> void RangeInputType::createShadowSubtree()
> {
>-    ASSERT(element());
>-    ASSERT(element()->userAgentShadowRoot());
>+    ASSERT(element().userAgentShadowRoot());
> 
>-    Document& document = element()->document();
>+    Document& document = element().document();
>     auto track = HTMLDivElement::create(document);
>     track->setPseudo(AtomicString("-webkit-slider-runnable-track", AtomicString::ConstructFromLiteral));
>     track->appendChild(SliderThumbElement::create(document));
>     auto container = SliderContainerElement::create(document);
>     container->appendChild(track);
>-    element()->userAgentShadowRoot()->appendChild(container);
>+    element().userAgentShadowRoot()->appendChild(container);
> }
> 
> HTMLElement* RangeInputType::sliderTrackElement() const
> {
>-    ASSERT(element());
>-    ASSERT(element()->userAgentShadowRoot());
>-    ASSERT(element()->userAgentShadowRoot()->firstChild()); // container
>-    ASSERT(element()->userAgentShadowRoot()->firstChild()->isHTMLElement());
>-    ASSERT(element()->userAgentShadowRoot()->firstChild()->firstChild()); // track
>+    ASSERT(element().userAgentShadowRoot());
>+    ASSERT(element().userAgentShadowRoot()->firstChild()); // container
>+    ASSERT(element().userAgentShadowRoot()->firstChild()->isHTMLElement());
>+    ASSERT(element().userAgentShadowRoot()->firstChild()->firstChild()); // track
> 
>-    RefPtr<ShadowRoot> root = element()->userAgentShadowRoot();
>+    RefPtr<ShadowRoot> root = element().userAgentShadowRoot();
>     if (!root)
>         return nullptr;
>     
>@@ -300,8 +292,7 @@ HTMLElement* RangeInputType::sliderThumbElement() const
> 
> RenderPtr<RenderElement> RangeInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderSlider>(*element(), WTFMove(style));
>+    return createRenderer<RenderSlider>(element(), WTFMove(style));
> }
> 
> Decimal RangeInputType::parseToNumber(const String& src, const Decimal& defaultValue) const
>@@ -321,8 +312,7 @@ void RangeInputType::accessKeyAction(bool sendMouseEvents)
> {
>     InputType::accessKeyAction(sendMouseEvents);
> 
>-    ASSERT(element());
>-    element()->dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
>+    element().dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
> }
> 
> void RangeInputType::attributeChanged(const QualifiedName& name)
>@@ -330,7 +320,7 @@ void RangeInputType::attributeChanged(const QualifiedName& name)
>     // FIXME: Don't we need to do this work for precisionAttr too?
>     if (name == maxAttr || name == minAttr) {
>         // Sanitize the value.
>-        if (auto* element = this->element()) {
>+        if (auto* element = this->elementPtr()) {
>             if (element->hasDirtyValue())
>                 element->setValue(element->value());
>         }
>@@ -346,10 +336,8 @@ void RangeInputType::setValue(const String& value, bool valueChanged, TextFieldE
>     if (!valueChanged)
>         return;
> 
>-    if (eventBehavior == DispatchNoEvent) {
>-        ASSERT(element());
>-        element()->setTextAsOfLastFormControlChangeEvent(value);
>-    }
>+    if (eventBehavior == DispatchNoEvent)
>+        element().setTextAsOfLastFormControlChangeEvent(value);
> 
>     typedSliderThumbElement().setPositionFromValue();
> }
>@@ -386,8 +374,7 @@ void RangeInputType::updateTickMarkValues()
>         return;
>     m_tickMarkValues.clear();
>     m_tickMarkValuesDirty = false;
>-    ASSERT(element());
>-    auto dataList = element()->dataList();
>+    auto dataList = element().dataList();
>     if (!dataList)
>         return;
>     Ref<HTMLCollection> options = dataList->options();
>@@ -396,7 +383,7 @@ void RangeInputType::updateTickMarkValues()
>         RefPtr<Node> node = options->item(i);
>         HTMLOptionElement& optionElement = downcast<HTMLOptionElement>(*node);
>         String optionValue = optionElement.value();
>-        if (!element()->isValidValue(optionValue))
>+        if (!element().isValidValue(optionValue))
>             continue;
>         m_tickMarkValues.append(parseToNumber(optionValue, Decimal::nan()));
>     }
>diff --git a/Source/WebCore/html/ResetInputType.cpp b/Source/WebCore/html/ResetInputType.cpp
>index 405cb2cc594a3d331146a855dbfa195b3ab70915..016fe104bb26d323dcc4bb3457681308a97c08a2 100644
>--- a/Source/WebCore/html/ResetInputType.cpp
>+++ b/Source/WebCore/html/ResetInputType.cpp
>@@ -52,10 +52,9 @@ bool ResetInputType::supportsValidation() const
> 
> void ResetInputType::handleDOMActivateEvent(Event& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledFormControl() || !element()->form())
>+    if (element().isDisabledFormControl() || !element().form())
>         return;
>-    element()->form()->reset();
>+    element().form()->reset();
>     event.setDefaultHandled();
> }
> 
>diff --git a/Source/WebCore/html/SearchInputType.cpp b/Source/WebCore/html/SearchInputType.cpp
>index 7124391a3063ee5a2628e46d3fcac85c6168aeee..e8295b316e38fec58c28789a8ff4df5f97285b3d 100644
>--- a/Source/WebCore/html/SearchInputType.cpp
>+++ b/Source/WebCore/html/SearchInputType.cpp
>@@ -56,9 +56,8 @@ void SearchInputType::addSearchResult()
>     // Normally we've got the correct renderer by the time we get here. However when the input type changes
>     // we don't update the associated renderers until after the next tree update, so we could actually end up here
>     // with a mismatched renderer (e.g. through form submission).
