<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[174504] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/174504">174504</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2014-10-09 09:17:06 -0700 (Thu, 09 Oct 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Use is&lt;&gt;() / downcast&lt;&gt;() for RenderBlockFlow
https://bugs.webkit.org/show_bug.cgi?id=137545

Reviewed by Darin Adler.

Use is&lt;&gt;() / downcast&lt;&gt;() for RenderBlockFlow and clean up the
surrounding code.

No new tests, no behavior change.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
* dom/Element.cpp:
(WebCore::Element::renderNamedFlowFragment):
(WebCore::Element::webkitGetRegionFlowRanges):
* editing/Editor.cpp:
(WebCore::Editor::hasBidiSelection):
* inspector/InspectorOverlay.cpp:
(WebCore::buildObjectForRegionHighlight):
(WebCore::buildObjectForElementInfo):
* rendering/EllipsisBox.h:
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::innerTextIfTruncated):
* rendering/LayoutState.cpp:
(WebCore::LayoutState::LayoutState):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeChild):
* rendering/RenderBlock.h:
(WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::rebuildFloatingObjectSetFromIntrudingFloats):
(WebCore::RenderBlockFlow::layoutBlockChild):
(WebCore::RenderBlockFlow::marginOffsetForSelfCollapsingBlock):
(WebCore::RenderBlockFlow::marginValuesForChild):
(WebCore::RenderBlockFlow::collapseMargins):
(WebCore::RenderBlockFlow::marginBeforeEstimateForChild):
(WebCore::RenderBlockFlow::handleAfterSideOfBlock):
(WebCore::RenderBlockFlow::mustDiscardMarginBeforeForChild):
(WebCore::RenderBlockFlow::mustDiscardMarginAfterForChild):
(WebCore::RenderBlockFlow::adjustBlockChildForPagination):
(WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
(WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout):
(WebCore::RenderBlockFlow::adjustForBorderFit):
(WebCore::getHeightForLineCount):
* rendering/RenderBlockFlow.h:
(WebCore::RenderElement::isRenderNamedFlowFragmentContainer):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::createLineBoxes):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::styleDidChange):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
(WebCore::RenderDeprecatedFlexibleBox::clearLineClamp):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeFlowChildInfo):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::updateLayerPositions):
(WebCore::expandClipRectForRegionAndReflection):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::computeCompositingRequirements):
(WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
(WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):
(WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
* rendering/RenderMultiColumnFlowThread.h:
* rendering/RenderMultiColumnSet.cpp:
(WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset):
(WebCore::RenderMultiColumnSet::columnGap):
* rendering/RenderMultiColumnSet.h:
* rendering/RenderNamedFlowFragment.cpp:
(WebCore::RenderNamedFlowFragment::fragmentContainer):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::adjustComputedFontSizesOnBlocks):
(WebCore::RenderObject::resetTextAutosizing):
(WebCore::RenderObject::showLineTreeForThis):
(WebCore::RenderObject::showRenderSubTreeAndMark):
* rendering/RenderText.cpp:
(WebCore::RenderText::setText):
(WebCore::RenderText::ensureLineBoxes):
(WebCore::RenderText::simpleLineLayout):
* rendering/RenderTreeAsText.cpp:
(WebCore::write):
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::selectionTopAdjustedForPrecedingBlock):
(WebCore::RootInlineBox::blockFlow):
* rendering/SimpleLineLayoutFunctions.cpp:
(WebCore::SimpleLineLayout::computeTextBoundingBox):
(WebCore::SimpleLineLayout::computeTextFirstRunLocation):
(WebCore::SimpleLineLayout::collectTextAbsoluteRects):
(WebCore::SimpleLineLayout::collectTextAbsoluteQuads):
* rendering/svg/SVGTextQuery.cpp:
(WebCore::flowBoxForRenderer):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCoredomElementcpp">trunk/Source/WebCore/dom/Element.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingEditorcpp">trunk/Source/WebCore/editing/Editor.cpp</a></li>
<li><a href="#trunkSourceWebCoreinspectorInspectorOverlaycpp">trunk/Source/WebCore/inspector/InspectorOverlay.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingEllipsisBoxh">trunk/Source/WebCore/rendering/EllipsisBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingHitTestResultcpp">trunk/Source/WebCore/rendering/HitTestResult.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingLayoutStatecpp">trunk/Source/WebCore/rendering/LayoutState.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockcpp">trunk/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockh">trunk/Source/WebCore/rendering/RenderBlock.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowcpp">trunk/Source/WebCore/rendering/RenderBlockFlow.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowh">trunk/Source/WebCore/rendering/RenderBlockFlow.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockLineLayoutcpp">trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxcpp">trunk/Source/WebCore/rendering/RenderBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxModelObjectcpp">trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderDeprecatedFlexibleBoxcpp">trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLayercpp">trunk/Source/WebCore/rendering/RenderLayer.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLayerCompositorcpp">trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnSetcpp">trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnSeth">trunk/Source/WebCore/rendering/RenderMultiColumnSet.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowFragmentcpp">trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderObjectcpp">trunk/Source/WebCore/rendering/RenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderTextcpp">trunk/Source/WebCore/rendering/RenderText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderTreeAsTextcpp">trunk/Source/WebCore/rendering/RenderTreeAsText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRootInlineBoxcpp">trunk/Source/WebCore/rendering/RootInlineBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingSimpleLineLayoutFunctionscpp">trunk/Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGTextQuerycpp">trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/ChangeLog        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -1,3 +1,102 @@
</span><ins>+2014-10-09  Christophe Dumez  &lt;cdumez@apple.com&gt;
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for RenderBlockFlow
+        https://bugs.webkit.org/show_bug.cgi?id=137545
+
+        Reviewed by Darin Adler.
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for RenderBlockFlow and clean up the
+        surrounding code.
+
+        No new tests, no behavior change.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
+        * dom/Element.cpp:
+        (WebCore::Element::renderNamedFlowFragment):
+        (WebCore::Element::webkitGetRegionFlowRanges):
+        * editing/Editor.cpp:
+        (WebCore::Editor::hasBidiSelection):
+        * inspector/InspectorOverlay.cpp:
+        (WebCore::buildObjectForRegionHighlight):
+        (WebCore::buildObjectForElementInfo):
+        * rendering/EllipsisBox.h:
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::innerTextIfTruncated):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo):
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::rebuildFloatingObjectSetFromIntrudingFloats):
+        (WebCore::RenderBlockFlow::layoutBlockChild):
+        (WebCore::RenderBlockFlow::marginOffsetForSelfCollapsingBlock):
+        (WebCore::RenderBlockFlow::marginValuesForChild):
+        (WebCore::RenderBlockFlow::collapseMargins):
+        (WebCore::RenderBlockFlow::marginBeforeEstimateForChild):
+        (WebCore::RenderBlockFlow::handleAfterSideOfBlock):
+        (WebCore::RenderBlockFlow::mustDiscardMarginBeforeForChild):
+        (WebCore::RenderBlockFlow::mustDiscardMarginAfterForChild):
+        (WebCore::RenderBlockFlow::adjustBlockChildForPagination):
+        (WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
+        (WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlockFlow::adjustForBorderFit):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlockFlow.h:
+        (WebCore::RenderElement::isRenderNamedFlowFragmentContainer):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::createLineBoxes):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintMaskForTextFillBox):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
+        (WebCore::RenderDeprecatedFlexibleBox::clearLineClamp):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeFlowChildInfo):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::expandClipRectForRegionAndReflection):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
+        (WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):
+        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
+        * rendering/RenderMultiColumnFlowThread.h:
+        * rendering/RenderMultiColumnSet.cpp:
+        (WebCore::RenderMultiColumnSet::heightAdjustedForSetOffset):
+        (WebCore::RenderMultiColumnSet::columnGap):
+        * rendering/RenderMultiColumnSet.h:
+        * rendering/RenderNamedFlowFragment.cpp:
+        (WebCore::RenderNamedFlowFragment::fragmentContainer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustComputedFontSizesOnBlocks):
+        (WebCore::RenderObject::resetTextAutosizing):
+        (WebCore::RenderObject::showLineTreeForThis):
+        (WebCore::RenderObject::showRenderSubTreeAndMark):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setText):
+        (WebCore::RenderText::ensureLineBoxes):
+        (WebCore::RenderText::simpleLineLayout):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::selectionTopAdjustedForPrecedingBlock):
+        (WebCore::RootInlineBox::blockFlow):
+        * rendering/SimpleLineLayoutFunctions.cpp:
+        (WebCore::SimpleLineLayout::computeTextBoundingBox):
+        (WebCore::SimpleLineLayout::computeTextFirstRunLocation):
+        (WebCore::SimpleLineLayout::collectTextAbsoluteRects):
+        (WebCore::SimpleLineLayout::collectTextAbsoluteQuads):
+        * rendering/svg/SVGTextQuery.cpp:
+        (WebCore::flowBoxForRenderer):
+
</ins><span class="cx"> 2014-10-09  Philip Chimento  &lt;philip.chimento@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [GTK] Netscape plugin API symbol used outside feature guards
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -1285,8 +1285,8 @@
</span><span class="cx">         return false;
</span><span class="cx"> #endif
</span><span class="cx">     
</span><del>-    if (m_renderer-&gt;isRenderBlockFlow() &amp;&amp; m_renderer-&gt;childrenInline() &amp;&amp; !canSetFocusAttribute())
-        return !toRenderBlockFlow(m_renderer)-&gt;hasLines() &amp;&amp; !mouseButtonListener();
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(*m_renderer) &amp;&amp; m_renderer-&gt;childrenInline() &amp;&amp; !canSetFocusAttribute())
+        return !downcast&lt;RenderBlockFlow&gt;(*m_renderer).hasLines() &amp;&amp; !mouseButtonListener();
</ins><span class="cx">     
</span><span class="cx">     // ignore images seemingly used as spacers
</span><span class="cx">     if (isImage()) {
</span><span class="lines">@@ -1298,9 +1298,9 @@
</span><span class="cx">         // First check the RenderImage's altText (which can be set through a style sheet, or come from the Element).
</span><span class="cx">         // However, if this is not a native image, fallback to the attribute on the Element.
