| Index: Source/core/dom/ContainerNode.cpp
|
| diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
|
| index 16fc8bbcc342218fdf62f180eb325aa58ee22ec4..1a262c6e33b69273817bfa6d08822030f05932e6 100644
|
| --- a/Source/core/dom/ContainerNode.cpp
|
| +++ b/Source/core/dom/ContainerNode.cpp
|
| @@ -108,7 +108,7 @@ bool ContainerNode::isChildTypeAllowed(const Node& child) const
|
| if (!child.isDocumentFragment())
|
| return childTypeAllowed(child.nodeType());
|
|
|
| - for (Node* node = child.firstChild(); node; node = node->nextSibling()) {
|
| + for (Node* node = toDocumentFragment(child).firstChild(); node; node = node->nextSibling()) {
|
| if (!childTypeAllowed(node->nodeType()))
|
| return false;
|
| }
|
|
|