>-    ASSERT(element());
>-    if (is<RenderSearchField>(element()->renderer()))
>-        downcast<RenderSearchField>(*element()->renderer()).addSearchResult();
>+    if (is<RenderSearchField>(element().renderer()))
>+        downcast<RenderSearchField>(*element().renderer()).addSearchResult();
> #endif
> }
> 
>@@ -76,7 +75,7 @@ void SearchInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == resultsAttr) {
>         if (m_resultsButton) {
>-            if (auto* element = this->element())
>+            if (auto* element = this->elementPtr())
>                 updateResultButtonPseudoType(*m_resultsButton, element->maxResults());
>         }
>     }
>@@ -85,8 +84,7 @@ void SearchInputType::attributeChanged(const QualifiedName& name)
> 
> RenderPtr<RenderElement> SearchInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderSearchField>(*element(), WTFMove(style));
>+    return createRenderer<RenderSearchField>(element(), WTFMove(style));
> }
> 
> const AtomicString& SearchInputType::formControlType() const
>@@ -115,12 +113,11 @@ void SearchInputType::createShadowSubtree()
>     ASSERT(container);
>     ASSERT(textWrapper);
> 
>-    ASSERT(element());
>-    m_resultsButton = SearchFieldResultsButtonElement::create(element()->document());
>-    updateResultButtonPseudoType(*m_resultsButton, element()->maxResults());
>+    m_resultsButton = SearchFieldResultsButtonElement::create(element().document());
>+    updateResultButtonPseudoType(*m_resultsButton, element().maxResults());
>     container->insertBefore(*m_resultsButton, textWrapper.get());
> 
>-    m_cancelButton = SearchFieldCancelButtonElement::create(element()->document());
>+    m_cancelButton = SearchFieldCancelButtonElement::create(element().document());
>     container->insertBefore(*m_cancelButton, textWrapper->nextSibling());
> }
> 
>@@ -136,15 +133,14 @@ HTMLElement* SearchInputType::cancelButtonElement() const
> 
> void SearchInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledOrReadOnly()) {
>+    if (element().isDisabledOrReadOnly()) {
>         TextFieldInputType::handleKeydownEvent(event);
>         return;
>     }
> 
>     const String& key = event.keyIdentifier();
>     if (key == "U+001B") {
>-        Ref<HTMLInputElement> protectedInputElement(*element());
>+        Ref<HTMLInputElement> protectedInputElement(element());
>         protectedInputElement->setValueForUser(emptyString());
>         protectedInputElement->onSearch();
>         event.setDefaultHandled();
>@@ -162,9 +158,8 @@ void SearchInputType::destroyShadowSubtree()
> 
> void SearchInputType::startSearchEventTimer()
> {
>-    ASSERT(element());
>-    ASSERT(element()->renderer());
>-    unsigned length = element()->innerTextValue().length();
>+    ASSERT(element().renderer());
>+    unsigned length = element().innerTextValue().length();
> 
>     if (!length) {
>         m_searchEventTimer.startOneShot(0_ms);
>@@ -183,21 +178,18 @@ void SearchInputType::stopSearchEventTimer()
> 
> void SearchInputType::searchEventTimerFired()
> {
>-    ASSERT(element());
>-    element()->onSearch();
>+    element().onSearch();
> }
> 
> bool SearchInputType::searchEventsShouldBeDispatched() const
> {
>-    ASSERT(element());
>-    return element()->hasAttributeWithoutSynchronization(incrementalAttr);
>+    return element().hasAttributeWithoutSynchronization(incrementalAttr);
> }
> 
> void SearchInputType::didSetValueByUserEdit()
> {
>-    ASSERT(element());
>-    if (m_cancelButton && is<RenderSearchField>(element()->renderer()))