</span><span class="cx">         AccessibilityObjectInclusion altTextInclusion = DefaultBehavior;
</span><del>-        bool isRenderImage = m_renderer &amp;&amp; m_renderer-&gt;isRenderImage();
</del><ins>+        bool isRenderImage = is&lt;RenderImage&gt;(m_renderer);
</ins><span class="cx">         if (isRenderImage)
</span><del>-            altTextInclusion = objectInclusionFromAltText(toRenderImage(m_renderer)-&gt;altText());
</del><ins>+            altTextInclusion = objectInclusionFromAltText(downcast&lt;RenderImage&gt;(*m_renderer).altText());
</ins><span class="cx">         else
</span><span class="cx">             altTextInclusion = objectInclusionFromAltText(getAttribute(altAttr).string());
</span><span class="cx"> 
</span><span class="lines">@@ -1315,13 +1315,13 @@
</span><span class="cx">     
</span><span class="cx">         if (isRenderImage) {
</span><span class="cx">             // check for one-dimensional image
</span><del>-            RenderImage* image = toRenderImage(m_renderer);
-            if (image-&gt;height() &lt;= 1 || image-&gt;width() &lt;= 1)
</del><ins>+            RenderImage&amp; image = downcast&lt;RenderImage&gt;(*m_renderer);
+            if (image.height() &lt;= 1 || image.width() &lt;= 1)
</ins><span class="cx">                 return true;
</span><span class="cx">             
</span><span class="cx">             // check whether rendered image was stretched from one-dimensional file image
</span><del>-            if (image-&gt;cachedImage()) {
-                LayoutSize imageSize = image-&gt;cachedImage()-&gt;imageSizeForRenderer(toRenderElement(m_renderer), image-&gt;view().zoomFactor());
</del><ins>+            if (image.cachedImage()) {
+                LayoutSize imageSize = image.cachedImage()-&gt;imageSizeForRenderer(toRenderElement(m_renderer), image.view().zoomFactor());
</ins><span class="cx">                 return imageSize.height() &lt;= 1 || imageSize.width() &lt;= 1;
</span><span class="cx">             }
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceWebCoredomElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Element.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Element.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/dom/Element.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -2494,7 +2494,7 @@
</span><span class="cx"> RenderNamedFlowFragment* Element::renderNamedFlowFragment() const
</span><span class="cx"> {
</span><span class="cx">     if (renderer() &amp;&amp; renderer()-&gt;isRenderNamedFlowFragmentContainer())
</span><del>-        return toRenderBlockFlow(renderer())-&gt;renderNamedFlowFragment();
</del><ins>+        return downcast&lt;RenderBlockFlow&gt;(*renderer()).renderNamedFlowFragment();
</ins><span class="cx"> 
</span><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="lines">@@ -2554,9 +2554,9 @@
</span><span class="cx"> 
</span><span class="cx">     document().updateLayoutIgnorePendingStylesheets();
</span><span class="cx">     if (renderer() &amp;&amp; renderer()-&gt;isRenderNamedFlowFragmentContainer()) {
</span><del>-        RenderNamedFlowFragment* namedFlowFragment = toRenderBlockFlow(renderer())-&gt;renderNamedFlowFragment();
-        if (namedFlowFragment-&gt;isValid())
-            namedFlowFragment-&gt;getRanges(rangeObjects);
</del><ins>+        RenderNamedFlowFragment&amp; namedFlowFragment = *downcast&lt;RenderBlockFlow&gt;(*renderer()).renderNamedFlowFragment();
+        if (namedFlowFragment.isValid())
+            namedFlowFragment.getRanges(rangeObjects);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return rangeObjects;
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingEditorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/Editor.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/Editor.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/editing/Editor.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -769,7 +769,7 @@
</span><span class="cx">         startNode = m_frame.selection().selection().visibleStart().deepEquivalent().deprecatedNode();
</span><span class="cx"> 
</span><span class="cx">     auto renderer = startNode-&gt;renderer();
</span><del>-    while (renderer &amp;&amp; !renderer-&gt;isRenderBlockFlow())
</del><ins>+    while (renderer &amp;&amp; !is&lt;RenderBlockFlow&gt;(*renderer))
</ins><span class="cx">         renderer = renderer-&gt;parent();
</span><span class="cx"> 
</span><span class="cx">     if (!renderer)
</span><span class="lines">@@ -778,7 +778,7 @@
</span><span class="cx">     if (!renderer-&gt;style().isLeftToRightDirection())
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    return toRenderBlockFlow(renderer)-&gt;containsNonZeroBidiLevel();
</del><ins>+    return downcast&lt;RenderBlockFlow&gt;(*renderer).containsNonZeroBidiLevel();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> TriState Editor::selectionUnorderedListState() const
</span></span></pre></div>
<a id="trunkSourceWebCoreinspectorInspectorOverlaycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorOverlay.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/inspector/InspectorOverlay.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/inspector/InspectorOverlay.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -379,10 +379,10 @@
</span><span class="cx">     if (!containingView)
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    RenderBlockFlow* regionContainer = toRenderBlockFlow(region-&gt;parent());
-    LayoutRect borderBox = regionContainer-&gt;borderBoxRect();
-    borderBox.setWidth(borderBox.width() + regionContainer-&gt;verticalScrollbarWidth());
-    borderBox.setHeight(borderBox.height() + regionContainer-&gt;horizontalScrollbarHeight());
</del><ins>+    RenderBlockFlow&amp; regionContainer = downcast&lt;RenderBlockFlow&gt;(*region-&gt;parent());
+    LayoutRect borderBox = regionContainer.borderBoxRect();
+    borderBox.setWidth(borderBox.width() + regionContainer.verticalScrollbarWidth());
+    borderBox.setHeight(borderBox.height() + regionContainer.horizontalScrollbarHeight());
</ins><span class="cx"> 
</span><span class="cx">     // Create incoming and outgoing boxes that we use to chain the regions toghether.
</span><span class="cx">     const LayoutSize linkBoxSize(10, 10);
</span><span class="lines">@@ -397,9 +397,9 @@
</span><span class="cx">     incomingRectBox.move(0, linkBoxVerticalOffset);
</span><span class="cx">     outgoingRectBox.move(0, -linkBoxVerticalOffset);
</span><span class="cx"> 
</span><del>-    FloatQuad borderRectQuad = regionContainer-&gt;localToAbsoluteQuad(FloatRect(borderBox));
-    FloatQuad incomingRectQuad = regionContainer-&gt;localToAbsoluteQuad(FloatRect(incomingRectBox));
-    FloatQuad outgoingRectQuad = regionContainer-&gt;localToAbsoluteQuad(FloatRect(outgoingRectBox));
</del><ins>+    FloatQuad borderRectQuad = regionContainer.localToAbsoluteQuad(FloatRect(borderBox));
+    FloatQuad incomingRectQuad = regionContainer.localToAbsoluteQuad(FloatRect(incomingRectBox));
+    FloatQuad outgoingRectQuad = regionContainer.localToAbsoluteQuad(FloatRect(outgoingRectBox));
</ins><span class="cx"> 
</span><span class="cx">     contentsQuadToPage(mainView, containingView, borderRectQuad);
</span><span class="cx">     contentsQuadToPage(mainView, containingView, incomingRectQuad);
</span><span class="lines">@@ -711,13 +711,12 @@
</span><span class="cx">     elementInfo-&gt;setString(&quot;nodeHeight&quot;, String::number(modelObject ? adjustForAbsoluteZoom(modelObject-&gt;pixelSnappedOffsetHeight(), *modelObject) : boundingBox.height()));
</span><span class="cx">     
</span><span class="cx">     if (renderer-&gt;isRenderNamedFlowFragmentContainer()) {
</span><del>-        RenderNamedFlowFragment* region = toRenderBlockFlow(renderer)-&gt;renderNamedFlowFragment();
-        if (region-&gt;isValid()) {
-            RenderFlowThread* flowThread = region-&gt;flowThread();
-            ASSERT(flowThread &amp;&amp; flowThread-&gt;isRenderNamedFlowThread());
</del><ins>+        RenderNamedFlowFragment&amp; region = *downcast&lt;RenderBlockFlow&gt;(*renderer).renderNamedFlowFragment();
+        if (region.isValid()) {
+            RenderFlowThread* flowThread = region.flowThread();
</ins><span class="cx">             RefPtr&lt;InspectorObject&gt; regionFlowInfo = InspectorObject::create();
</span><del>-            regionFlowInfo-&gt;setString(&quot;name&quot;, toRenderNamedFlowThread(flowThread)-&gt;flowThreadName());
-            regionFlowInfo-&gt;setArray(&quot;regions&quot;, buildObjectForCSSRegionsHighlight(region, flowThread));
</del><ins>+            regionFlowInfo-&gt;setString(&quot;name&quot;, downcast&lt;RenderNamedFlowThread&gt;(*flowThread).flowThreadName());
+            regionFlowInfo-&gt;setArray(&quot;regions&quot;, buildObjectForCSSRegionsHighlight(&amp;region, flowThread));
</ins><span class="cx">             elementInfo-&gt;setObject(&quot;regionFlowInfo&quot;, regionFlowInfo.release());
</span><span class="cx">         }
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingEllipsisBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/EllipsisBox.h (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/EllipsisBox.h        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/EllipsisBox.h        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx">     void setSelectionState(RenderObject::SelectionState s) { m_selectionState = s; }
</span><span class="cx">     IntRect selectionRect();
</span><span class="cx"> 
</span><del>-    RenderBlockFlow&amp; blockFlow() const { return toRenderBlockFlow(InlineBox::renderer()); }
</del><ins>+    RenderBlockFlow&amp; blockFlow() const { return downcast&lt;RenderBlockFlow&gt;(InlineBox::renderer()); }
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     void paintMarkupBox(PaintInfo&amp;, const LayoutPoint&amp; paintOffset, LayoutUnit lineTop, LayoutUnit lineBottom, const RenderStyle&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingHitTestResultcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/HitTestResult.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/HitTestResult.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/HitTestResult.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -243,12 +243,12 @@
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="cx">         if (auto renderer = downcast&lt;Element&gt;(*truncatedNode).renderer()) {
</span><del>-            if (renderer-&gt;isRenderBlockFlow()) {
-                RenderBlockFlow* block = toRenderBlockFlow(renderer);
-                if (block-&gt;style().textOverflow()) {
-                    for (RootInlineBox* line = block-&gt;firstRootBox(); line; line = line-&gt;nextRootBox()) {
</del><ins>+            if (is&lt;RenderBlockFlow&gt;(*renderer)) {
+                RenderBlockFlow&amp; block = downcast&lt;RenderBlockFlow&gt;(*renderer);
+                if (block.style().textOverflow()) {
+                    for (RootInlineBox* line = block.firstRootBox(); line; line = line-&gt;nextRootBox()) {
</ins><span class="cx">                         if (line-&gt;hasEllipsisBox()) {
</span><del>-                            dir = block-&gt;style().direction();
</del><ins>+                            dir = block.style().direction();
</ins><span class="cx">                             return downcast&lt;Element&gt;(*truncatedNode).innerText();
</span><span class="cx">                         }
</span><span class="cx">                     }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingLayoutStatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/LayoutState.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/LayoutState.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/LayoutState.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -116,8 +116,8 @@
</span><span class="cx">         toRenderMultiColumnFlowThread(renderer)-&gt;computeLineGridPaginationOrigin(*this);
</span><span class="cx"> 
</span><span class="cx">     // If we have a new grid to track, then add it to our set.
</span><del>-    if (renderer-&gt;style().lineGrid() != RenderStyle::initialLineGrid() &amp;&amp; renderer-&gt;isRenderBlockFlow())
-        establishLineGrid(toRenderBlockFlow(renderer));
</del><ins>+    if (renderer-&gt;style().lineGrid() != RenderStyle::initialLineGrid() &amp;&amp; is&lt;RenderBlockFlow&gt;(*renderer))
+        establishLineGrid(downcast&lt;RenderBlockFlow&gt;(renderer));
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: &lt;http://bugs.webkit.org/show_bug.cgi?id=13443&gt; Apply control clip if present.
