Merge 106771

Source/WebCore/loader/FormSubmission.cpp

Index: Source/WebCore/loader/FormSubmission.cpp
===================================================================
--- Source/WebCore/loader/FormSubmission.cpp	(revision 107322)
+++ Source/WebCore/loader/FormSubmission.cpp	(working copy)
@@ -142,8 +142,11 @@
     ASSERT(form);
 
     HTMLFormControlElement* submitButton = 0;
-    if (event && event->target() && event->target()->toNode())
-        submitButton = static_cast<HTMLFormControlElement*>(event->target()->toNode());
+    if (event && event->target()) {
+        Node* node = event->target()->toNode();
+        if (node && node->isElementNode() && toElement(node)->isFormControlElement())
+            submitButton = static_cast<HTMLFormControlElement*>(node);
+    }
 
     FormSubmission::Attributes copiedAttributes;
     copiedAttributes.copyFrom(attributes);