Cherry-pick 272448.385@safari-7618-branch (2d3dc03). https://bugs.web…

…kit.org/show_bug.cgi?id=268235

    Bad cast in TextManipulationController::scheduleObservationUpdate()
    https://bugs.webkit.org/show_bug.cgi?id=268235
    rdar://121646850

    Reviewed by Wenson Hsieh.

    Convert the downcast<>() into a dynamicDowncast<>() since the common ancestor
    is not guaranteed to be an Element.

    I have not been able to reproduce but it is happening in the wild.

    * Source/WebCore/editing/TextManipulationController.cpp:
    (WebCore::TextManipulationController::scheduleObservationUpdate):

    Canonical link: https://commits.webkit.org/272448.385@safari-7618-branch

Canonical link: https://commits.webkit.org/266719.405@webkitglib/2.42

Source/WebCore/editing/TextManipulationController.cpp

@@ -613,7 +613,7 @@ void TextManipulationController::scheduleObservationUpdate()
         }
 
         Position start;
-        if (auto* element = downcast<Element>(commonAncestor.get())) {
+        if (RefPtr element = dynamicDowncast<Element>(commonAncestor.get())) {
             // Ensure to include the element in the range.
             if (canPerformTextManipulationByReplacingEntireTextContent(*element))
                 start = positionBeforeNode(commonAncestor.get());