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -745,7 +745,7 @@
</span><span class="cx">         } else {
</span><span class="cx">             // Take all the children out of the |next| block and put them in
</span><span class="cx">             // the |prev| block.
</span><del>-            nextBlock.moveAllChildrenIncludingFloatsTo(&amp;prevBlock, nextBlock.hasLayer() || prevBlock.hasLayer());
</del><ins>+            nextBlock.moveAllChildrenIncludingFloatsTo(prevBlock, nextBlock.hasLayer() || prevBlock.hasLayer());
</ins><span class="cx">             
</span><span class="cx">             // Delete the now-empty block's lines and nuke it.
</span><span class="cx">             nextBlock.deleteLines();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.h (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.h        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBlock.h        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -407,7 +407,7 @@
</span><span class="cx">     virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
</span><span class="cx"> 
</span><span class="cx">     // FIXME-BLOCKFLOW: Remove virtualizaion when all callers have moved to RenderBlockFlow
</span><del>-    virtual void moveAllChildrenIncludingFloatsTo(RenderBlock* toBlock, bool fullRemoveInsert) { moveAllChildrenTo(toBlock, fullRemoveInsert); }
</del><ins>+    virtual void moveAllChildrenIncludingFloatsTo(RenderBlock&amp; toBlock, bool fullRemoveInsert) { moveAllChildrenTo(&amp;toBlock, fullRemoveInsert); }
</ins><span class="cx"> 
</span><span class="cx">     void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
</span><span class="cx">     virtual void addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild) override;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -227,16 +227,16 @@
</span><span class="cx">     // We should not process floats if the parent node is not a RenderBlock. Otherwise, we will add 
</span><span class="cx">     // floats in an invalid context. This will cause a crash arising from a bad cast on the parent.
</span><span class="cx">     // See &lt;rdar://problem/8049753&gt;, where float property is applied on a text node in a SVG.
</span><del>-    if (!parent() || !parent()-&gt;isRenderBlockFlow())
</del><ins>+    if (!is&lt;RenderBlockFlow&gt;(parent()))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     // Attempt to locate a previous sibling with overhanging floats. We skip any elements that are
</span><span class="cx">     // out of flow (like floating/positioned elements), and we also skip over any objects that may have shifted
</span><span class="cx">     // to avoid floats.
</span><del>-    RenderBlockFlow* parentBlock = toRenderBlockFlow(parent());
</del><ins>+    RenderBlockFlow&amp; parentBlock = downcast&lt;RenderBlockFlow&gt;(*parent());
</ins><span class="cx">     bool parentHasFloats = false;
</span><span class="cx">     RenderObject* prev = previousSibling();
</span><del>-    while (prev &amp;&amp; (prev-&gt;isFloatingOrOutOfFlowPositioned() || !prev-&gt;isBox() || !prev-&gt;isRenderBlockFlow() || toRenderBlockFlow(prev)-&gt;avoidsFloats())) {
</del><ins>+    while (prev &amp;&amp; (prev-&gt;isFloatingOrOutOfFlowPositioned() || !is&lt;RenderBox&gt;(*prev) || !is&lt;RenderBlockFlow&gt;(*prev) || downcast&lt;RenderBlockFlow&gt;(*prev).avoidsFloats())) {
</ins><span class="cx">         if (prev-&gt;isFloating())
</span><span class="cx">             parentHasFloats = true;
</span><span class="cx">         prev = prev-&gt;previousSibling();
</span><span class="lines">@@ -245,21 +245,21 @@
</span><span class="cx">     // First add in floats from the parent. Self-collapsing blocks let their parent track any floats that intrude into
</span><span class="cx">     // them (as opposed to floats they contain themselves) so check for those here too.
</span><span class="cx">     LayoutUnit logicalTopOffset = logicalTop();
</span><del>-    if (parentHasFloats || (parentBlock-&gt;lowestFloatLogicalBottom() &gt; logicalTopOffset &amp;&amp; prev &amp;&amp; toRenderBlockFlow(prev)-&gt;isSelfCollapsingBlock()))
-        addIntrudingFloats(parentBlock, parentBlock-&gt;logicalLeftOffsetForContent(), logicalTopOffset);
</del><ins>+    if (parentHasFloats || (parentBlock.lowestFloatLogicalBottom() &gt; logicalTopOffset &amp;&amp; prev &amp;&amp; downcast&lt;RenderBlockFlow&gt;(*prev).isSelfCollapsingBlock()))
+        addIntrudingFloats(&amp;parentBlock, parentBlock.logicalLeftOffsetForContent(), logicalTopOffset);
</ins><span class="cx">     
</span><span class="cx">     LayoutUnit logicalLeftOffset = 0;
</span><span class="cx">     if (prev)
</span><span class="cx">         logicalTopOffset -= toRenderBox(prev)-&gt;logicalTop();
</span><span class="cx">     else {
</span><del>-        prev = parentBlock;
-        logicalLeftOffset += parentBlock-&gt;logicalLeftOffsetForContent();
</del><ins>+        prev = &amp;parentBlock;
+        logicalLeftOffset += parentBlock.logicalLeftOffsetForContent();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Add overhanging floats from the previous RenderBlock, but only if it has a float that intrudes into our space.    
</span><del>-    RenderBlockFlow* block = toRenderBlockFlow(prev);
-    if (block-&gt;m_floatingObjects &amp;&amp; block-&gt;lowestFloatLogicalBottom() &gt; logicalTopOffset)
-        addIntrudingFloats(block, logicalLeftOffset, logicalTopOffset);
</del><ins>+    RenderBlockFlow&amp; block = downcast&lt;RenderBlockFlow&gt;(*prev);
+    if (block.m_floatingObjects &amp;&amp; block.lowestFloatLogicalBottom() &gt; logicalTopOffset)
+        addIntrudingFloats(&amp;block, logicalLeftOffset, logicalTopOffset);
</ins><span class="cx"> 
</span><span class="cx">     if (childrenInline()) {
</span><span class="cx">         LayoutUnit changeLogicalTop = LayoutUnit::max();
</span><span class="lines">@@ -678,7 +678,7 @@
</span><span class="cx">     setLogicalTopForChild(child, logicalTopEstimate, ApplyLayoutDelta);
</span><span class="cx">     estimateRegionRangeForBoxChild(child);
</span><span class="cx"> 
</span><del>-    RenderBlockFlow* childBlockFlow = child.isRenderBlockFlow() ? toRenderBlockFlow(&amp;child) : nullptr;
</del><ins>+    RenderBlockFlow* childBlockFlow = is&lt;RenderBlockFlow&gt;(child) ? &amp;downcast&lt;RenderBlockFlow&gt;(child) : nullptr;
</ins><span class="cx">     bool markDescendantsWithFloats = false;
</span><span class="cx">     if (logicalTopEstimate != oldLogicalTop &amp;&amp; !child.avoidsFloats() &amp;&amp; childBlockFlow &amp;&amp; childBlockFlow-&gt;containsFloats())
</span><span class="cx">         markDescendantsWithFloats = true;
</span><span class="lines">@@ -827,7 +827,7 @@
</span><span class="cx"> LayoutUnit RenderBlockFlow::marginOffsetForSelfCollapsingBlock()
</span><span class="cx"> {
</span><span class="cx">     ASSERT(isSelfCollapsingBlock());
</span><del>-    RenderBlockFlow* parentBlock = toRenderBlockFlow(parent());
</del><ins>+    RenderBlockFlow* parentBlock = downcast&lt;RenderBlockFlow&gt;(parent());
</ins><span class="cx">     if (parentBlock &amp;&amp; style().clear() &amp;&amp; parentBlock-&gt;getClearDelta(*this, logicalHeight()))
</span><span class="cx">         return marginValuesForChild(*this).positiveMarginBefore();
</span><span class="cx">     return LayoutUnit();
</span><span class="lines">@@ -900,7 +900,7 @@
</span><span class="cx">     LayoutUnit beforeMargin = 0;
</span><span class="cx">     LayoutUnit afterMargin = 0;
</span><span class="cx"> 
</span><del>-    RenderBlockFlow* childRenderBlock = child.isRenderBlockFlow() ? toRenderBlockFlow(&amp;child) : nullptr;
</del><ins>+    RenderBlockFlow* childRenderBlock = is&lt;RenderBlockFlow&gt;(child) ? &amp;downcast&lt;RenderBlockFlow&gt;(child) : nullptr;
</ins><span class="cx">     
</span><span class="cx">     // If the child has the same directionality as we do, then we can just return its
</span><span class="cx">     // margins in the same direction.
</span><span class="lines">@@ -1023,8 +1023,8 @@
</span><span class="cx">     // If the child's previous sibling is a self-collapsing block that cleared a float then its top border edge has been set at the bottom border edge
</span><span class="cx">     // of the float. Since we want to collapse the child's top margin with the self-collapsing block's top and bottom margins we need to adjust our parent's height to match the 
</span><span class="cx">     // margin top of the self-collapsing block. If the resulting collapsed margin leaves the child still intruding into the float then we will want to clear it.
</span><del>-    if (!marginInfo.canCollapseWithMarginBefore() &amp;&amp; prev &amp;&amp; prev-&gt;isRenderBlockFlow() &amp;&amp; toRenderBlockFlow(prev)-&gt;isSelfCollapsingBlock()) {
-        clearanceForSelfCollapsingBlock = toRenderBlockFlow(prev)-&gt;marginOffsetForSelfCollapsingBlock();
</del><ins>+    if (!marginInfo.canCollapseWithMarginBefore() &amp;&amp; is&lt;RenderBlockFlow&gt;(prev) &amp;&amp; downcast&lt;RenderBlockFlow&gt;(*prev).isSelfCollapsingBlock()) {
+        clearanceForSelfCollapsingBlock = downcast&lt;RenderBlockFlow&gt;(*prev).marginOffsetForSelfCollapsingBlock();
</ins><span class="cx">         setLogicalHeight(logicalHeight() - clearanceForSelfCollapsingBlock);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1091,10 +1091,10 @@
</span><span class="cx">         setLogicalHeight(logicalHeight() + (logicalTop - oldLogicalTop));
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (prev &amp;&amp; prev-&gt;isRenderBlockFlow() &amp;&amp; !prev-&gt;isFloatingOrOutOfFlowPositioned()) {
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(prev) &amp;&amp; !prev-&gt;isFloatingOrOutOfFlowPositioned()) {
</ins><span class="cx">         // If |child| is a self-collapsing block it may have collapsed into a previous sibling and although it hasn't reduced the height of the parent yet
</span><span class="cx">         // any floats from the parent will now overhang.
