Adopt dynamicDowncast<>() more in html/

https://bugs.webkit.org/show_bug.cgi?id=265174

Reviewed by Jean-Yves Avenard and Tim Nguyen.

* Source/WebCore/html/HTMLElement.h:
(WebCore::Node::hasTagName const):
(isType):
* Source/WebCore/html/HTMLEmbedElement.cpp:
(WebCore::findWidgetRenderer):
(WebCore::HTMLEmbedElement::rendererIsNeeded):
* Source/WebCore/html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::autofillMantle const):
* Source/WebCore/html/HTMLFormControlElement.h:
(isType):
* Source/WebCore/html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::submitImplicitly):
(WebCore::HTMLFormElement::textFieldValues const):
(WebCore::HTMLFormElement::findSubmitButton):
(WebCore::HTMLFormElement::registerFormListedElement):
(WebCore::HTMLFormElement::findSubmitter const):
(WebCore::HTMLFormElement::defaultButton const):
(WebCore::HTMLFormElement::constructEntryList):
* Source/WebCore/html/HTMLFrameElementBase.h:
(isType):
* Source/WebCore/html/HTMLFrameOwnerElement.cpp:
(WebCore::HTMLFrameOwnerElement::renderWidget const):
* Source/WebCore/html/HTMLFrameSetElement.cpp:
(WebCore::HTMLFrameSetElement::namedItem):
* Source/WebCore/html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):
(WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
(WebCore::HTMLImageElement::attributeChanged):
(WebCore::HTMLImageElement::didAttachRenderers):
(WebCore::HTMLImageElement::insertedIntoAncestor):
(WebCore::HTMLImageElement::isSystemPreviewImage const):
(WebCore::HTMLImageElement::cloneElementWithoutAttributesAndChildren):
* Source/WebCore/html/HTMLImageLoader.cpp:
(WebCore::HTMLImageLoader::notifyFinished):
* Source/WebCore/html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::willDispatchEvent):
* Source/WebCore/html/HTMLLIElement.cpp:
(WebCore::HTMLLIElement::didAttachRenderers):
* Source/WebCore/html/HTMLLabelElement.cpp:
(WebCore::HTMLLabelElement::isEventTargetedAtInteractiveDescendants const):
(WebCore::HTMLLabelElement::defaultEventHandler):
* Source/WebCore/html/HTMLLegendElement.cpp:
(WebCore::HTMLLegendElement::form const):
* Source/WebCore/html/HTMLMaybeFormAssociatedCustomElement.h:
(isType):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::bestMediaElementForRemoteControls):
(WebCore::HTMLMediaElement::updateActiveTextTrackCues):
(WebCore::HTMLMediaElement::textTrackRemoveCue):
(WebCore::HTMLMediaElement::setReadyState):
(WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
(WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
(WebCore::HTMLMediaElement::enterFullscreen):
(WebCore::HTMLMediaElement::exitFullscreen):
(WebCore::HTMLMediaElement::willBecomeFullscreenElement):
(WebCore::HTMLMediaElement::mediaState const):
(WebCore::HTMLMediaElement::isVideoTooSmallForInlinePlayback):
* Source/WebCore/html/HTMLMediaElement.h:
(isType):
* Source/WebCore/html/HTMLMeterElement.cpp:
(WebCore::HTMLMeterElement::renderMeter const):
* Source/WebCore/html/HTMLNameCollection.cpp:
(WebCore::isObjectElementForDocumentNameCollection):
* Source/WebCore/html/HTMLObjectElement.cpp:
(WebCore::preventsParentObjectFromExposure):
(WebCore::HTMLObjectElement::updateExposedState):
* Source/WebCore/html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::ownerSelectElement const):
(WebCore::HTMLOptionElement::isDisabledFormControl const):
(WebCore::HTMLOptionElement::collectOptionInnerText const):
* Source/WebCore/html/HTMLPictureElement.cpp:
(WebCore::HTMLPictureElement::isSystemPreviewImage):
* Source/WebCore/html/HTMLPlugInElement.cpp:
(WebCore::HTMLPlugInElement::defaultEventHandler):
(WebCore::HTMLPlugInElement::supportsFocus const):
(WebCore::HTMLPlugInElement::setReplacement):
(WebCore::HTMLPlugInElement::isReplacementObscured):
* Source/WebCore/html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::didAttachRenderers):
* Source/WebCore/html/HTMLPlugInImageElement.h:
(isType):
* Source/WebCore/html/HTMLProgressElement.cpp:
(WebCore::HTMLProgressElement::renderProgress const):
* Source/WebCore/html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::optionToSelectFromChildChangeScope):
(WebCore::HTMLSelectElement::setLength):
(WebCore::HTMLSelectElement::nextSelectableListIndexPageAway const):
(WebCore::HTMLSelectElement::saveLastSelection):
(WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
(WebCore::HTMLSelectElement::updateListBoxSelection):
(WebCore::HTMLSelectElement::listBoxOnChange):
(WebCore::HTMLSelectElement::scrollToSelection):
(WebCore::HTMLSelectElement::setOptionsChangedOnRenderer):
(WebCore::HTMLSelectElement::recalcListItems const):
(WebCore::HTMLSelectElement::selectedIndex const):
(WebCore::HTMLSelectElement::selectOption):
(WebCore::HTMLSelectElement::deselectItemsWithoutValidation):
(WebCore::HTMLSelectElement::saveFormControlState const):
(WebCore::HTMLSelectElement::searchOptionsForValue const):
(WebCore::HTMLSelectElement::restoreFormControlState):
(WebCore::HTMLSelectElement::appendFormData):
(WebCore::HTMLSelectElement::reset):
(WebCore::HTMLSelectElement::platformHandleKeydownEvent):
(WebCore::HTMLSelectElement::menuListDefaultEventHandler):
(WebCore::HTMLSelectElement::updateSelectedState):
(WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
(WebCore::HTMLSelectElement::defaultEventHandler):
(WebCore::HTMLSelectElement::lastSelectedListIndex const):
(WebCore::HTMLSelectElement::optionAtIndex const):
(WebCore::HTMLSelectElement::accessKeySetSelectedIndex):

