Fix bug: https://bugs.webkit.org/show_bug.cgi?id=21032
        <rdar://problem/6243032>

        Reviewed by Dave Hyatt.

        Test: fast/dom/attribute-downcast-right.html

        Add isMappedAttribute function to Attribute for checking if an object
        is an instance of MappedAttribute. Removed attributeItem,
        getAttributeItem functions from NamedMappedAttrMap, and callers
        expecting MappedAttribute have to check isMappedAttribute before
        downcasting the return value to MappedAttribute.

        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::styleForElement):
        * dom/Attribute.h:
        (WebCore::Attribute::isMappedAttribute):
        * dom/MappedAttribute.h:
        (WebCore::MappedAttribute::isMappedAttribute):
        * dom/NamedMappedAttrMap.cpp:
        (WebCore::NamedMappedAttrMap::declCount):
        (WebCore::NamedMappedAttrMap::mapsEquivalent):
        * dom/NamedMappedAttrMap.h:
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::attributeChanged):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setInputType):
        * svg/SVGForeignObjectElement.cpp:
        (WebCore::addCSSPropertyAndNotifyAttributeMap):
        * svg/SVGStyledElement.cpp:
        (WebCore::SVGStyledElement::getPresentationAttribute):

LayoutTests:

        Test for: https://bugs.webkit.org/show_bug.cgi?id=21032
        <rdar://problem/6243032>

        Reviewed by Dave Hyatt.

        The test crashes webkit if using Windows heap allocator.

        * fast/dom/attribute-downcast-right-expected.txt: Added.
        * fast/dom/attribute-downcast-right.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@36918 268f45cc-cd09-0410-ab3c-d52691b4dbfc