</span><del>-        RenderBlockFlow&amp; block = toRenderBlockFlow(*prev);
</del><ins>+        RenderBlockFlow&amp; block = downcast&lt;RenderBlockFlow&gt;(*prev);
</ins><span class="cx">         LayoutUnit oldLogicalHeight = logicalHeight();
</span><span class="cx">         setLogicalHeight(logicalTop);
</span><span class="cx">         if (block.containsFloats() &amp;&amp; !block.avoidsFloats() &amp;&amp; (block.logicalTop() + block.lowestFloatLogicalBottom()) &gt; logicalTop)
</span><span class="lines">@@ -1195,10 +1195,10 @@
</span><span class="cx">     positiveMarginBefore = std::max(positiveMarginBefore, beforeChildMargin);
</span><span class="cx">     negativeMarginBefore = std::max(negativeMarginBefore, -beforeChildMargin);
</span><span class="cx"> 
</span><del>-    if (!child.isRenderBlockFlow())
</del><ins>+    if (!is&lt;RenderBlockFlow&gt;(child))
</ins><span class="cx">         return;
</span><span class="cx">     
</span><del>-    RenderBlockFlow&amp; childBlock = toRenderBlockFlow(child);
</del><ins>+    RenderBlockFlow&amp; childBlock = downcast&lt;RenderBlockFlow&gt;(child);
</ins><span class="cx">     if (childBlock.childrenInline() || childBlock.isWritingModeRoot())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -1314,8 +1314,8 @@
</span><span class="cx">     // bottom edge of the float that the child clears. The correct vertical position for the margin-collapsing we want
</span><span class="cx">     // to perform now is at the child's margin-top - so adjust our height to that position.
</span><span class="cx">     RenderObject* lastBlock = lastChild();
</span><del>-    if (lastBlock &amp;&amp; lastBlock-&gt;isRenderBlockFlow() &amp;&amp; toRenderBlockFlow(lastBlock)-&gt;isSelfCollapsingBlock())
-        setLogicalHeight(logicalHeight() - toRenderBlockFlow(lastBlock)-&gt;marginOffsetForSelfCollapsingBlock());
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(lastBlock) &amp;&amp; downcast&lt;RenderBlockFlow&gt;(*lastBlock).isSelfCollapsingBlock())
+        setLogicalHeight(logicalHeight() - downcast&lt;RenderBlockFlow&gt;(*lastBlock).marginOffsetForSelfCollapsingBlock());
</ins><span class="cx"> 
</span><span class="cx">     // If we can't collapse with children then go ahead and add in the bottom margin.
</span><span class="cx">     if (!marginInfo.discardMargin() &amp;&amp; (!marginInfo.canCollapseWithMarginAfter() &amp;&amp; !marginInfo.canCollapseWithMarginBefore()
</span><span class="lines">@@ -1403,9 +1403,9 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!child.selfNeedsLayout());
</span><span class="cx">     if (!child.isWritingModeRoot())
</span><del>-        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginBefore() : (child.style().marginBeforeCollapse() == MDISCARD);
</del><ins>+        return is&lt;RenderBlockFlow&gt;(child) ? downcast&lt;RenderBlockFlow&gt;(child).mustDiscardMarginBefore() : (child.style().marginBeforeCollapse() == MDISCARD);
</ins><span class="cx">     if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
</span><del>-        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginAfter() : (child.style().marginAfterCollapse() == MDISCARD);
</del><ins>+        return is&lt;RenderBlockFlow&gt;(child) ? downcast&lt;RenderBlockFlow&gt;(child).mustDiscardMarginAfter() : (child.style().marginAfterCollapse() == MDISCARD);
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: We return false here because the implementation is not geometrically complete. We have values only for before/after, not start/end.
</span><span class="cx">     // In case the boxes are perpendicular we assume the property is not specified.
</span><span class="lines">@@ -1416,9 +1416,9 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!child.selfNeedsLayout());
</span><span class="cx">     if (!child.isWritingModeRoot())
</span><del>-        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginAfter() : (child.style().marginAfterCollapse() == MDISCARD);
</del><ins>+        return is&lt;RenderBlockFlow&gt;(child) ? downcast&lt;RenderBlockFlow&gt;(child).mustDiscardMarginAfter() : (child.style().marginAfterCollapse() == MDISCARD);
</ins><span class="cx">     if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
</span><del>-        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginBefore() : (child.style().marginBeforeCollapse() == MDISCARD);
</del><ins>+        return is&lt;RenderBlockFlow&gt;(child) ? downcast&lt;RenderBlockFlow&gt;(child).mustDiscardMarginBefore() : (child.style().marginBeforeCollapse() == MDISCARD);
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: See |mustDiscardMarginBeforeForChild| above.
</span><span class="cx">     return false;
</span><span class="lines">@@ -1540,7 +1540,7 @@
</span><span class="cx">         
</span><span class="cx">         if (childRenderBlock) {
</span><span class="cx">             if (!child.avoidsFloats() &amp;&amp; childRenderBlock-&gt;containsFloats())
</span><del>-                toRenderBlockFlow(childRenderBlock)-&gt;markAllDescendantsWithFloatsForLayout();
</del><ins>+                downcast&lt;RenderBlockFlow&gt;(*childRenderBlock).markAllDescendantsWithFloatsForLayout();
</ins><span class="cx">             if (!child.needsLayout())
</span><span class="cx">                 child.markForPaginationRelayoutIfNeeded();
</span><span class="cx">         }
</span><span class="lines">@@ -2055,11 +2055,11 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderBlockFlow::moveAllChildrenIncludingFloatsTo(RenderBlock* toBlock, bool fullRemoveInsert)
</del><ins>+void RenderBlockFlow::moveAllChildrenIncludingFloatsTo(RenderBlock&amp; toBlock, bool fullRemoveInsert)
</ins><span class="cx"> {
</span><del>-    RenderBlockFlow* toBlockFlow = toRenderBlockFlow(toBlock);
-    moveAllChildrenTo(toBlockFlow, fullRemoveInsert);
-    moveFloatsTo(toBlockFlow);
</del><ins>+    RenderBlockFlow&amp; toBlockFlow = downcast&lt;RenderBlockFlow&gt;(toBlock);
+    moveAllChildrenTo(&amp;toBlockFlow, fullRemoveInsert);
+    moveFloatsTo(&amp;toBlockFlow);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderBlockFlow::addOverflowFromFloats()
</span><span class="lines">@@ -2709,12 +2709,12 @@
</span><span class="cx">     for (auto&amp; block : childrenOfType&lt;RenderBlock&gt;(*this)) {
</span><span class="cx">         if (!floatToRemove &amp;&amp; block.isFloatingOrOutOfFlowPositioned())
</span><span class="cx">             continue;
</span><del>-        if (!block.isRenderBlockFlow()) {
</del><ins>+        if (!is&lt;RenderBlockFlow&gt;(block)) {
</ins><span class="cx">             if (block.shrinkToAvoidFloats() &amp;&amp; block.everHadLayout())
</span><span class="cx">                 block.setChildNeedsLayout(markParents);
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><del>-        auto&amp; blockFlow = toRenderBlockFlow(block);
</del><ins>+        auto&amp; blockFlow = downcast&lt;RenderBlockFlow&gt;(block);
</ins><span class="cx">         if ((floatToRemove ? blockFlow.containsFloat(*floatToRemove) : blockFlow.containsFloats()) || blockFlow.shrinkToAvoidFloats())
</span><span class="cx">             blockFlow.markAllDescendantsWithFloatsForLayout(floatToRemove, inLayout);
</span><span class="cx">     }
</span><span class="lines">@@ -2885,8 +2885,8 @@
</span><span class="cx">     } else {
</span><span class="cx">         for (RenderBox* obj = firstChildBox(); obj; obj = obj-&gt;nextSiblingBox()) {
</span><span class="cx">             if (!obj-&gt;isFloatingOrOutOfFlowPositioned()) {
</span><del>-                if (obj-&gt;isRenderBlockFlow() &amp;&amp; !obj-&gt;hasOverflowClip())
-                    toRenderBlockFlow(obj)-&gt;adjustForBorderFit(x + obj-&gt;x(), left, right);
</del><ins>+                if (is&lt;RenderBlockFlow&gt;(*obj) &amp;&amp; !obj-&gt;hasOverflowClip())
+                    downcast&lt;RenderBlockFlow&gt;(*obj).adjustForBorderFit(x + obj-&gt;x(), left, right);
</ins><span class="cx">                 else if (obj-&gt;style().visibility() == VISIBLE) {
</span><span class="cx">                     // We are a replaced element or some kind of non-block-flow object.
</span><span class="cx">                     left = std::min(left, x + obj-&gt;x());
</span><span class="lines">@@ -3209,10 +3209,10 @@
</span><span class="cx">                 return box-&gt;lineBottom() + (includeBottom ? (block.borderBottom() + block.paddingBottom()) : LayoutUnit());
</span><span class="cx">         }
</span><span class="cx">     } else {
</span><del>-        RenderBox* normalFlowChildWithoutLines = 0;
</del><ins>+        RenderBox* normalFlowChildWithoutLines = nullptr;
</ins><span class="cx">         for (auto obj = block.firstChildBox(); obj; obj = obj-&gt;nextSiblingBox()) {
</span><del>-            if (obj-&gt;isRenderBlockFlow() &amp;&amp; shouldCheckLines(toRenderBlockFlow(*obj))) {
-                int result = getHeightForLineCount(toRenderBlockFlow(*obj), lineCount, false, count);
</del><ins>+            if (is&lt;RenderBlockFlow&gt;(*obj) &amp;&amp; shouldCheckLines(downcast&lt;RenderBlockFlow&gt;(*obj))) {
+                int result = getHeightForLineCount(downcast&lt;RenderBlockFlow&gt;(*obj), lineCount, false, count);
</ins><span class="cx">                 if (result != -1)
</span><span class="cx">                     return result + obj-&gt;y() + (includeBottom ? (block.borderBottom() + block.paddingBottom()) : LayoutUnit());
</span><span class="cx">             } else if (!obj-&gt;isFloatingOrOutOfFlowPositioned())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.h (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -471,7 +471,7 @@
</span><span class="cx">     virtual void paintInlineChildren(PaintInfo&amp;, const LayoutPoint&amp;) override;
</span><span class="cx">     virtual void paintFloats(PaintInfo&amp;, const LayoutPoint&amp;, bool preservePhase = false) override;
</span><span class="cx"> 
</span><del>-    virtual void moveAllChildrenIncludingFloatsTo(RenderBlock* toBlock, bool fullRemoveInsert) override;
</del><ins>+    virtual void moveAllChildrenIncludingFloatsTo(RenderBlock&amp; toBlock, bool fullRemoveInsert) override;
</ins><span class="cx">     virtual void repaintOverhangingFloats(bool paintAllDescendants) override final;
</span><span class="cx">     virtual void clipOutFloatingObjects(RenderBlock&amp;, const PaintInfo*, const LayoutPoint&amp;, const LayoutSize&amp;) override;
</span><span class="cx"> 
</span><span class="lines">@@ -621,11 +621,9 @@
</span><span class="cx">     friend class LineWidth; // Needs to know FloatingObject
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-RENDER_OBJECT_TYPE_CASTS(RenderBlockFlow, isRenderBlockFlow())
-
</del><span class="cx"> inline bool RenderElement::isRenderNamedFlowFragmentContainer() const
</span><span class="cx"> {
</span><del>-    return isRenderBlockFlow() &amp;&amp; toRenderBlockFlow(this)-&gt;renderNamedFlowFragment();
</del><ins>+    return is&lt;RenderBlockFlow&gt;(*this) &amp;&amp; downcast&lt;RenderBlockFlow&gt;(*this).renderNamedFlowFragment();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockLineLayoutcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -190,16 +190,16 @@
</span><span class="cx">     // See if we have an unconstructed line box for this object that is also
</span><span class="cx">     // the last item on the line.
