Only allow path as target for mpath

Source/core/svg/SVGMPathElement.cpp

 /*
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 44 matching lines @@
     Element* target = SVGURIReference::targetElementFromIRIString(hrefString(), treeScope(), &id);
     if (!target) {
         // Do not register as pending if we are already pending this resource.
         if (document().accessSVGExtensions().isElementPendingResource(this, id))
             return;
 
         if (!id.isEmpty()) {
             document().accessSVGExtensions().addPendingResource(id, this);
             ASSERT(hasPendingResources());
         }
-    } else if (target->isSVGElement()) {
+    } else if (isSVGPathElement(target)) {
         // Register us with the target in the dependencies map. Any change of hrefElement
         // that leads to relayout/repainting now informs us, so we can react to it.
         addReferenceTo(toSVGElement(target));
     }
 
     targetPathChanged();
 }
 
 void SVGMPathElement::clearResourceReferences()
 {
@@ skipping 67 matching lines @@
     notifyParentOfPathChange(parentNode());
 }
 
 void SVGMPathElement::notifyParentOfPathChange(ContainerNode* parent)
 {
     if (isSVGAnimateMotionElement(parent))
         toSVGAnimateMotionElement(parent)->updateAnimationPath();
 }
 
 } // namespace blink