>-        downcast<RenderSearchField>(*element()->renderer()).updateCancelButtonVisibility();
>+    if (m_cancelButton && is<RenderSearchField>(element().renderer()))
>+        downcast<RenderSearchField>(*element().renderer()).updateCancelButtonVisibility();
>     // If the incremental attribute is set, then dispatch the search event
>     if (searchEventsShouldBeDispatched())
>         startSearchEventTimer();
>@@ -207,8 +199,7 @@ void SearchInputType::didSetValueByUserEdit()
> 
> bool SearchInputType::sizeShouldIncludeDecoration(int, int& preferredSize) const
> {
>-    ASSERT(element());
>-    preferredSize = element()->size();
>+    preferredSize = element().size();
>     return true;
> }
> 
>diff --git a/Source/WebCore/html/SubmitInputType.cpp b/Source/WebCore/html/SubmitInputType.cpp
>index 1b1ea080e3807ac6542c5ca2491845cc0c753c9c..3e5aac088056fd6b94d3e70a9ffff1797f6388ef 100644
>--- a/Source/WebCore/html/SubmitInputType.cpp
>+++ b/Source/WebCore/html/SubmitInputType.cpp
>@@ -48,10 +48,9 @@ const AtomicString& SubmitInputType::formControlType() const
> 
> bool SubmitInputType::appendFormData(DOMFormData& formData, bool) const
> {
>-    ASSERT(element());
>-    if (!element()->isActivatedSubmit())
>+    if (!element().isActivatedSubmit())
>         return false;
>-    formData.append(element()->name(), element()->valueWithDefault());
>+    formData.append(element().name(), element().valueWithDefault());
>     return true;
> }
> 
>@@ -62,8 +61,7 @@ bool SubmitInputType::supportsRequired() const
> 
> void SubmitInputType::handleDOMActivateEvent(Event& event)
> {
>-    ASSERT(element());
>-    Ref<HTMLInputElement> protectedElement(*element());
>+    Ref<HTMLInputElement> protectedElement(element());
>     if (protectedElement->isDisabledFormControl() || !protectedElement->form())
>         return;
> 
>diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
>index 6fefffdb9e8144e7337340290c85b995c69849fb..143387d13bb850592d18541fc998f5065b5966fb 100644
>--- a/Source/WebCore/html/TextFieldInputType.cpp
>+++ b/Source/WebCore/html/TextFieldInputType.cpp
>@@ -83,18 +83,16 @@ TextFieldInputType::~TextFieldInputType()
> 
> bool TextFieldInputType::isKeyboardFocusable(KeyboardEvent*) const
> {
>-    ASSERT(element());
> #if PLATFORM(IOS)
>-    if (element()->isReadOnly())
>+    if (element().isReadOnly())
>         return false;
> #endif
>-    return element()->isTextFormControlFocusable();
>+    return element().isTextFormControlFocusable();
> }
> 
> bool TextFieldInputType::isMouseFocusable() const
> {
>-    ASSERT(element());
>-    return element()->isTextFormControlFocusable();
>+    return element().isTextFormControlFocusable();
> }
> 
> bool TextFieldInputType::isTextField() const
>@@ -116,17 +114,14 @@ bool TextFieldInputType::isEmptyValue() const
> 
> bool TextFieldInputType::valueMissing(const String& value) const
> {
>-    ASSERT(element());
>-    return element()->isRequired() && value.isEmpty();
>+    return element().isRequired() && value.isEmpty();
> }
> 
> void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChanged, TextFieldEventBehavior eventBehavior)
> {
>-    ASSERT(element());
>-
>     // Grab this input element to keep reference even if JS event handler
>     // changes input type.
>-    Ref<HTMLInputElement> input(*element());
>+    Ref<HTMLInputElement> input(element());
> 
>     // We don't ask InputType::setValue to dispatch events because
>     // TextFieldInputType dispatches events different way from InputType.
