Avoid transiently creating disallowed elements when building <use> trees

Source/core/svg/SVGUseElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 355 matching lines @@
     ASSERT(!m_targetElementInstance);
 
     // <use> creates a "user agent" shadow root. Do not build the shadow/instance tree for <use>
     // elements living in a user agent shadow tree because they will get expanded in a second
     // pass -- see expandUseElementsInShadowTree().
     if (inUseShadowTree())
         return;
 
     // Do not allow self-referencing.
     // 'target' may be null, if it's a non SVG namespaced element.
-    if (!target || target == this)
+    if (!target || target == this || isDisallowedElement(target))
         return;
 
     // Set up root SVG element in shadow tree.
     RefPtrWillBeRawPtr<Element> newChild = target->cloneElementWithoutChildren();
     m_targetElementInstance = toSVGElement(newChild.get());
     ShadowRoot* shadowTreeRootElement = userAgentShadowRoot();
     shadowTreeRootElement->appendChild(newChild.release());
 
     // Clone the target subtree into the shadow tree, not handling <use> and <symbol> yet.
 
@@ skipping 375 matching lines @@
 
     if (m_resource)
         m_resource->removeClient(this);
 
     m_resource = resource;
     if (m_resource)
         m_resource->addClient(this);
 }
 
 }