</span><span class="cx">     unsigned lineDepth = 1;
</span><del>-    InlineFlowBox* parentBox = 0;
-    InlineFlowBox* result = 0;
</del><ins>+    InlineFlowBox* parentBox = nullptr;
+    InlineFlowBox* result = nullptr;
</ins><span class="cx">     bool hasDefaultLineBoxContain = style().lineBoxContain() == RenderStyle::initialLineBoxContain();
</span><span class="cx">     do {
</span><del>-        ASSERT_WITH_SECURITY_IMPLICATION(obj-&gt;isRenderInline() || obj == this);
</del><ins>+        ASSERT_WITH_SECURITY_IMPLICATION(is&lt;RenderInline&gt;(*obj) || obj == this);
</ins><span class="cx"> 
</span><del>-        RenderInline* inlineFlow = (obj != this) ? toRenderInline(obj) : 0;
</del><ins>+        RenderInline* inlineFlow = obj != this ? downcast&lt;RenderInline&gt;(obj) : nullptr;
</ins><span class="cx"> 
</span><span class="cx">         // Get the last box we made for this render object.
</span><del>-        parentBox = inlineFlow ? inlineFlow-&gt;lastLineBox() : toRenderBlockFlow(obj)-&gt;lastRootBox();
</del><ins>+        parentBox = inlineFlow ? inlineFlow-&gt;lastLineBox() : downcast&lt;RenderBlockFlow&gt;(*obj).lastRootBox();
</ins><span class="cx"> 
</span><span class="cx">         // If this box or its ancestor is constructed then it is from a previous line, and we need
</span><span class="cx">         // to make a new box for our line.  If this box or its ancestor is unconstructed but it has
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -408,8 +408,8 @@
</span><span class="cx">         if (viewStyleChanged &amp;&amp; view().multiColumnFlowThread())
</span><span class="cx">             view().updateStylesForColumnChildren();
</span><span class="cx">         
</span><del>-        if (rootStyleChanged &amp;&amp; rootRenderer &amp;&amp; rootRenderer-&gt;isRenderBlockFlow() &amp;&amp; toRenderBlockFlow(rootRenderer)-&gt;multiColumnFlowThread())
-            toRenderBlockFlow(rootRenderer)-&gt;updateStylesForColumnChildren();
</del><ins>+        if (rootStyleChanged &amp;&amp; is&lt;RenderBlockFlow&gt;(rootRenderer) &amp;&amp; downcast&lt;RenderBlockFlow&gt;(*rootRenderer).multiColumnFlowThread())
+            downcast&lt;RenderBlockFlow&gt;(*rootRenderer).updateStylesForColumnChildren();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(CSS_SHAPES)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxModelObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -611,11 +611,11 @@
</span><span class="cx">         const RootInlineBox&amp; rootBox = box-&gt;root();
</span><span class="cx">         box-&gt;paint(info, LayoutPoint(scrolledPaintRect.x() - box-&gt;x(), scrolledPaintRect.y() - box-&gt;y()), rootBox.lineTop(), rootBox.lineBottom());
</span><span class="cx">     } else if (isRenderNamedFlowFragmentContainer()) {
</span><del>-        RenderNamedFlowFragment* region = toRenderBlockFlow(this)-&gt;renderNamedFlowFragment();
-        if (region-&gt;isValid())
-            region-&gt;flowThread()-&gt;layer()-&gt;paintNamedFlowThreadInsideRegion(maskImageContext, region, maskRect, maskRect.location(), PaintBehaviorForceBlackText, RenderLayer::PaintLayerTemporaryClipRects);
</del><ins>+        RenderNamedFlowFragment&amp; region = *downcast&lt;RenderBlockFlow&gt;(*this).renderNamedFlowFragment();
+        if (region.isValid())
+            region.flowThread()-&gt;layer()-&gt;paintNamedFlowThreadInsideRegion(maskImageContext, &amp;region, maskRect, maskRect.location(), PaintBehaviorForceBlackText, RenderLayer::PaintLayerTemporaryClipRects);
</ins><span class="cx">     } else {
</span><del>-        LayoutSize localOffset = isBox() ? toRenderBox(this)-&gt;locationOffset() : LayoutSize();
</del><ins>+        LayoutSize localOffset = is&lt;RenderBox&gt;(*this) ? downcast&lt;RenderBox&gt;(*this).locationOffset() : LayoutSize();
</ins><span class="cx">         paint(info, scrolledPaintRect.location() - localOffset);
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderDeprecatedFlexibleBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -942,18 +942,18 @@
</span><span class="cx"> 
</span><span class="cx">         child-&gt;clearOverrideSize();
</span><span class="cx">         if (relayoutChildren || (child-&gt;isReplaced() &amp;&amp; (child-&gt;style().width().isPercent() || child-&gt;style().height().isPercent()))
</span><del>-            || (child-&gt;style().height().isAuto() &amp;&amp; child-&gt;isRenderBlockFlow())) {
</del><ins>+            || (child-&gt;style().height().isAuto() &amp;&amp; is&lt;RenderBlockFlow&gt;(*child))) {
</ins><span class="cx">             child-&gt;setChildNeedsLayout(MarkOnlyThis);
</span><span class="cx"> 
</span><span class="cx">             // Dirty all the positioned objects.
</span><del>-            if (child-&gt;isRenderBlockFlow()) {
-                toRenderBlockFlow(child)-&gt;markPositionedObjectsForLayout();
-                toRenderBlockFlow(child)-&gt;clearTruncation();
</del><ins>+            if (is&lt;RenderBlockFlow&gt;(*child)) {
+                downcast&lt;RenderBlockFlow&gt;(*child).markPositionedObjectsForLayout();
+                downcast&lt;RenderBlockFlow&gt;(*child).clearTruncation();
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         child-&gt;layoutIfNeeded();
</span><del>-        if (child-&gt;style().height().isAuto() &amp;&amp; child-&gt;isRenderBlockFlow())
-            maxLineCount = std::max(maxLineCount, toRenderBlockFlow(child)-&gt;lineCount());
</del><ins>+        if (child-&gt;style().height().isAuto() &amp;&amp; is&lt;RenderBlockFlow&gt;(*child))
+            maxLineCount = std::max(maxLineCount, downcast&lt;RenderBlockFlow&gt;(*child).lineCount());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Get the number of lines and then alter all block flow children with auto height to use the
</span><span class="lines">@@ -964,15 +964,15 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
</span><del>-        if (childDoesNotAffectWidthOrFlexing(child) || !child-&gt;style().height().isAuto() || !child-&gt;isRenderBlockFlow())
</del><ins>+        if (childDoesNotAffectWidthOrFlexing(child) || !child-&gt;style().height().isAuto() || !is&lt;RenderBlockFlow&gt;(*child))
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        RenderBlockFlow* blockChild = toRenderBlockFlow(child);
-        int lineCount = blockChild-&gt;lineCount();
</del><ins>+        RenderBlockFlow&amp; blockChild = downcast&lt;RenderBlockFlow&gt;(*child);
+        int lineCount = blockChild.lineCount();
</ins><span class="cx">         if (lineCount &lt;= numVisibleLines)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        LayoutUnit newHeight = blockChild-&gt;heightForLineCount(numVisibleLines);
</del><ins>+        LayoutUnit newHeight = blockChild.heightForLineCount(numVisibleLines);
</ins><span class="cx">         if (newHeight == child-&gt;height())
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="lines">@@ -985,11 +985,11 @@
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="cx">         // Get the last line
</span><del>-        RootInlineBox* lastLine = blockChild-&gt;lineAtIndex(lineCount - 1);
</del><ins>+        RootInlineBox* lastLine = blockChild.lineAtIndex(lineCount - 1);
</ins><span class="cx">         if (!lastLine)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        RootInlineBox* lastVisibleLine = blockChild-&gt;lineAtIndex(numVisibleLines - 1);
</del><ins>+        RootInlineBox* lastVisibleLine = blockChild.lineAtIndex(numVisibleLines - 1);
</ins><span class="cx">         if (!lastVisibleLine)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="lines">@@ -1005,7 +1005,7 @@
</span><span class="cx">         if (anchorBox &amp;&amp; anchorBox-&gt;renderer().style().isLink())
</span><span class="cx">             totalWidth = anchorBox-&gt;logicalWidth() + font.width(constructTextRun(this, font, ellipsisAndSpace, 2, style()));
</span><span class="cx">         else {
</span><del>-            anchorBox = 0;
</del><ins>+            anchorBox = nullptr;
</ins><span class="cx">             totalWidth = font.width(constructTextRun(this, font, &amp;horizontalEllipsis, 1, style()));
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1042,12 +1042,12 @@
</span><span class="cx"> 
</span><span class="cx">         child-&gt;clearOverrideSize();
</span><span class="cx">         if ((child-&gt;isReplaced() &amp;&amp; (child-&gt;style().width().isPercent() || child-&gt;style().height().isPercent()))
</span><del>-            || (child-&gt;style().height().isAuto() &amp;&amp; child-&gt;isRenderBlock())) {
</del><ins>+            || (child-&gt;style().height().isAuto() &amp;&amp; is&lt;RenderBlockFlow&gt;(*child))) {
</ins><span class="cx">             child-&gt;setChildNeedsLayout();
</span><span class="cx"> 
</span><del>-            if (child-&gt;isRenderBlockFlow()) {
-                toRenderBlockFlow(child)-&gt;markPositionedObjectsForLayout();
-                toRenderBlockFlow(child)-&gt;clearTruncation();
</del><ins>+            if (is&lt;RenderBlockFlow&gt;(*child)) {
+                downcast&lt;RenderBlockFlow&gt;(*child).markPositionedObjectsForLayout();
+                downcast&lt;RenderBlockFlow&gt;(*child).clearTruncation();
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -92,10 +92,10 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderFlowThread::removeFlowChildInfo(RenderObject* child)
</span><span class="cx"> {
</span><del>-    if (child-&gt;isRenderBlockFlow())
-        removeLineRegionInfo(toRenderBlockFlow(child));
-    if (child-&gt;isBox())
-        removeRenderBoxRegionInfo(toRenderBox(child));
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(*child))
+        removeLineRegionInfo(downcast&lt;RenderBlockFlow&gt;(child));
+    if (is&lt;RenderBox&gt;(*child))
+        removeRenderBoxRegionInfo(downcast&lt;RenderBox&gt;(child));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -412,9 +412,9 @@
</span><span class="cx">                 if (didRepaint &amp;&amp; renderer().isRenderNamedFlowFragmentContainer()) {
</span><span class="cx">                     // If we just repainted a region, we must also repaint the flow thread since it is the one
</span><span class="cx">                     // doing the actual painting of the flowed content.