>@@ -172,15 +167,14 @@ void TextFieldInputType::setValue(const String& sanitizedValue, bool valueChange
> #if ENABLE(DATALIST_ELEMENT)
> void TextFieldInputType::handleClickEvent(MouseEvent&)
> {
>-    if (element()->focused() && element()->list())
>+    if (element().focused() && element().list())
>         displaySuggestions(DataListSuggestionActivationType::ControlClicked);
> }
> #endif
> 
> void TextFieldInputType::handleKeydownEvent(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    if (!element()->focused())
>+    if (!element().focused())
>         return;
> #if ENABLE(DATALIST_ELEMENT)
>     const String& key = event.keyIdentifier();
>@@ -189,16 +183,15 @@ void TextFieldInputType::handleKeydownEvent(KeyboardEvent& event)
>         event.setDefaultHandled();
>     }
> #endif
>-    RefPtr<Frame> frame = element()->document().frame();
>-    if (!frame || !frame->editor().doTextFieldCommandFromEvent(element(), &event))
>+    RefPtr<Frame> frame = element().document().frame();
>+    if (!frame || !frame->editor().doTextFieldCommandFromEvent(elementPtr(), &event))
>         return;
>     event.setDefaultHandled();
> }
> 
> void TextFieldInputType::handleKeydownEventForSpinButton(KeyboardEvent& event)
> {
>-    ASSERT(element());
>-    if (element()->isDisabledOrReadOnly())
>+    if (element().isDisabledOrReadOnly())
>         return;
> #if ENABLE(DATALIST_ELEMENT)
>     if (m_suggestionPicker)
>@@ -226,16 +219,13 @@ void TextFieldInputType::forwardEvent(Event& event)
>     bool isBlurEvent = event.type() == eventNames().blurEvent;
>     if (isFocusEvent || isBlurEvent)
>         capsLockStateMayHaveChanged();
>-    if (event.isMouseEvent() || isFocusEvent || isBlurEvent) {
>-        ASSERT(element());
>-        element()->forwardEvent(event);
>-    }
>+    if (event.isMouseEvent() || isFocusEvent || isBlurEvent)
>+        element().forwardEvent(event);
> }
> 
> void TextFieldInputType::elementDidBlur()
> {
>-    ASSERT(element());
>-    auto* renderer = element()->renderer();
>+    auto* renderer = element().renderer();
>     if (!renderer)
>         return;
> 
>@@ -258,17 +248,15 @@ void TextFieldInputType::elementDidBlur()
> 
> void TextFieldInputType::handleFocusEvent(Node* oldFocusedNode, FocusDirection)
> {
>-    ASSERT(element());
>-    ASSERT_UNUSED(oldFocusedNode, oldFocusedNode != element());
>-    if (RefPtr<Frame> frame = element()->document().frame())
>-        frame->editor().textFieldDidBeginEditing(element());
>+    ASSERT_UNUSED(oldFocusedNode, oldFocusedNode != elementPtr());
>+    if (RefPtr<Frame> frame = element().document().frame())
>+        frame->editor().textFieldDidBeginEditing(elementPtr());
> }
> 
> void TextFieldInputType::handleBlurEvent()
> {
>     InputType::handleBlurEvent();
>-    ASSERT(element());
>-    element()->endEditing();
>+    element().endEditing();
> }
> 
> bool TextFieldInputType::shouldSubmitImplicitly(Event& event)
>@@ -279,8 +267,7 @@ bool TextFieldInputType::shouldSubmitImplicitly(Event& event)
> 
> RenderPtr<RenderElement> TextFieldInputType::createInputRenderer(RenderStyle&& style)
> {
>-    ASSERT(element());
>-    return createRenderer<RenderTextControlSingleLine>(*element(), WTFMove(style));
>+    return createRenderer<RenderTextControlSingleLine>(element(), WTFMove(style));
> }
> 
> bool TextFieldInputType::needsContainer() const
>@@ -290,20 +277,17 @@ bool TextFieldInputType::needsContainer() const
> 
> bool TextFieldInputType::shouldHaveSpinButton() const
> {
>-    ASSERT(element());
>-    return RenderTheme::singleton().shouldHaveSpinButton(*element());
>+    return RenderTheme::singleton().shouldHaveSpinButton(element());
> }
> 
> bool TextFieldInputType::shouldHaveCapsLockIndicator() const
> {
>-    ASSERT(element());
>-    return RenderTheme::singleton().shouldHaveCapsLockIndicator(*element());
>+    return RenderTheme::singleton().shouldHaveCapsLockIndicator(element());
> }
> 
> void TextFieldInputType::createShadowSubtree()
> {
>-    ASSERT(element());
>-    ASSERT(element()->shadowRoot());
>+    ASSERT(element().shadowRoot());
> 
>     ASSERT(!m_innerText);
>     ASSERT(!m_innerBlock);
>@@ -311,7 +295,7 @@ void TextFieldInputType::createShadowSubtree()
>     ASSERT(!m_capsLockIndicator);
>     ASSERT(!m_autoFillButton);
> 
>-    Document& document = element()->document();
>+    Document& document = element().document();
>     bool shouldHaveSpinButton = this->shouldHaveSpinButton();
>     bool shouldHaveCapsLockIndicator = this->shouldHaveCapsLockIndicator();
>     bool createsContainer = shouldHaveSpinButton || shouldHaveCapsLockIndicator || needsContainer();
>@@ -319,7 +303,7 @@ void TextFieldInputType::createShadowSubtree()
>     m_innerText = TextControlInnerTextElement::create(document);
> 
>     if (!createsContainer) {
>-        element()->userAgentShadowRoot()->appendChild(*m_innerText);
>+        element().userAgentShadowRoot()->appendChild(*m_innerText);
>         updatePlaceholderText();
>         return;
>     }
>@@ -398,7 +382,7 @@ void TextFieldInputType::destroyShadowSubtree()
> void TextFieldInputType::attributeChanged(const QualifiedName& name)
> {
>     if (name == valueAttr || name == placeholderAttr) {
>-        if (element())
>+        if (elementPtr())
>             updateInnerTextValue();
>     }
>     InputType::attributeChanged(name);
>@@ -517,13 +501,12 @@ String TextFieldInputType::sanitizeValue(const String& proposedValue) const
> 
> void TextFieldInputType::handleBeforeTextInsertedEvent(BeforeTextInsertedEvent& event)
> {
>-    ASSERT(element());
>     // Make sure that the text to be inserted will not violate the maxLength.