Canonical link: https://commits.webkit.org/271033@main

Source/WebCore/html/HTMLElement.h

@@ -227,14 +227,19 @@ inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document& document
 
 inline bool Node::hasTagName(const HTMLQualifiedName& name) const
 {
-    return is<HTMLElement>(*this) && downcast<HTMLElement>(*this).hasTagName(name);
+    auto* htmlElement = dynamicDowncast<HTMLElement>(*this);
+    return htmlElement && htmlElement->hasTagName(name);
 }
 
 } // namespace WebCore
 
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::HTMLElement)
     static bool isType(const WebCore::Node& node) { return node.isHTMLElement(); }
-    static bool isType(const WebCore::EventTarget& target) { return is<WebCore::Node>(target) && isType(downcast<WebCore::Node>(target)); }
+    static bool isType(const WebCore::EventTarget& target)
+    {
+        auto* node = dynamicDowncast<WebCore::Node>(target);
+        return node && isType(*node);
+    }
 SPECIALIZE_TYPE_TRAITS_END()
 
 #include "HTMLElementTypeHelpers.h"

Source/WebCore/html/HTMLEmbedElement.cpp

@@ -67,8 +67,8 @@ static inline RenderWidget* findWidgetRenderer(const Node* node)
 {
     if (!node->renderer())
         node = ancestorsOfType<HTMLObjectElement>(*node).first();
-    if (node && is<RenderWidget>(node->renderer()))
-        return downcast<RenderWidget>(node->renderer());
+    if (node)
+        return dynamicDowncast<RenderWidget>(node->renderer());
     return nullptr;
 }
 
