Fix crash by adding a form control to an element.

This CL fixes a null pointer dereference in the following scenario:

1. A form control and a <form> element are associated by HTML parser, and the
  <form> is not an ancestor of the form control.
2. Their common ancestor is detached from the document.
3. GC happens. The <form> is collected and the form control survives.
4. The form control is added to an element.

Usually FormAssociatedElement::m_form is never null if
FormAssociatedElement::m_formWasSetByParser is true. However it can be null.
Blink r179263 [1] exposed this issue because we stopeed to support null Node
pointer in highestAncestorOrSelf()

[1] http://src.chromium.org/viewvc/blink?view=revision&revision=179263

BUG=403088

Review URL: https://codereview.chromium.org/481363002

git-svn-id: svn://svn.chromium.org/blink/trunk@180542 bbb929c8-8fbe-4397-9dbb-9b2b20218538