> 
>     // We use RenderTextControlSingleLine::text() instead of InputElement::value()
>     // because they can be mismatched by sanitizeValue() in
>     // HTMLInputElement::subtreeHasChanged() in some cases.
>-    String innerText = element()->innerTextValue();
>+    String innerText = element().innerTextValue();
>     unsigned oldLength = numGraphemeClusters(innerText);
> 
>     // selectionLength represents the selection length of this text field to be
>@@ -532,18 +515,18 @@ void TextFieldInputType::handleBeforeTextInsertedEvent(BeforeTextInsertedEvent&
>     // selection length. The selection is the source of text drag-and-drop in
>     // that case, and nothing in the text field will be removed.
>     unsigned selectionLength = 0;
>-    if (element()->focused()) {
>-        ASSERT(enclosingTextFormControl(element()->document().frame()->selection().selection().start()) == element());
>-        int selectionStart = element()->selectionStart();
>-        ASSERT(selectionStart <= element()->selectionEnd());
>-        int selectionCodeUnitCount = element()->selectionEnd() - selectionStart;
>+    if (element().focused()) {
>+        ASSERT(enclosingTextFormControl(element().document().frame()->selection().selection().start()) == elementPtr());
>+        int selectionStart = element().selectionStart();
>+        ASSERT(selectionStart <= element().selectionEnd());
>+        int selectionCodeUnitCount = element().selectionEnd() - selectionStart;
>         selectionLength = selectionCodeUnitCount ? numGraphemeClusters(StringView(innerText).substring(selectionStart, selectionCodeUnitCount)) : 0;
>     }
>     ASSERT(oldLength >= selectionLength);
> 
>     // Selected characters will be removed by the next text event.
>     unsigned baseLength = oldLength - selectionLength;
>-    unsigned maxLength = isTextType() ? element()->effectiveMaxLength() : HTMLInputElement::maxEffectiveLength;
>+    unsigned maxLength = isTextType() ? element().effectiveMaxLength() : HTMLInputElement::maxEffectiveLength;
>     unsigned appendableLength = maxLength > baseLength ? maxLength - baseLength : 0;
> 
>     // Truncate the inserted text to avoid violating the maxLength and other constraints.