@@ -190,12 +190,11 @@ bool HTMLEmbedElement::rendererIsNeeded(const RenderStyle& style)
 
     // If my parent is an <object> and is not set to use fallback content, I
     // should be ignored and not get a renderer.
-    RefPtr<ContainerNode> parent = parentNode();
-    if (is<HTMLObjectElement>(parent)) {
-        if (!parent->renderer())
+    if (RefPtr parentObject = dynamicDowncast<HTMLObjectElement>(parentNode())) {
+        if (!parentObject->renderer())
             return false;
-        if (!downcast<HTMLObjectElement>(*parent).useFallbackContent()) {
-            ASSERT(!parent->renderer()->isRenderEmbeddedObject());
+        if (!parentObject->useFallbackContent()) {
+            ASSERT(!parentObject->renderer()->isRenderEmbeddedObject());
             return false;
         }
     }

Source/WebCore/html/HTMLFormControlElement.cpp

@@ -306,7 +306,8 @@ void HTMLFormControlElement::setAutocomplete(const AtomString& value)
 
 AutofillMantle HTMLFormControlElement::autofillMantle() const
 {
-    return is<HTMLInputElement>(*this) && downcast<HTMLInputElement>(this)->isInputTypeHidden() ? AutofillMantle::Anchor : AutofillMantle::Expectation;
+    auto* input = dynamicDowncast<HTMLInputElement>(this);
+    return input && input->isInputTypeHidden() ? AutofillMantle::Anchor : AutofillMantle::Expectation;
 }
 
 AutofillData HTMLFormControlElement::autofillData() const

Source/WebCore/html/HTMLFormControlElement.h

@@ -157,6 +157,10 @@ class HTMLFormControlElement : public HTMLElement, public ValidatedFormListedEle
 
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::HTMLFormControlElement)
     static bool isType(const WebCore::Element& element) { return element.isFormControlElement(); }
-    static bool isType(const WebCore::Node& node) { return is<WebCore::Element>(node) && isType(downcast<WebCore::Element>(node)); }
+    static bool isType(const WebCore::Node& node)
+    {
+        auto* element = dynamicDowncast<WebCore::Element>(node);
+        return element && isType(*element);
+    }
     static bool isType(const WebCore::FormListedElement& element) { return element.isFormControlElement(); }
 SPECIALIZE_TYPE_TRAITS_END()

Source/WebCore/html/HTMLFormElement.cpp

@@ -195,13 +195,14 @@ void HTMLFormElement::submitImplicitly(Event& event, bool fromImplicitSubmission
 {
     unsigned submissionTriggerCount = 0;
     for (auto& listedElement : m_listedElements) {
-        if (!is<HTMLFormControlElement>(*listedElement))
+        auto* formElement = dynamicDowncast<HTMLFormControlElement>(*listedElement);
+        if (!formElement)
             continue;
-        HTMLFormControlElement& formElement = downcast<HTMLFormControlElement>(*listedElement);
-        if (formElement.isSuccessfulSubmitButton()) {
-            formElement.dispatchSimulatedClick(&event);
+        if (formElement->isSuccessfulSubmitButton()) {
+            formElement->dispatchSimulatedClick(&event);
             return;
-        } else if (formElement.canTriggerImplicitSubmission())
+        }
+        if (formElement->canTriggerImplicitSubmission())
             ++submissionTriggerCount;
     }
 
@@ -338,13 +339,10 @@ ExceptionOr<void> HTMLFormElement::requestSubmit(HTMLElement* submitter)
 StringPairVector HTMLFormElement::textFieldValues() const
 {
     return WTF::compactMap(m_listedElements, [](auto& weakElement) -> std::optional<std::pair<String, String>> {
-        RefPtr element { weakElement.get() };
-        if (!is<HTMLInputElement>(element))
+        RefPtr input = dynamicDowncast<HTMLInputElement>(weakElement.get());
+        if (!input || !input->isTextField())
             return std::nullopt;
-        auto& input = downcast<HTMLInputElement>(*element);
-        if (!input.isTextField())
-            return std::nullopt;
-        return std::pair { input.name().string(), input.value() };
+        return std::pair { input->name().string(), input->value() };
     });
 }
 