</span><del>-                    RenderNamedFlowFragment* region = toRenderBlockFlow(&amp;renderer())-&gt;renderNamedFlowFragment();
-                    if (region-&gt;isValid())
-                        region-&gt;flowThread()-&gt;layer()-&gt;repaintIncludingDescendants();
</del><ins>+                    RenderNamedFlowFragment&amp; region = *downcast&lt;RenderBlockFlow&gt;(renderer()).renderNamedFlowFragment();
+                    if (region.isValid())
+                        region.flowThread()-&gt;layer()-&gt;repaintIncludingDescendants();
</ins><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -1579,12 +1579,12 @@
</span><span class="cx"> {
</span><span class="cx">     // If this is a region, then the painting is actually done by its flow thread's layer.
</span><span class="cx">     if (layer.renderer().isRenderNamedFlowFragmentContainer()) {
</span><del>-        RenderBlockFlow* regionContainer = toRenderBlockFlow(&amp;layer.renderer());
-        RenderNamedFlowFragment* region = regionContainer-&gt;renderNamedFlowFragment();
-        RenderLayer* flowThreadLayer = region-&gt;flowThread()-&gt;layer();
</del><ins>+        RenderBlockFlow&amp; regionContainer = downcast&lt;RenderBlockFlow&gt;(layer.renderer());
+        RenderNamedFlowFragment&amp; region = *regionContainer.renderNamedFlowFragment();
+        RenderLayer* flowThreadLayer = region.flowThread()-&gt;layer();
</ins><span class="cx">         if (flowThreadLayer &amp;&amp; (!layer.reflection() || layer.reflectionLayer() != flowThreadLayer)) {
</span><span class="cx">             LayoutRect flowThreadClipRect = transparencyClipBox(*flowThreadLayer, rootLayer, transparencyBehavior, DescendantsOfTransparencyClipBox, paintBehavior);
</span><del>-            LayoutSize moveOffset = (regionContainer-&gt;contentBoxRect().location() + layer.offsetFromAncestor(flowThreadLayer)) - region-&gt;flowThreadPortionRect().location();
</del><ins>+            LayoutSize moveOffset = (regionContainer.contentBoxRect().location() + layer.offsetFromAncestor(flowThreadLayer)) - region.flowThreadPortionRect().location();
</ins><span class="cx">             flowThreadClipRect.move(moveOffset);
</span><span class="cx">             
</span><span class="cx">             clipRect.unite(flowThreadClipRect);
</span><span class="lines">@@ -6160,15 +6160,15 @@
</span><span class="cx"> void RenderLayer::repaintIncludingDescendants()
</span><span class="cx"> {
</span><span class="cx">     renderer().repaint();
</span><del>-    for (RenderLayer* curr = firstChild(); curr; curr = curr-&gt;nextSibling())
-        curr-&gt;repaintIncludingDescendants();
</del><ins>+    for (RenderLayer* current = firstChild(); current; current = current-&gt;nextSibling())
+        current-&gt;repaintIncludingDescendants();
</ins><span class="cx"> 
</span><span class="cx">     // If this is a region, we must also repaint the flow thread's layer since it is the one
</span><span class="cx">     // doing the actual painting of the flowed content, but only if the region is valid.
</span><span class="cx">     if (renderer().isRenderNamedFlowFragmentContainer()) {
</span><del>-        RenderNamedFlowFragment* region = toRenderBlockFlow(renderer()).renderNamedFlowFragment();
-        if (region-&gt;isValid())
-            region-&gt;flowThread()-&gt;layer()-&gt;repaintIncludingDescendants();
</del><ins>+        RenderNamedFlowFragment&amp; region = *downcast&lt;RenderBlockFlow&gt;(renderer()).renderNamedFlowFragment();
+        if (region.isValid())
+            region.flowThread()-&gt;layer()-&gt;repaintIncludingDescendants();
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -6730,8 +6730,8 @@
</span><span class="cx">     if (!renderer().isRenderNamedFlowFragmentContainer())
</span><span class="cx">         return;
</span><span class="cx">     
</span><del>-    RenderBlockFlow* renderNamedFlowFragmentContainer = toRenderBlockFlow(&amp;renderer());
-    RenderNamedFlowFragment* flowFragment = renderNamedFlowFragmentContainer-&gt;renderNamedFlowFragment();
</del><ins>+    RenderBlockFlow&amp; renderNamedFlowFragmentContainer = downcast&lt;RenderBlockFlow&gt;(renderer());
+    RenderNamedFlowFragment* flowFragment = renderNamedFlowFragmentContainer.renderNamedFlowFragment();
</ins><span class="cx">     if (!flowFragment-&gt;isValid())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -6740,7 +6740,7 @@
</span><span class="cx"> 
</span><span class="cx">     LayoutRect regionClipRect = LayoutRect::infiniteRect();
</span><span class="cx">     if (flowFragment-&gt;shouldClipFlowThreadContent()) {
</span><del>-        regionClipRect = renderNamedFlowFragmentContainer-&gt;paddingBoxRect();
</del><ins>+        regionClipRect = renderNamedFlowFragmentContainer.paddingBoxRect();
</ins><span class="cx"> 
</span><span class="cx">         // When the layer of the flow fragment's container is composited, the flow fragment container receives a
</span><span class="cx">         // GraphicsLayer of its own so the clipping coordinates (caused by overflow:hidden) must be relative to the
</span><span class="lines">@@ -6778,23 +6778,23 @@
</span><span class="cx">     const HitTestingTransformState* unflattenedTransformState, bool depthSortDescendants)
</span><span class="cx"> {
</span><span class="cx">     if (!renderer().isRenderNamedFlowFragmentContainer())
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RenderNamedFlowFragment* region = toRenderBlockFlow(&amp;renderer())-&gt;renderNamedFlowFragment();
-    if (!region-&gt;isValid())
-        return 0;
</del><ins>+    RenderNamedFlowFragment&amp; region = *downcast&lt;RenderBlockFlow&gt;(renderer()).renderNamedFlowFragment();
+    if (!region.isValid())
+        return nullptr;
</ins><span class="cx"> 
</span><del>-    RenderFlowThread* flowThread = region-&gt;flowThread();
-    LayoutPoint portionLocation = region-&gt;flowThreadPortionRect().location();
</del><ins>+    RenderFlowThread* flowThread = region.flowThread();
+    LayoutPoint portionLocation = region.flowThreadPortionRect().location();
</ins><span class="cx">     if (flowThread-&gt;style().isFlippedBlocksWritingMode()) {
</span><span class="cx">         // The portion location coordinate must be translated into physical coordinates.
</span><span class="cx">         if (flowThread-&gt;style().isHorizontalWritingMode())
</span><del>-            portionLocation.setY(flowThread-&gt;height() - (portionLocation.y() + region-&gt;contentHeight()));
</del><ins>+            portionLocation.setY(flowThread-&gt;height() - (portionLocation.y() + region.contentHeight()));
</ins><span class="cx">         else
</span><del>-            portionLocation.setX(flowThread-&gt;width() - (portionLocation.x() + region-&gt;contentWidth()));
</del><ins>+            portionLocation.setX(flowThread-&gt;width() - (portionLocation.x() + region.contentWidth()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    LayoutRect regionContentBox = toRenderBlockFlow(&amp;renderer())-&gt;contentBoxRect();
</del><ins>+    LayoutRect regionContentBox = downcast&lt;RenderBlockFlow&gt;(renderer()).contentBoxRect();
</ins><span class="cx"> 
</span><span class="cx">     RenderLayer* resultLayer = nullptr;
</span><span class="cx">     for (int i = fragments.size() - 1; i &gt;= 0; --i) {
</span><span class="lines">@@ -6803,7 +6803,7 @@
</span><span class="cx">         if (!fragment.backgroundRect.intersects(hitTestLocation))
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        LayoutSize hitTestOffset = portionLocation - (fragment.layerBounds.location() + regionContentBox.location()) + region-&gt;fragmentContainer().scrolledContentOffset();
</del><ins>+        LayoutSize hitTestOffset = portionLocation - (fragment.layerBounds.location() + regionContentBox.location()) + region.fragmentContainer().scrolledContentOffset();
</ins><span class="cx"> 
</span><span class="cx">         // Always ignore clipping, since the RenderFlowThread has nothing to do with the bounds of the FrameView.
</span><span class="cx">         HitTestRequest newRequest(request.type() | HitTestRequest::IgnoreClipping | HitTestRequest::DisallowShadowContent);
</span><span class="lines">@@ -6817,10 +6817,10 @@
</span><span class="cx">         hitTestRectInFlowThread.expand(LayoutSize(fabs((double)hitTestOffset.width()), fabs((double)hitTestOffset.height())));
</span><span class="cx"> 
</span><span class="cx">         CurrentRenderFlowThreadMaintainer flowThreadMaintainer(flowThread);
</span><del>-        CurrentRenderRegionMaintainer regionMaintainer(*region);
</del><ins>+        CurrentRenderRegionMaintainer regionMaintainer(region);
</ins><span class="cx"> 
</span><span class="cx">         HitTestResult tempResult(result.hitTestLocation());
</span><del>-        RenderLayer* hitLayer = flowThread-&gt;layer()-&gt;hitTestLayer(flowThread-&gt;layer(), 0, newRequest, tempResult, hitTestRectInFlowThread, newHitTestLocation, false, transformState, zOffsetForDescendants);
</del><ins>+        RenderLayer* hitLayer = flowThread-&gt;layer()-&gt;hitTestLayer(flowThread-&gt;layer(), nullptr, newRequest, tempResult, hitTestRectInFlowThread, newHitTestLocation, false, transformState, zOffsetForDescendants);
</ins><span class="cx">         if (result.isRectBasedTest())
</span><span class="cx">             result.append(tempResult);
</span><span class="cx">         if (isHitCandidate(hitLayer, depthSortDescendants, zOffset, unflattenedTransformState)) {
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLayerCompositorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderLayerCompositor.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -1287,7 +1287,7 @@
</span><span class="cx">         // anonymous RenderRegion, but first we need to make sure that the parent itself of the region is going to
</span><span class="cx">         // have a composited layer. We only want to make regions composited when there's an actual layer that we
</span><span class="cx">         // need to move to that region.
