Merge 145013

Source/WebCore/svg/SVGViewSpec.cpp

 /*
  * Copyright (C) 2007, 2010 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 124 matching lines @@
 
 String SVGViewSpec::preserveAspectRatioString() const
 {
     return SVGPropertyTraits<SVGPreserveAspectRatio>::toString(preserveAspectRatioBaseValue());
 }
 
 SVGElement* SVGViewSpec::viewTarget() const
 {
     if (!m_contextElement)
         return 0;
-    return static_cast<SVGElement*>(m_contextElement->treeScope()->getElementById(m_viewTargetString));
+    Element* element = m_contextElement->treeScope()->getElementById(m_viewTargetString);
+    if (!element || !element->isSVGElement())
+        return 0;
+    return static_cast<SVGElement*>(element);
 }
 
 SVGTransformListPropertyTearOff* SVGViewSpec::transform()
 {
     if (!m_contextElement)
         return 0;
     // Return the animVal here, as its readonly by default - which is exactly what we want here.
     return static_cast<SVGTransformListPropertyTearOff*>(static_pointer_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
 }
 
@@ skipping 134 matching lines @@
     
     if (currViewSpec >= end || *currViewSpec != ')')
         return false;
 
     return true;
 }
 
 }
 
 #endif // ENABLE(SVG)