@@ -356,13 +354,13 @@ RefPtr<HTMLFormControlElement> HTMLFormElement::findSubmitButton(HTMLFormControl
         return nullptr;
     RefPtr<HTMLFormControlElement> firstSuccessfulSubmitButton;
     for (auto& listedElement : m_listedElements) {
-        if (!is<HTMLFormControlElement>(*listedElement))
+        auto* control = dynamicDowncast<HTMLFormControlElement>(*listedElement);
+        if (!control)
             continue;
-        auto& control = downcast<HTMLFormControlElement>(*listedElement);
-        if (control.isActivatedSubmit())
+        if (control->isActivatedSubmit())
             return nullptr;
-        if (!firstSuccessfulSubmitButton && control.isSuccessfulSubmitButton())
-            firstSuccessfulSubmitButton = &control;
+        if (!firstSuccessfulSubmitButton && control->isSuccessfulSubmitButton())
+            firstSuccessfulSubmitButton = control;
     }
     return firstSuccessfulSubmitButton;
 }
@@ -590,15 +588,12 @@ void HTMLFormElement::registerFormListedElement(FormListedElement& element)
 {
     m_listedElements.insert(formElementIndex(element), element.asHTMLElement());
 
-    if (!is<HTMLFormControlElement>(element))
-        return;
-
-    auto& control = downcast<HTMLFormControlElement>(element);
-    if (!control.isSuccessfulSubmitButton())
+    auto* control = dynamicDowncast<HTMLFormControlElement>(element);
+    if (!control || !control->isSuccessfulSubmitButton())
         return;
 
     if (!m_defaultButton)
-        control.invalidateStyleForSubtree();
+        control->invalidateStyleForSubtree();
     else
         resetDefaultButton();
 }
@@ -748,10 +743,14 @@ bool HTMLFormElement::wasUserSubmitted() const
 
 HTMLFormControlElement* HTMLFormElement::findSubmitter(const Event* event) const
 {
-    if (!event || !is<Node>(event->target()))
+    if (!event)
+        return nullptr;
+    auto* node = dynamicDowncast<Node>(event->target());
+    if (!node)
         return nullptr;
-    auto& node = downcast<Node>(*event->target());
-    auto* element = is<Element>(node) ? &downcast<Element>(node) : node.parentElement();
+    auto* element = dynamicDowncast<Element>(*node);
+    if (!element)
+        element = node->parentElement();
     return element ? lineageOfType<HTMLFormControlElement>(*element).first() : nullptr;
 }
 
@@ -760,12 +759,9 @@ HTMLFormControlElement* HTMLFormElement::defaultButton() const
     if (m_defaultButton)
         return m_defaultButton.get();
     for (auto& listedElement : m_listedElements) {
-        if (!is<HTMLFormControlElement>(*listedElement))
-            continue;
-        HTMLFormControlElement& control = downcast<HTMLFormControlElement>(*listedElement);
-        if (control.isSuccessfulSubmitButton()) {
-            m_defaultButton = control;
-            return &control;
+        if (auto* control = dynamicDowncast<HTMLFormControlElement>(*listedElement); control && control->isSuccessfulSubmitButton()) {
+            m_defaultButton = *control;
+            return control;
         }
     }
     return nullptr;
@@ -991,11 +987,10 @@ RefPtr<DOMFormData> HTMLFormElement::constructEntryList(RefPtr<HTMLFormControlEl
         auto& element = control->asHTMLElement();
         if (!element.isDisabledFormControl())
             control->appendFormData(domFormData.get());
-        if (formValues && is<HTMLInputElement>(element)) {
-            auto& input = downcast<HTMLInputElement>(element);
-            if (input.isTextField()) {
-                formValues->append({ input.name(), input.value() });
-                input.addSearchResult();
+        if (RefPtr input = dynamicDowncast<HTMLInputElement>(element); formValues && input) {
+            if (input->isTextField()) {
+                formValues->append({ input->name(), input->value() });
+                input->addSearchResult();
             }
         }
     }