</span><del>-        computeRegionCompositingRequirements(toRenderBlockFlow(layer.renderer()).renderNamedFlowFragment(), overlapMap, childState, layersChanged, anyDescendantHas3DTransform);
</del><ins>+        computeRegionCompositingRequirements(downcast&lt;RenderBlockFlow&gt;(layer.renderer()).renderNamedFlowFragment(), overlapMap, childState, layersChanged, anyDescendantHas3DTransform);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     
</span><span class="lines">@@ -1544,7 +1544,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (layer.renderer().isRenderNamedFlowFragmentContainer())
</span><del>-        rebuildRegionCompositingLayerTree(toRenderBlockFlow(layer.renderer()).renderNamedFlowFragment(), layerChildren, depth + 1);
</del><ins>+        rebuildRegionCompositingLayerTree(downcast&lt;RenderBlockFlow&gt;(layer.renderer()).renderNamedFlowFragment(), layerChildren, depth + 1);
</ins><span class="cx"> 
</span><span class="cx">     if (Vector&lt;RenderLayer*&gt;* normalFlowList = layer.normalFlowList()) {
</span><span class="cx">         for (size_t i = 0, size = normalFlowList-&gt;size(); i &lt; size; ++i)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -183,9 +183,9 @@
</span><span class="cx">     while ((it = m_spannerMap.begin()) != m_spannerMap.end()) {
</span><span class="cx">         RenderBox* spanner = it-&gt;key;
</span><span class="cx">         RenderMultiColumnSpannerPlaceholder* placeholder = it-&gt;value;
</span><del>-        RenderBlockFlow* originalContainer = toRenderBlockFlow(placeholder-&gt;parent());
</del><ins>+        RenderBlockFlow&amp; originalContainer = downcast&lt;RenderBlockFlow&gt;(*placeholder-&gt;parent());
</ins><span class="cx">         multicolContainer-&gt;removeChild(*spanner);
</span><del>-        originalContainer-&gt;addChild(spanner, placeholder);
</del><ins>+        originalContainer.addChild(spanner, placeholder);
</ins><span class="cx">         placeholder-&gt;destroy();
</span><span class="cx">         m_spannerMap.remove(it);
</span><span class="cx">     }
</span><span class="lines">@@ -296,7 +296,7 @@
</span><span class="cx">         // so that they live among the column sets. This simplifies the layout implementation, and
</span><span class="cx">         // basically just relies on regular block layout done by the RenderBlockFlow that
</span><span class="cx">         // establishes the multicol container.
</span><del>-        RenderBlockFlow* container = toRenderBlockFlow(descendant-&gt;parent());
</del><ins>+        RenderBlockFlow* container = downcast&lt;RenderBlockFlow&gt;(descendant-&gt;parent());
</ins><span class="cx">         RenderMultiColumnSet* setToSplit = nullptr;
</span><span class="cx">         if (nextRendererInFlowThread) {
</span><span class="cx">             setToSplit = findSetRendering(descendant);
</span><span class="lines">@@ -311,7 +311,7 @@
</span><span class="cx">         // content before and after the spanner, so that it becomes separate line boxes. Secondly,
</span><span class="cx">         // this placeholder serves as a break point for column sets, so that, when encountered, we
</span><span class="cx">         // end flowing one column set and move to the next one.
</span><del>-        RenderMultiColumnSpannerPlaceholder* placeholder = RenderMultiColumnSpannerPlaceholder::createAnonymous(this, toRenderBox(descendant), &amp;container-&gt;style());
</del><ins>+        RenderMultiColumnSpannerPlaceholder* placeholder = RenderMultiColumnSpannerPlaceholder::createAnonymous(this, downcast&lt;RenderBox&gt;(descendant), &amp;container-&gt;style());
</ins><span class="cx">         container-&gt;addChild(placeholder, descendant-&gt;nextSibling());
</span><span class="cx">         container-&gt;removeChild(*descendant);
</span><span class="cx">         
</span><span class="lines">@@ -329,14 +329,14 @@
</span><span class="cx">         nextDescendant = placeholder;
</span><span class="cx">     } else {
</span><span class="cx">         // This is regular multicol content, i.e. not part of a spanner.
</span><del>-        if (nextRendererInFlowThread &amp;&amp; nextRendererInFlowThread-&gt;isRenderMultiColumnSpannerPlaceholder()) {
</del><ins>+        if (is&lt;RenderMultiColumnSpannerPlaceholder&gt;(nextRendererInFlowThread)) {
</ins><span class="cx">             // Inserted right before a spanner. Is there a set for us there?
</span><del>-            RenderMultiColumnSpannerPlaceholder* placeholder = toRenderMultiColumnSpannerPlaceholder(nextRendererInFlowThread);
-            if (RenderObject* previous = placeholder-&gt;spanner()-&gt;previousSibling()) {
-                if (previous-&gt;isRenderMultiColumnSet())
</del><ins>+            RenderMultiColumnSpannerPlaceholder&amp; placeholder = downcast&lt;RenderMultiColumnSpannerPlaceholder&gt;(*nextRendererInFlowThread);
+            if (RenderObject* previous = placeholder.spanner()-&gt;previousSibling()) {
+                if (is&lt;RenderMultiColumnSet&gt;(*previous))
</ins><span class="cx">                     return nextDescendant; // There's already a set there. Nothing to do.
</span><span class="cx">             }
</span><del>-            insertBeforeMulticolChild = placeholder-&gt;spanner();
</del><ins>+            insertBeforeMulticolChild = placeholder.spanner();
</ins><span class="cx">         } else if (RenderMultiColumnSet* lastSet = lastMultiColumnSet()) {
</span><span class="cx">             // This child is not an immediate predecessor of a spanner, which means that if this
</span><span class="cx">             // child precedes a spanner at all, there has to be a column set created for us there
</span><span class="lines">@@ -383,13 +383,13 @@
</span><span class="cx">                 
</span><span class="cx">                 // Insert after the placeholder, but don't let a notification happen.
</span><span class="cx">                 gShiftingSpanner = true;
</span><del>-                RenderBlockFlow* ancestorBlock = toRenderBlockFlow(spanner-&gt;parent());
-                ancestorBlock-&gt;moveChildTo(placeholder-&gt;parentBox(), spanner, placeholder-&gt;nextSibling(), true);
</del><ins>+                RenderBlockFlow&amp; ancestorBlock = downcast&lt;RenderBlockFlow&gt;(*spanner-&gt;parent());
+                ancestorBlock.moveChildTo(placeholder-&gt;parentBox(), spanner, placeholder-&gt;nextSibling(), true);
</ins><span class="cx">                 gShiftingSpanner = false;
</span><span class="cx">                 
</span><span class="cx">                 // We have to nuke the placeholder, since the ancestor already lost the mapping to it when
</span><span class="cx">                 // we shifted the placeholder down into this flow thread.
</span><del>-                ancestorBlock-&gt;multiColumnFlowThread()-&gt;handleSpannerRemoval(spanner);
</del><ins>+                ancestorBlock.multiColumnFlowThread()-&gt;handleSpannerRemoval(spanner);
</ins><span class="cx">                 placeholder-&gt;destroy();
</span><span class="cx">                 
</span><span class="cx">                 // Now we process the spanner.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void removeFlowChildInfo(RenderObject*) override;
</span><span class="cx"> 
</span><del>-    RenderBlockFlow* multiColumnBlockFlow() const { return toRenderBlockFlow(parent()); }
</del><ins>+    RenderBlockFlow* multiColumnBlockFlow() const { return downcast&lt;RenderBlockFlow&gt;(parent()); }
</ins><span class="cx"> 
</span><span class="cx">     RenderMultiColumnSet* firstMultiColumnSet() const;
</span><span class="cx">     RenderMultiColumnSet* lastMultiColumnSet() const;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -137,8 +137,8 @@
</span><span class="cx"> 
</span><span class="cx"> LayoutUnit RenderMultiColumnSet::heightAdjustedForSetOffset(LayoutUnit height) const
</span><span class="cx"> {
</span><del>-    RenderBlockFlow* multicolBlock = toRenderBlockFlow(parent());
-    LayoutUnit contentLogicalTop = logicalTop() - multicolBlock-&gt;borderAndPaddingBefore();
</del><ins>+    RenderBlockFlow&amp; multicolBlock = downcast&lt;RenderBlockFlow&gt;(*parent());
+    LayoutUnit contentLogicalTop = logicalTop() - multicolBlock.borderAndPaddingBefore();
</ins><span class="cx"> 
</span><span class="cx">     height -= contentLogicalTop;
</span><span class="cx">     return std::max(height, LayoutUnit::fromPixel(1)); // Let's avoid zero height, as that would probably cause an infinite amount of columns to be created.
</span><span class="lines">@@ -421,10 +421,10 @@
</span><span class="cx"> {
</span><span class="cx">     // FIXME: Eventually we will cache the column gap when the widths of columns start varying, but for now we just
</span><span class="cx">     // go to the parent block to get the gap.
</span><del>-    RenderBlockFlow* parentBlock = toRenderBlockFlow(parent());
-    if (parentBlock-&gt;style().hasNormalColumnGap())
-        return parentBlock-&gt;style().fontDescription().computedPixelSize(); // &quot;1em&quot; is recommended as the normal gap setting. Matches &lt;p&gt; margins.
-    return parentBlock-&gt;style().columnGap();
</del><ins>+    RenderBlockFlow&amp; parentBlock = downcast&lt;RenderBlockFlow&gt;(*parent());
+    if (parentBlock.style().hasNormalColumnGap())
+        return parentBlock.style().fontDescription().computedPixelSize(); // &quot;1em&quot; is recommended as the normal gap setting. Matches &lt;p&gt; margins.
