Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit

Hold a reference to firstSuccessfulSubmitButton in HTMLFormElement::submit
<http://webkit.org/b/130713>
<rdar://problem/15661876>

Reviewed by Darin Adler.

Merged from Blink (patch by Ian Beer):
http://crbug.com/303657
https://src.chromium.org/viewvc/blink?view=rev&revision=158938

Source/WebCore:

Test: fast/forms/form-submission-crash-successful-submit-button.html

* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::submit):

LayoutTests:

* fast/forms/form-submission-crash-successful-submit-button-expected.txt: Added.
* fast/forms/form-submission-crash-successful-submit-button.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@166236 268f45cc-cd09-0410-ab3c-d52691b4dbfc