WebVTT only allows <rt> if the currently innermost node is <ruby>

Source/core/html/track/vtt/VTTParser.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 524 matching lines @@
 {
     // http://dev.w3.org/html5/webvtt/#webvtt-cue-text-dom-construction-rules
 
     switch (m_token.type()) {
     case VTTTokenTypes::Character: {
         RefPtr<Text> child = Text::create(document, m_token.characters());
         m_currentNode->parserAppendChild(child);
         break;
     }
     case VTTTokenTypes::StartTag: {
-        RefPtr<VTTElement> child;
         VTTNodeType nodeType = tokenToNodeType(m_token);
-        if (nodeType != VTTNodeTypeNone)
-            child = VTTElement::create(nodeType, &document);
-        if (child) {
-            if (!m_token.classes().isEmpty())
-                child->setAttribute(classAttr, m_token.classes());
+        if (nodeType == VTTNodeTypeNone)
+            break;
 
-            if (child->webVTTNodeType() == VTTNodeTypeVoice) {
-                child->setAttribute(VTTElement::voiceAttributeName(), m_token.annotation());
-            } else if (child->webVTTNodeType() == VTTNodeTypeLanguage) {
-                m_languageStack.append(m_token.annotation());
-                child->setAttribute(VTTElement::langAttributeName(), m_languageStack.last());
-            }
-            if (!m_languageStack.isEmpty())
-                child->setLanguage(m_languageStack.last());
-            m_currentNode->parserAppendChild(child);
-            m_currentNode = child;
+        VTTNodeType currentType = m_currentNode->isVTTElement() ? toVTTElement(m_currentNode.get())->webVTTNodeType() : VTTNodeTypeNone;
+        // <rt> is only allowed if the current node is <ruby>.
+        if (nodeType == VTTNodeTypeRubyText && currentType != VTTNodeTypeRuby)
+            break;
+
+        RefPtr<VTTElement> child = VTTElement::create(nodeType, &document);
+        if (!m_token.classes().isEmpty())
+            child->setAttribute(classAttr, m_token.classes());
+
+        if (nodeType == VTTNodeTypeVoice) {
+            child->setAttribute(VTTElement::voiceAttributeName(), m_token.annotation());
+        } else if (nodeType == VTTNodeTypeLanguage) {
+            m_languageStack.append(m_token.annotation());
+            child->setAttribute(VTTElement::langAttributeName(), m_languageStack.last());
         }
+        if (!m_languageStack.isEmpty())
+            child->setLanguage(m_languageStack.last());
+        m_currentNode->parserAppendChild(child);
+        m_currentNode = child;
         break;
     }
     case VTTTokenTypes::EndTag: {
         VTTNodeType nodeType = tokenToNodeType(m_token);
         if (nodeType == VTTNodeTypeNone)
             break;
 
         // The only non-VTTElement would be the DocumentFragment root. (Text
         // nodes and PIs will never appear as m_currentNode.)
         if (!m_currentNode->isVTTElement())
@@ skipping 30 matching lines @@
 }
 
 void VTTParser::skipWhiteSpace(const String& line, unsigned* position)
 {
     while (*position < line.length() && isASpace(line[*position]))
         (*position)++;
 }
 
 }