Fix Range.createContextualFragment for non-Element contexts.

Source/core/editing/markup.cpp

Index: Source/core/editing/markup.cpp
diff --git a/Source/core/editing/markup.cpp b/Source/core/editing/markup.cpp
index c58d828319b0af89fd79888ccd56782f36902319..d8e112b1d5a3c9c98286c49c94b720cf10a9bcc1 100644
--- a/Source/core/editing/markup.cpp
+++ b/Source/core/editing/markup.cpp
@@ -975,13 +975,16 @@ static inline void removeElementPreservingChildren(PassRefPtrWillBeRawPtr<Docume
     fragment->removeChild(element);
 }
 
-PassRefPtrWillBeRawPtr<DocumentFragment> createContextualFragment(const String& markup, HTMLElement* element, ParserContentPolicy parserContentPolicy, ExceptionState& exceptionState)
+PassRefPtrWillBeRawPtr<DocumentFragment> createContextualFragment(const String& markup, Element* element, ParserContentPolicy parserContentPolicy, ExceptionState& exceptionState)
 {
     ASSERT(element);
-    if (element->ieForbidsInsertHTML() || element->hasLocalName(colTag) || element->hasLocalName(colgroupTag) || element->hasLocalName(framesetTag)
-        || element->hasLocalName(headTag) || element->hasLocalName(styleTag) || element->hasLocalName(titleTag)) {
-        exceptionState.throwDOMException(NotSupportedError, "The range's container is '" + element->localName() + "', which is not supported.");
-        return nullptr;
+    if (element->isHTMLElement()) {
+        HTMLElement* htmlElement = toHTMLElement(element);
+        if (htmlElement->ieForbidsInsertHTML() || htmlElement->hasLocalName(colTag) || htmlElement->hasLocalName(colgroupTag) || htmlElement->hasLocalName(framesetTag)

[eseidel, 2014/06/02 16:51:28]

I probably would have pulled this into a little helper function, but this is
also OK.

static bool isSupportedContainer(Element* element) {
  if (!element->isHTMLElement())
      return true;

   if () // long cascade of hasLocalName checks.

   // finall cast to HTMLElement and check ieForbidsInsertHTML.
}

[pwnall-personal, 2014/06/03 00:09:01]

Done. Thank you!

+            || htmlElement->hasLocalName(headTag) || htmlElement->hasLocalName(styleTag) || htmlElement->hasLocalName(titleTag)) {
+            exceptionState.throwDOMException(NotSupportedError, "The range's container is '" + htmlElement->localName() + "', which is not supported.");
+            return nullptr;
+        }
     }
 
     RefPtrWillBeRawPtr<DocumentFragment> fragment = createFragmentForInnerOuterHTML(markup, element, parserContentPolicy, "createContextualFragment", exceptionState);