Source/WebCore/html/HTMLFrameElementBase.h

@@ -78,5 +78,9 @@ class HTMLFrameElementBase : public HTMLFrameOwnerElement {
 
 SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::HTMLFrameElementBase)
     static bool isType(const WebCore::HTMLElement& element) { return is<WebCore::HTMLFrameElement>(element) || is<WebCore::HTMLIFrameElement>(element); }
-    static bool isType(const WebCore::Node& node) { return is<WebCore::HTMLElement>(node) && isType(downcast<WebCore::HTMLElement>(node)); }
+    static bool isType(const WebCore::Node& node)
+    {
+        auto* htmlElement = dynamicDowncast<WebCore::HTMLElement>(node);
+        return htmlElement && isType(*htmlElement);
+    }
 SPECIALIZE_TYPE_TRAITS_END()

Source/WebCore/html/HTMLFrameOwnerElement.cpp

@@ -49,9 +49,7 @@ RenderWidget* HTMLFrameOwnerElement::renderWidget() const
 {
     // HTMLObjectElement and HTMLEmbedElement may return arbitrary renderers
     // when using fallback content.
-    if (!is<RenderWidget>(renderer()))
-        return nullptr;
-    return downcast<RenderWidget>(renderer());
+    return dynamicDowncast<RenderWidget>(renderer());
 }
 
 void HTMLFrameOwnerElement::setContentFrame(Frame& frame)

Source/WebCore/html/HTMLFrameSetElement.cpp

@@ -214,11 +214,8 @@ void HTMLFrameSetElement::removedFromAncestor(RemovalType removalType, Container
 
 WindowProxy* HTMLFrameSetElement::namedItem(const AtomString& name)
 {
-    RefPtr frameElement = children()->namedItem(name);
-    if (!is<HTMLFrameElement>(frameElement))
-        return nullptr;
-
-    return downcast<HTMLFrameElement>(*frameElement).contentWindow();
+    RefPtr frameElement = dynamicDowncast<HTMLFrameElement>(children()->namedItem(name));
+    return frameElement ? frameElement->contentWindow() : nullptr;
 }
 
 bool HTMLFrameSetElement::isSupportedPropertyName(const AtomString& name)

Source/WebCore/html/HTMLImageElement.cpp

@@ -233,8 +233,8 @@ void HTMLImageElement::setBestFitURLAndDPRFromImageCandidate(const ImageCandidat
     m_currentSrc = AtomString(m_currentURL.string());
     if (candidate.density >= 0)
         m_imageDevicePixelRatio = 1 / candidate.density;
-    if (is<RenderImage>(renderer()))
-        downcast<RenderImage>(*renderer()).setImageDevicePixelRatio(m_imageDevicePixelRatio);
+    if (CheckedPtr renderImage = dynamicDowncast<RenderImage>(renderer()))
+        renderImage->setImageDevicePixelRatio(m_imageDevicePixelRatio);
 }
 
 static String extractMIMETypeFromTypeAttributeForLookup(const String& typeAttribute)
@@ -254,15 +254,15 @@ ImageCandidate HTMLImageElement::bestFitSourceFromPictureElement()
     ImageCandidate candidate;
 
     for (RefPtr<Node> child = picture->firstChild(); child && child != this; child = child->nextSibling()) {
-        if (!is<HTMLSourceElement>(*child))
+        auto* source = dynamicDowncast<HTMLSourceElement>(*child);
+        if (!source)
             continue;
-        auto& source = downcast<HTMLSourceElement>(*child);
 
