Fix Range.createContextualFragment for non-Element contexts.

Source/core/editing/markup.cpp

Index: Source/core/editing/markup.cpp
diff --git a/Source/core/editing/markup.cpp b/Source/core/editing/markup.cpp
index c58d828319b0af89fd79888ccd56782f36902319..7477a73e0c0aa7ff3b8e403ec8df3e2e554fa2cf 100644
--- a/Source/core/editing/markup.cpp
+++ b/Source/core/editing/markup.cpp
@@ -975,11 +975,23 @@ static inline void removeElementPreservingChildren(PassRefPtrWillBeRawPtr<Docume
     fragment->removeChild(element);
 }
 
-PassRefPtrWillBeRawPtr<DocumentFragment> createContextualFragment(const String& markup, HTMLElement* element, ParserContentPolicy parserContentPolicy, ExceptionState& exceptionState)
+static inline bool isSupportedContainer(Element* element)
 {
     ASSERT(element);
-    if (element->ieForbidsInsertHTML() || element->hasLocalName(colTag) || element->hasLocalName(colgroupTag) || element->hasLocalName(framesetTag)
+    if (!element->isHTMLElement())
+        return true;
+
+    if (element->hasLocalName(colTag) || element->hasLocalName(colgroupTag) || element->hasLocalName(framesetTag)
         || element->hasLocalName(headTag) || element->hasLocalName(styleTag) || element->hasLocalName(titleTag)) {
+        return false;
+    }
+    return !toHTMLElement(element)->ieForbidsInsertHTML();
+}
+
+PassRefPtrWillBeRawPtr<DocumentFragment> createContextualFragment(const String& markup, Element* element, ParserContentPolicy parserContentPolicy, ExceptionState& exceptionState)
+{
+    ASSERT(element);
+    if (!isSupportedContainer(element)) {
         exceptionState.throwDOMException(NotSupportedError, "The range's container is '" + element->localName() + "', which is not supported.");
         return nullptr;
     }