>@@ -571,8 +554,7 @@ void TextFieldInputType::updatePlaceholderText()
> {
>     if (!supportsPlaceholder())
>         return;
>-    ASSERT(element());
>-    String placeholderText = element()->strippedPlaceholder();
>+    String placeholderText = element().strippedPlaceholder();
>     if (placeholderText.isEmpty()) {
>         if (m_placeholder) {
>             m_placeholder->parentNode()->removeChild(*m_placeholder);
>@@ -581,8 +563,8 @@ void TextFieldInputType::updatePlaceholderText()
>         return;
>     }
>     if (!m_placeholder) {
>-        m_placeholder = TextControlPlaceholderElement::create(element()->document());
>-        element()->userAgentShadowRoot()->insertBefore(*m_placeholder, m_container ? m_container.get() : innerTextElement().get());
>+        m_placeholder = TextControlPlaceholderElement::create(element().document());
>+        element().userAgentShadowRoot()->insertBefore(*m_placeholder, m_container ? m_container.get() : innerTextElement().get());
>     }
>     m_placeholder->setInnerText(placeholderText);
> }
>@@ -590,10 +572,9 @@ void TextFieldInputType::updatePlaceholderText()
> bool TextFieldInputType::appendFormData(DOMFormData& formData, bool multipart) const
> {
>     InputType::appendFormData(formData, multipart);
>-    ASSERT(element());
>-    auto& dirnameAttrValue = element()->attributeWithoutSynchronization(dirnameAttr);
>+    auto& dirnameAttrValue = element().attributeWithoutSynchronization(dirnameAttr);
>     if (!dirnameAttrValue.isNull())
>-        formData.append(dirnameAttrValue, element()->directionForFormData());
>+        formData.append(dirnameAttrValue, element().directionForFormData());
>     return true;
> }
> 
>@@ -604,8 +585,7 @@ String TextFieldInputType::convertFromVisibleValue(const String& visibleValue) c
> 
> void TextFieldInputType::subtreeHasChanged()
> {
>-    ASSERT(element());
>-    element()->setChangedSinceLastFormControlChangeEvent(true);
>+    element().setChangedSinceLastFormControlChangeEvent(true);
> 
>     // We don't need to call sanitizeUserInputValue() function here because
>     // HTMLInputElement::handleBeforeTextInsertedEvent() has already called
>@@ -617,26 +597,25 @@ void TextFieldInputType::subtreeHasChanged()
>     // user input in order to retain parity between what's in the model and
>     // what's on the screen. Otherwise, we retain the sanitization process for
>     // backward compatibility. https://bugs.webkit.org/show_bug.cgi?id=150346
>-    String innerText = convertFromVisibleValue(element()->innerTextValue());
>+    String innerText = convertFromVisibleValue(element().innerTextValue());
>     if (!supportsSelectionAPI())
>         innerText = sanitizeValue(innerText);
>-    element()->setValueFromRenderer(innerText);
>-    element()->updatePlaceholderVisibility();
>+    element().setValueFromRenderer(innerText);
>+    element().updatePlaceholderVisibility();
>     // Recalc for :invalid change.
>-    element()->invalidateStyleForSubtree();
>+    element().invalidateStyleForSubtree();
> 
>     didSetValueByUserEdit();
> }
> 
> void TextFieldInputType::didSetValueByUserEdit()
> {
>-    ASSERT(element());
>-    if (!element()->focused())
>+    if (!element().focused())
>         return;
>-    if (RefPtr<Frame> frame = element()->document().frame())
>-        frame->editor().textDidChangeInTextField(element());
>+    if (RefPtr<Frame> frame = element().document().frame())
>+        frame->editor().textDidChangeInTextField(elementPtr());
> #if ENABLE(DATALIST_ELEMENT)
>-    if (element()->list())
>+    if (element().list())
>         displaySuggestions(DataListSuggestionActivationType::TextChanged);
> #endif
> }
>@@ -653,45 +632,40 @@ void TextFieldInputType::spinButtonStepUp()
> 
> void TextFieldInputType::updateInnerTextValue()
> {
>-    ASSERT(element());
>-    if (!element()->formControlValueMatchesRenderer()) {
>+    if (!element().formControlValueMatchesRenderer()) {
>         // Update the renderer value if the formControlValueMatchesRenderer() flag is false.
>         // It protects an unacceptable renderer value from being overwritten with the DOM value.