-        auto& srcset = source.attributeWithoutSynchronization(srcsetAttr);
+        auto& srcset = source->attributeWithoutSynchronization(srcsetAttr);
         if (srcset.isEmpty())
             continue;
 
-        auto& typeAttribute = source.attributeWithoutSynchronization(typeAttr);
+        auto& typeAttribute = source->attributeWithoutSynchronization(typeAttr);
         if (!typeAttribute.isNull()) {
             auto type = extractMIMETypeFromTypeAttributeForLookup(typeAttribute);
             if (!type.isEmpty() && !MIMETypeRegistry::isSupportedImageVideoOrSVGMIMEType(type))
@@ -271,7 +271,7 @@ ImageCandidate HTMLImageElement::bestFitSourceFromPictureElement()
 
         RefPtr documentElement = document().documentElement();
         MQ::MediaQueryEvaluator evaluator { document().printing() ? printAtom() : screenAtom(), document(), documentElement ? documentElement->computedStyle() : nullptr };
-        auto& queries = source.parsedMediaAttribute(document());
+        auto& queries = source->parsedMediaAttribute(document());
         LOG(MediaQueries, "HTMLImageElement %p bestFitSourceFromPictureElement evaluating media queries", this);
 
         auto result = evaluator.evaluate(queries);
@@ -282,15 +282,15 @@ ImageCandidate HTMLImageElement::bestFitSourceFromPictureElement()
         if (!result)
             continue;
 
-        SizesAttributeParser sizesParser(source.attributeWithoutSynchronization(sizesAttr).string(), document());
+        SizesAttributeParser sizesParser(source->attributeWithoutSynchronization(sizesAttr).string(), document());
 
         m_dynamicMediaQueryResults.appendVector(sizesParser.dynamicMediaQueryResults());
 
         auto sourceSize = sizesParser.length();
 
         candidate = bestFitSourceForImageAttributes(document().deviceScaleFactor(), nullAtom(), srcset, sourceSize);
         if (!candidate.isEmpty()) {
-            setSourceElement(&source);
+            setSourceElement(source);
             break;
         }
     }
@@ -390,14 +390,13 @@ void HTMLImageElement::attributeChanged(const QualifiedName& name, const AtomStr
         break;
     case AttributeNames::nameAttr: {
         bool willHaveName = !newValue.isEmpty();
-        if (m_hadNameBeforeAttributeChanged != willHaveName && isConnected() && !isInShadowTree() && is<HTMLDocument>(document())) {
-            HTMLDocument& document = downcast<HTMLDocument>(this->document());
+        if (auto* document = dynamicDowncast<HTMLDocument>(this->document()); m_hadNameBeforeAttributeChanged != willHaveName && isConnected() && !isInShadowTree() && document) {
             const AtomString& id = getIdAttribute();
             if (!id.isEmpty() && id != getNameAttribute()) {
                 if (willHaveName)
-                    document.addDocumentNamedItem(id, *this);
+                    document->addDocumentNamedItem(id, *this);
                 else
-                    document.removeDocumentNamedItem(id, *this);
+                    document->removeDocumentNamedItem(id, *this);
             }
         }
         m_hadNameBeforeAttributeChanged = willHaveName;
@@ -453,7 +452,8 @@ bool HTMLImageElement::isInteractiveContent() const
 
 void HTMLImageElement::didAttachRenderers()
 {
-    if (!is<RenderImage>(renderer()))
+    CheckedPtr renderImage = dynamicDowncast<RenderImage>(renderer());
+    if (!renderImage)
         return;
     if (m_imageLoader->hasPendingBeforeLoadEvent())
         return;
@@ -462,16 +462,15 @@ void HTMLImageElement::didAttachRenderers()
     ImageControlsMac::updateImageControls(*this);
 #endif
 
