Merge 115763

Source/WebCore/html/parser/HTMLElementStack.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 368 matching lines @@
 }
 
 HTMLElementStack::ElementRecord* HTMLElementStack::topRecord() const
 {
     ASSERT(m_top);
     return m_top.get();
 }
 
 Element* HTMLElementStack::oneBelowTop() const
 {
-    // We should never be calling this if it could be 0.
+    // We should never call this if there are fewer than 2 elements on the stack.
     ASSERT(m_top);
     ASSERT(m_top->next());
-    return m_top->next()->element();
+    if (m_top->next()->node()->isElementNode())
+        return m_top->next()->element();
+    return 0;
 }
 
 Element* HTMLElementStack::bottom() const
 {
     return htmlElement();
 }
 
 void HTMLElementStack::removeHTMLHeadElement(Element* element)
 {
     ASSERT(m_headElement == element);
@@ skipping 216 matching lines @@
 
 void HTMLElementStack::show()
 {
     for (ElementRecord* record = m_top.get(); record; record = record->next())
         record->element()->showNode();
 }
 
 #endif
 
 }