>-        element()->setInnerTextValue(visibleValue());
>-        element()->updatePlaceholderVisibility();
>+        element().setInnerTextValue(visibleValue());
>+        element().updatePlaceholderVisibility();
>     }
> }
> 
> void TextFieldInputType::focusAndSelectSpinButtonOwner()
> {
>-    ASSERT(element());
>-    Ref<HTMLInputElement> input(*element());
>+    Ref<HTMLInputElement> input(element());
>     input->focus();
>     input->select();
> }
> 
> bool TextFieldInputType::shouldSpinButtonRespondToMouseEvents()
> {
>-    ASSERT(element());
>-    return !element()->isDisabledOrReadOnly();
>+    return !element().isDisabledOrReadOnly();
> }
> 
> bool TextFieldInputType::shouldSpinButtonRespondToWheelEvents()
> {
>-    ASSERT(element());
>-    return shouldSpinButtonRespondToMouseEvents() && element()->focused();
>+    return shouldSpinButtonRespondToMouseEvents() && element().focused();
> }
> 
> bool TextFieldInputType::shouldDrawCapsLockIndicator() const
> {
>-    ASSERT(element());
>-    if (element()->document().focusedElement() != element())
>+    if (element().document().focusedElement() != elementPtr())
>         return false;
> 
>-    if (element()->isDisabledOrReadOnly())
>+    if (element().isDisabledOrReadOnly())
>         return false;
> 
>-    RefPtr<Frame> frame = element()->document().frame();
>+    RefPtr<Frame> frame = element().document().frame();
>     if (!frame)
>         return false;
> 
>@@ -712,33 +686,30 @@ void TextFieldInputType::capsLockStateMayHaveChanged()
> 
> bool TextFieldInputType::shouldDrawAutoFillButton() const
> {
>-    ASSERT(element());
>-    return !element()->isDisabledOrReadOnly() && element()->autoFillButtonType() != AutoFillButtonType::None;
>+    return !element().isDisabledOrReadOnly() && element().autoFillButtonType() != AutoFillButtonType::None;
> }
> 
> void TextFieldInputType::autoFillButtonElementWasClicked()
> {
>-    ASSERT(element());
>-    Page* page = element()->document().page();
>+    Page* page = element().document().page();
>     if (!page)
>         return;
> 
>-    page->chrome().client().handleAutoFillButtonClick(*element());
>+    page->chrome().client().handleAutoFillButtonClick(element());
> }
> 
> void TextFieldInputType::createContainer()
> {
>     ASSERT(!m_container);
>-    ASSERT(element());
> 
>-    m_container = TextControlInnerContainer::create(element()->document());
>+    m_container = TextControlInnerContainer::create(element().document());
>     m_container->setPseudo(AtomicString("-webkit-textfield-decoration-container", AtomicString::ConstructFromLiteral));
> 
>-    m_innerBlock = TextControlInnerElement::create(element()->document());
>+    m_innerBlock = TextControlInnerElement::create(element().document());
>     m_innerBlock->appendChild(*m_innerText);
>     m_container->appendChild(*m_innerBlock);
> 
>-    element()->userAgentShadowRoot()->appendChild(*m_container);
>+    element().userAgentShadowRoot()->appendChild(*m_container);
> }
> 
> void TextFieldInputType::createAutoFillButton(AutoFillButtonType autoFillButtonType)
>@@ -748,8 +719,7 @@ void TextFieldInputType::createAutoFillButton(AutoFillButtonType autoFillButtonT
>     if (autoFillButtonType == AutoFillButtonType::None)
>         return;
> 
>-    ASSERT(element());
>-    m_autoFillButton = AutoFillButtonElement::create(element()->document(), *this);
>+    m_autoFillButton = AutoFillButtonElement::create(element().document(), *this);
>     m_autoFillButton->setPseudo(autoFillButtonTypeToAutoFillButtonPseudoClassName(autoFillButtonType));
>     m_autoFillButton->setAttributeWithoutSynchronization(roleAttr, AtomicString("button", AtomicString::ConstructFromLiteral));
>     m_autoFillButton->setAttributeWithoutSynchronization(aria_labelAttr, autoFillButtonTypeToAccessibilityLabel(autoFillButtonType));
>@@ -763,8 +733,7 @@ void TextFieldInputType::updateAutoFillButton()
>         if (!m_container)
>             createContainer();
> 
>-        ASSERT(element());
>-        AutoFillButtonType autoFillButtonType = element()->autoFillButtonType();
>+        AutoFillButtonType autoFillButtonType = element().autoFillButtonType();
>         if (!m_autoFillButton)
>             createAutoFillButton(autoFillButtonType);
> 
>@@ -787,23 +756,23 @@ void TextFieldInputType::updateAutoFillButton()
> 
> IntRect TextFieldInputType::elementRectInRootViewCoordinates() const
> {
>-    if (!element()->renderer())
>+    if (!element().renderer())
>         return IntRect();
>-    return element()->document().view()->contentsToRootView(element()->renderer()->absoluteBoundingBoxRect());
>+    return element().document().view()->contentsToRootView(element().renderer()->absoluteBoundingBoxRect());
> }
> 
> Vector<String> TextFieldInputType::suggestions() const
> {
>     Vector<String> suggestions;
> 
>-    if (auto dataList = element()->dataList()) {
>+    if (auto dataList = element().dataList()) {
>         Ref<HTMLCollection> options = dataList->options();