-    auto& renderImage = downcast<RenderImage>(*renderer());
-    RenderImageResource& renderImageResource = renderImage.imageResource();
+    RenderImageResource& renderImageResource = renderImage->imageResource();
     if (renderImageResource.cachedImage())
         return;
     renderImageResource.setCachedImage(m_imageLoader->image());
 
     // If we have no image at all because we have no src attribute, set
     // image height and width for the alt text instead.
     if (!m_imageLoader->image() && !renderImageResource.cachedImage())
-        renderImage.setImageSizeForAltText();
+        renderImage->setImageSizeForAltText();
 }
 
 Node::InsertedIntoAncestorResult HTMLImageElement::insertedIntoAncestor(InsertionType insertionType, ContainerNode& parentOfInsertedTree)
@@ -487,10 +486,10 @@ Node::InsertedIntoAncestorResult HTMLImageElement::insertedIntoAncestor(Insertio
     if (insertionType.treeScopeChanged && !m_parsedUsemap.isNull())
         treeScope().addImageElementByUsemap(m_parsedUsemap, *this);
 
-    if (is<HTMLPictureElement>(&parentOfInsertedTree) && &parentOfInsertedTree == parentElement()) {
+    if (auto* parentPicture = dynamicDowncast<HTMLPictureElement>(parentOfInsertedTree); parentPicture && &parentOfInsertedTree == parentElement()) {
         // FIXME: When the hack in HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface to eagerly call setPictureElement is removed, we can just assert !pictureElement().
         ASSERT(!pictureElement() || pictureElement() == &parentOfInsertedTree);
-        setPictureElement(&downcast<HTMLPictureElement>(parentOfInsertedTree));
+        setPictureElement(parentPicture);
         selectImageSource(RelevantMutation::Yes);
         return insertNotificationRequest;
     }
@@ -935,10 +934,10 @@ bool HTMLImageElement::isSystemPreviewImage() const
         return false;
 
     auto* parent = parentElement();
-    if (is<HTMLAnchorElement>(parent))
-        return downcast<HTMLAnchorElement>(parent)->isSystemPreviewLink();
-    if (is<HTMLPictureElement>(parent))
-        return downcast<HTMLPictureElement>(parent)->isSystemPreviewImage();
+    if (auto* anchorElement = dynamicDowncast<HTMLAnchorElement>(parent))
+        return anchorElement->isSystemPreviewLink();
+    if (auto* pictureElement = dynamicDowncast<HTMLPictureElement>(parent))
+        return pictureElement->isSystemPreviewImage();
     return false;
 }
 #endif
@@ -1057,8 +1056,7 @@ Ref<Element> HTMLImageElement::cloneElementWithoutAttributesAndChildren(Document
 #if ENABLE(ATTACHMENT_ELEMENT)
     if (auto attachment = attachmentElement()) {
         auto attachmentClone = attachment->cloneElementWithoutChildren(targetDocument);
-        RELEASE_ASSERT(is<HTMLAttachmentElement>(attachmentClone));
-        clone->setAttachmentElement(downcast<HTMLAttachmentElement>(attachmentClone.get()));
+        clone->setAttachmentElement(checkedDowncast<HTMLAttachmentElement>(attachmentClone.get()));
     }
 #endif
     return clone;

Source/WebCore/html/HTMLImageLoader.cpp

@@ -91,8 +91,10 @@ void HTMLImageLoader::notifyFinished(CachedResource&, const NetworkLoadMetrics&
         }
     }
 
-    if (loadError && is<HTMLObjectElement>(element()))
-        downcast<HTMLObjectElement>(element()).renderFallbackContent();
+    if (loadError) {
+        if (RefPtr objectElement = dynamicDowncast<HTMLObjectElement>(element()))
+            objectElement->renderFallbackContent();
+    }
 }
 
 }