1 files changed, 22 insertions, 21 deletions

diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index ab2df915c..e40dde949 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -26,7 +26,10 @@
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ElementAncestorIterator.h"
 #include "HTMLNames.h"
+#include "HTMLOListElement.h"
+#include "HTMLUListElement.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
@@ -40,14 +43,14 @@ HTMLLIElement::HTMLLIElement(const QualifiedName& tagName, Document& document)
     setHasCustomStyleResolveCallbacks();
 }
 
-PassRefPtr<HTMLLIElement> HTMLLIElement::create(Document& document)
+Ref<HTMLLIElement> HTMLLIElement::create(Document& document)
 {
-    return adoptRef(new HTMLLIElement(liTag, document));
+    return adoptRef(*new HTMLLIElement(liTag, document));
 }
 
-PassRefPtr<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Document& document)
+Ref<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Document& document)
 {
-    return adoptRef(new HTMLLIElement(tagName, document));
+    return adoptRef(*new HTMLLIElement(tagName, document));
 }
 
 bool HTMLLIElement::isPresentationAttribute(const QualifiedName& name) const
@@ -87,39 +90,37 @@ void HTMLLIElement::parseAttribute(const QualifiedName& name, const AtomicString
 
 void HTMLLIElement::didAttachRenderers()
 {
-    if (!renderer() || !renderer()->isListItem())
+    if (!is<RenderListItem>(renderer()))
         return;
-    RenderListItem* listItemRenderer = toRenderListItem(renderer());
-
-    // Find the enclosing list node.
-    Element* listNode = 0;
-    Element* current = this;
-    while (!listNode) {
-        current = current->parentElement();
-        if (!current)
+    auto& listItemRenderer = downcast<RenderListItem>(*renderer());
+
+    // Check if there is an enclosing list.
+    bool isInList = false;
+    for (auto& ancestor : ancestorsOfType<HTMLElement>(*this)) {
+        if (is<HTMLUListElement>(ancestor) || is<HTMLOListElement>(ancestor)) {
+            isInList = true;
             break;
-        if (current->hasTagName(ulTag) || current->hasTagName(olTag))
-            listNode = current;
+        }
     }
 
     // If we are not in a list, tell the renderer so it can position us inside.
     // We don't want to change our style to say "inside" since that would affect nested nodes.
-    if (!listNode)
-        listItemRenderer->setNotInList(true);
+    if (!isInList)
+        listItemRenderer.setNotInList(true);
 
-    parseValue(fastGetAttribute(valueAttr));
+    parseValue(attributeWithoutSynchronization(valueAttr));
 }
 
 inline void HTMLLIElement::parseValue(const AtomicString& value)
 {
-    ASSERT(renderer() && renderer()->isListItem());
+    ASSERT(renderer());
 
     bool valueOK;
     int requestedValue = value.toInt(&valueOK);
     if (valueOK)
-        toRenderListItem(renderer())->setExplicitValue(requestedValue);
+        downcast<RenderListItem>(*renderer()).setExplicitValue(requestedValue);
     else
-        toRenderListItem(renderer())->clearExplicitValue();
+        downcast<RenderListItem>(*renderer()).clearExplicitValue();
 }
 
 }