Need to check if some HTML child elements are HTMLUnknownElement

Based on upstream fix http://trac.webkit.org/changeset/156953

The check for whether an element is an HTMLAudioElement or not was
incomplete. An element can have the 'audio' tag-name but still be
another element if media elements have been disabled. In this
case it will be an HTMLUnknownElement.

Task-number: QTBUG-41360
Change-Id: I6a3e366b9dc268b0dbebe5880ba68945bcb42a27
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

2 files changed, 15 insertions, 3 deletions

diff --git a/Source/WebCore/html/HTMLAudioElement.h b/Source/WebCore/html/HTMLAudioElement.h
index 07ca48dd4..0d2483668 100644
--- a/Source/WebCore/html/HTMLAudioElement.h
+++ b/Source/WebCore/html/HTMLAudioElement.h
@@ -43,14 +43,19 @@ private:
     HTMLAudioElement(const QualifiedName&, Document*, bool);
 };
 
-inline bool isHTMLAudioElement(Node* node)
+inline bool isHTMLAudioElement(HTMLElement* element)
 {
-    return node->hasTagName(HTMLNames::audioTag);
+    return !element->isHTMLUnknownElement() && element->hasTagName(HTMLNames::audioTag);
 }
 
 inline bool isHTMLAudioElement(Element* element)
 {
-    return element->hasTagName(HTMLNames::audioTag);
+    return element->isHTMLElement() && isHTMLAudioElement(toHTMLElement(element));
+}
+
+inline bool isHTMLAudioElement(Node* node)
+{
+    return node->isHTMLElement() && isHTMLAudioElement(toHTMLElement(node));
 }
 
 inline HTMLAudioElement* toHTMLAudioElement(Node* node)
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 8ef0348ab..fc8578e57 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -2379,6 +2379,13 @@ double HTMLMediaElement::duration() const
 
 bool HTMLMediaElement::paused() const
 {
+    // As of this writing, JavaScript garbage collection calls this function directly. In the past
+    // we had problems where this was called on an object after a bad cast. The assertion below
+    // made our regression test detect the problem, so we should keep it because of that. But note
+    // that the value of the assertion relies on the compiler not being smart enough to know that
+    // isHTMLUnknownElement is guaranteed to return false for an HTMLMediaElement.
+    ASSERT(!isHTMLUnknownElement());
+
     return m_paused;
 }