>         for (unsigned i = 0; auto* option = downcast<HTMLOptionElement>(options->item(i)); ++i) {
>-            if (!element()->isValidValue(option->value()))
>+            if (!element().isValidValue(option->value()))
>                 continue;
> 
>             String value = sanitizeValue(option->value());
>-            if (!suggestions.contains(value) && (element()->value().isEmpty() || value.containsIgnoringASCIICase(element()->value())))
>+            if (!suggestions.contains(value) && (element().value().isEmpty() || value.containsIgnoringASCIICase(element().value())))
>                 suggestions.append(value);
>         }
>     }
>@@ -813,7 +782,7 @@ Vector<String> TextFieldInputType::suggestions() const
> 
> void TextFieldInputType::didSelectDataListOption(const String& selectedOption)
> {
>-    element()->setValue(selectedOption, DispatchInputAndChangeEvent);
>+    element().setValue(selectedOption, DispatchInputAndChangeEvent);
> }
> 
> void TextFieldInputType::didCloseSuggestions()
>@@ -823,7 +792,7 @@ void TextFieldInputType::didCloseSuggestions()
> 
> void TextFieldInputType::displaySuggestions(DataListSuggestionActivationType type)
> {
>-    if (element()->isDisabledFormControl() || !element()->renderer())
>+    if (element().isDisabledFormControl() || !element().renderer())
>         return;
> 
>     if (!UserGestureIndicator::processingUserGesture())
>diff --git a/Source/WebCore/html/TimeInputType.cpp b/Source/WebCore/html/TimeInputType.cpp
>index 42c3911ede22bf127f9c2c9adaeed1de369e2577..edb44c2133dfa167fae3ba37e69dd61431aa3301 100644
>--- a/Source/WebCore/html/TimeInputType.cpp
>+++ b/Source/WebCore/html/TimeInputType.cpp
>@@ -77,11 +77,10 @@ Decimal TimeInputType::defaultValueForStepUp() const
> 
> StepRange TimeInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal stepBase = parseToNumber(element()->attributeWithoutSynchronization(minAttr), 0);
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumTime()));
>-    const Decimal maximum = parseToNumber(element()->attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumTime()));
>-    const Decimal step = StepRange::parseStep(anyStepHandling, timeStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal stepBase = parseToNumber(element().attributeWithoutSynchronization(minAttr), 0);
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumTime()));
>+    const Decimal maximum = parseToNumber(element().attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumTime()));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, timeStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(stepBase, RangeLimitations::Valid, minimum, maximum, step, timeStepDescription);
> }
> 
>diff --git a/Source/WebCore/html/URLInputType.cpp b/Source/WebCore/html/URLInputType.cpp
>index 6ca0ac1a2013cf6d5d8dc5c0ea03b211792f195e..1824a181568483dc7076d59116f9d462664c66b4 100644
>--- a/Source/WebCore/html/URLInputType.cpp
>+++ b/Source/WebCore/html/URLInputType.cpp
>@@ -52,8 +52,7 @@ bool URLInputType::typeMismatchFor(const String& value) const
> 
> bool URLInputType::typeMismatch() const
> {
>-    ASSERT(element());
>-    return typeMismatchFor(element()->value());
>+    return typeMismatchFor(element().value());
> }
> 
> String URLInputType::typeMismatchText() const
>diff --git a/Source/WebCore/html/WeekInputType.cpp b/Source/WebCore/html/WeekInputType.cpp
>index bcb6af2caad5e5f3bea9454a5103eb951cd43d62..9aff4f6fbda77d69f8a498c75e1a1ad0958960ea 100644
>--- a/Source/WebCore/html/WeekInputType.cpp
>+++ b/Source/WebCore/html/WeekInputType.cpp
>@@ -57,11 +57,10 @@ DateComponents::Type WeekInputType::dateType() const
> 
> StepRange WeekInputType::createStepRange(AnyStepHandling anyStepHandling) const
> {
>-    ASSERT(element());
>-    const Decimal stepBase = parseToNumber(element()->attributeWithoutSynchronization(minAttr), weekDefaultStepBase);
>-    const Decimal minimum = parseToNumber(element()->attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumWeek()));
>-    const Decimal maximum = parseToNumber(element()->attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumWeek()));
>-    const Decimal step = StepRange::parseStep(anyStepHandling, weekStepDescription, element()->attributeWithoutSynchronization(stepAttr));
>+    const Decimal stepBase = parseToNumber(element().attributeWithoutSynchronization(minAttr), weekDefaultStepBase);
>+    const Decimal minimum = parseToNumber(element().attributeWithoutSynchronization(minAttr), Decimal::fromDouble(DateComponents::minimumWeek()));
>+    const Decimal maximum = parseToNumber(element().attributeWithoutSynchronization(maxAttr), Decimal::fromDouble(DateComponents::maximumWeek()));
>+    const Decimal step = StepRange::parseStep(anyStepHandling, weekStepDescription, element().attributeWithoutSynchronization(stepAttr));
>     return StepRange(stepBase, RangeLimitations::Valid, minimum, maximum, step, weekStepDescription);
> }
>

Actions: View | Formatted Diff | Diff

Attachments on bug 186321: 346660 | 346667