+    return parentBlock.style().columnGap();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> unsigned RenderMultiColumnSet::columnCount() const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnSet.h (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnSet.h        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnSet.h        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual bool isRenderMultiColumnSet() const override { return true; }
</span><span class="cx"> 
</span><del>-    RenderBlockFlow* multiColumnBlockFlow() const { return toRenderBlockFlow(parent()); }
</del><ins>+    RenderBlockFlow* multiColumnBlockFlow() const { return downcast&lt;RenderBlockFlow&gt;(parent()); }
</ins><span class="cx">     RenderMultiColumnFlowThread* multiColumnFlowThread() const { return static_cast&lt;RenderMultiColumnFlowThread*&gt;(flowThread()); }
</span><span class="cx"> 
</span><span class="cx">     RenderMultiColumnSet* nextSiblingMultiColumnSet() const;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowFragmentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -231,7 +231,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(parent());
</span><span class="cx">     ASSERT(parent()-&gt;isRenderNamedFlowFragmentContainer());
</span><del>-    return *toRenderBlockFlow(parent());
</del><ins>+    return downcast&lt;RenderBlockFlow&gt;(*parent());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RenderLayer&amp; RenderNamedFlowFragment::fragmentContainerLayer() const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -437,8 +437,8 @@
</span><span class="cx">             depthStack.append(newFixedDepth);
</span><span class="cx"> 
</span><span class="cx">         int stackSize = depthStack.size();
</span><del>-        if (descendent-&gt;isRenderBlockFlow() &amp;&amp; !descendent-&gt;isListItem() &amp;&amp; (!stackSize || currentDepth - depthStack[stackSize - 1] &gt; TextAutoSizingFixedHeightDepth))
-            toRenderBlockFlow(descendent)-&gt;adjustComputedFontSizes(size, visibleWidth);
</del><ins>+        if (is&lt;RenderBlockFlow&gt;(*descendent) &amp;&amp; !descendent-&gt;isListItem() &amp;&amp; (!stackSize || currentDepth - depthStack[stackSize - 1] &gt; TextAutoSizingFixedHeightDepth))
+            downcast&lt;RenderBlockFlow&gt;(*descendent).adjustComputedFontSizes(size, visibleWidth);
</ins><span class="cx">         newFixedDepth = 0;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -465,8 +465,8 @@
</span><span class="cx">             depthStack.append(newFixedDepth);
</span><span class="cx"> 
</span><span class="cx">         int stackSize = depthStack.size();
</span><del>-        if (descendent-&gt;isRenderBlockFlow() &amp;&amp; !descendent-&gt;isListItem() &amp;&amp; (!stackSize || currentDepth - depthStack[stackSize - 1] &gt; TextAutoSizingFixedHeightDepth))
-            toRenderBlockFlow(descendent)-&gt;resetComputedFontSize();
</del><ins>+        if (is&lt;RenderBlockFlow&gt;(*descendent) &amp;&amp; !descendent-&gt;isListItem() &amp;&amp; (!stackSize || currentDepth - depthStack[stackSize - 1] &gt; TextAutoSizingFixedHeightDepth))
+            downcast&lt;RenderBlockFlow&gt;(*descendent).resetComputedFontSize();
</ins><span class="cx">         newFixedDepth = 0;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1429,11 +1429,11 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderObject::showLineTreeForThis() const
</span><span class="cx"> {
</span><del>-    if (!isRenderBlockFlow())
</del><ins>+    if (!is&lt;RenderBlockFlow&gt;(*this))
</ins><span class="cx">         return;
</span><span class="cx">     showRenderTreeLegend();
</span><span class="cx">     showRenderObject(false, 1);
</span><del>-    toRenderBlockFlow(this)-&gt;showLineTreeAndMark(nullptr, 2);
</del><ins>+    downcast&lt;RenderBlockFlow&gt;(*this).showLineTreeAndMark(nullptr, 2);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderObject::showRegionsInformation() const
</span><span class="lines">@@ -1586,8 +1586,8 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     showRenderObject(markedObject == this, depth);
</span><del>-    if (isRenderBlockFlow())
-        toRenderBlockFlow(this)-&gt;showLineTreeAndMark(nullptr, depth + 1);
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(*this))
+        downcast&lt;RenderBlockFlow&gt;(*this).showLineTreeAndMark(nullptr, depth + 1);
</ins><span class="cx"> 
</span><span class="cx">     for (const RenderObject* child = firstChildSlow(); child; child = child-&gt;nextSibling())
</span><span class="cx">         child-&gt;showRenderSubTreeAndMark(markedObject, depth + 1);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderText.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderText.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderText.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -1102,8 +1102,8 @@
</span><span class="cx">     setNeedsLayoutAndPrefWidthsRecalc();
</span><span class="cx">     m_knownToHaveNoOverflowAndNoFallbackFonts = false;
</span><span class="cx"> 
</span><del>-    if (parent()-&gt;isRenderBlockFlow())
-        toRenderBlockFlow(parent())-&gt;invalidateLineLayoutPath();
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(*parent()))
+        downcast&lt;RenderBlockFlow&gt;(*parent()).invalidateLineLayoutPath();
</ins><span class="cx">     
</span><span class="cx">     if (AXObjectCache* cache = document().existingAXObjectCache())
</span><span class="cx">         cache-&gt;textChanged(this);
</span><span class="lines">@@ -1149,16 +1149,16 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderText::ensureLineBoxes()
</span><span class="cx"> {
</span><del>-    if (!parent()-&gt;isRenderBlockFlow())
</del><ins>+    if (!is&lt;RenderBlockFlow&gt;(*parent()))
</ins><span class="cx">         return;
</span><del>-    toRenderBlockFlow(parent())-&gt;ensureLineBoxes();
</del><ins>+    downcast&lt;RenderBlockFlow&gt;(*parent()).ensureLineBoxes();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const SimpleLineLayout::Layout* RenderText::simpleLineLayout() const
</span><span class="cx"> {
</span><del>-    if (!parent()-&gt;isRenderBlockFlow())
</del><ins>+    if (!is&lt;RenderBlockFlow&gt;(*parent()))
</ins><span class="cx">         return nullptr;
</span><del>-    return toRenderBlockFlow(parent())-&gt;simpleLineLayout();
</del><ins>+    return downcast&lt;RenderBlockFlow&gt;(*parent()).simpleLineLayout();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> float RenderText::width(unsigned from, unsigned len, float xPos, bool firstLine, HashSet&lt;const SimpleFontData*&gt;* fallbackFonts, GlyphOverflow* glyphOverflow) const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderTreeAsTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderTreeAsText.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderTreeAsText.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RenderTreeAsText.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -542,7 +542,7 @@
</span><span class="cx">         auto&amp; text = downcast&lt;RenderText&gt;(o);
</span><span class="cx">         if (auto layout = text.simpleLineLayout()) {
</span><span class="cx">             ASSERT(!text.firstTextBox());
</span><del>-            auto resolver = runResolver(toRenderBlockFlow(*text.parent()), *layout);
</del><ins>+            auto resolver = runResolver(downcast&lt;RenderBlockFlow&gt;(*text.parent()), *layout);
</ins><span class="cx">             for (auto it = resolver.begin(), end = resolver.end(); it != end; ++it) {
</span><span class="cx">                 auto run = *it;
</span><span class="cx">                 writeIndent(ts, indent + 1);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRootInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RootInlineBox.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RootInlineBox.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/RootInlineBox.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -630,8 +630,8 @@
</span><span class="cx"> 
</span><span class="cx">     LayoutSize offsetToBlockBefore;
</span><span class="cx">     if (RenderBlock* block = rootBox.blockFlow().blockBeforeWithinSelectionRoot(offsetToBlockBefore)) {
</span><del>-        if (block-&gt;isRenderBlockFlow()) {
-            if (RootInlineBox* lastLine = toRenderBlockFlow(block)-&gt;lastRootBox()) {
</del><ins>+        if (is&lt;RenderBlockFlow&gt;(*block)) {
+            if (RootInlineBox* lastLine = downcast&lt;RenderBlockFlow&gt;(*block).lastRootBox()) {
</ins><span class="cx">                 RenderObject::SelectionState lastLineSelectionState = lastLine-&gt;selectionState();
</span><span class="cx">                 if (lastLineSelectionState != RenderObject::SelectionInside &amp;&amp; lastLineSelectionState != RenderObject::SelectionStart)
</span><span class="cx">                     return top;
</span><span class="lines">@@ -678,7 +678,7 @@
</span><span class="cx"> 
</span><span class="cx"> RenderBlockFlow&amp; RootInlineBox::blockFlow() const
</span><span class="cx"> {
</span><del>-    return toRenderBlockFlow(renderer());
</del><ins>+    return downcast&lt;RenderBlockFlow&gt;(renderer());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static bool isEditableLeaf(InlineBox* leaf)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingSimpleLineLayoutFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/SimpleLineLayoutFunctions.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -140,7 +140,7 @@
</span><span class="cx"> 
</span><span class="cx"> IntRect computeTextBoundingBox(const RenderText&amp; textRenderer, const Layout&amp; layout)
</span><span class="cx"> {
</span><del>-    auto resolver = lineResolver(toRenderBlockFlow(*textRenderer.parent()), layout);
</del><ins>+    auto resolver = lineResolver(downcast&lt;RenderBlockFlow&gt;(*textRenderer.parent()), layout);
</ins><span class="cx">     auto it = resolver.begin();
</span><span class="cx">     auto end = resolver.end();
</span><span class="cx">     if (it == end)
</span><span class="lines">@@ -167,7 +167,7 @@
</span><span class="cx"> 
</span><span class="cx"> IntPoint computeTextFirstRunLocation(const RenderText&amp; textRenderer, const Layout&amp; layout)
</span><span class="cx"> {
</span><del>-    auto resolver = runResolver(toRenderBlockFlow(*textRenderer.parent()), layout);
</del><ins>+    auto resolver = runResolver(downcast&lt;RenderBlockFlow&gt;(*textRenderer.parent()), layout);
</ins><span class="cx">     auto begin = resolver.begin();
</span><span class="cx">     if (begin == resolver.end())
</span><span class="cx">         return IntPoint();
</span><span class="lines">@@ -177,7 +177,7 @@
</span><span class="cx"> Vector&lt;IntRect&gt; collectTextAbsoluteRects(const RenderText&amp; textRenderer, const Layout&amp; layout, const LayoutPoint&amp; accumulatedOffset)
</span><span class="cx"> {
</span><span class="cx">     Vector&lt;IntRect&gt; rects;
</span><del>-    auto resolver = runResolver(toRenderBlockFlow(*textRenderer.parent()), layout);
</del><ins>+    auto resolver = runResolver(downcast&lt;RenderBlockFlow&gt;(*textRenderer.parent()), layout);
</ins><span class="cx">     for (auto it = resolver.begin(), end = resolver.end(); it != end; ++it) {
</span><span class="cx">         const auto&amp; run = *it;
</span><span class="cx">         auto rect = run.rect();
</span><span class="lines">@@ -189,7 +189,7 @@
</span><span class="cx"> Vector&lt;FloatQuad&gt; collectTextAbsoluteQuads(const RenderText&amp; textRenderer, const Layout&amp; layout, bool* wasFixed)
</span><span class="cx"> {
</span><span class="cx">     Vector&lt;FloatQuad&gt; quads;
</span><del>-    auto resolver = runResolver(toRenderBlockFlow(*textRenderer.parent()), layout);
</del><ins>+    auto resolver = runResolver(downcast&lt;RenderBlockFlow&gt;(*textRenderer.parent()), layout);
</ins><span class="cx">     for (auto it = resolver.begin(), end = resolver.end(); it != end; ++it) {
</span><span class="cx">         const auto&amp; run = *it;
</span><span class="cx">         auto rect = run.rect();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGTextQuerycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp (174503 => 174504)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp        2014-10-09 15:59:06 UTC (rev 174503)
+++ trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp        2014-10-09 16:17:06 UTC (rev 174504)
</span><span class="lines">@@ -50,12 +50,12 @@
</span><span class="cx"> static inline InlineFlowBox* flowBoxForRenderer(RenderObject* renderer)
</span><span class="cx"> {
</span><span class="cx">     if (!renderer)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><del>-    if (renderer-&gt;isRenderBlockFlow()) {
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(*renderer)) {
</ins><span class="cx">         // If we're given a block element, it has to be a RenderSVGText.
</span><del>-        ASSERT(renderer-&gt;isSVGText());
-        RenderBlockFlow&amp; renderBlock = toRenderBlockFlow(*renderer);
</del><ins>+        ASSERT(is&lt;RenderSVGText&gt;(*renderer));
+        RenderBlockFlow&amp; renderBlock = downcast&lt;RenderBlockFlow&gt;(*renderer);
</ins><span class="cx"> 
</span><span class="cx">         // RenderSVGText only ever contains a single line box.
</span><span class="cx">         auto flowBox = renderBlock.firstRootBox();
</span><span class="lines">@@ -63,9 +63,9 @@
</span><span class="cx">         return flowBox;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (renderer-&gt;isRenderInline()) {
</del><ins>+    if (is&lt;RenderInline&gt;(*renderer)) {
</ins><span class="cx">         // We're given a RenderSVGInline or objects that derive from it (RenderSVGTSpan / RenderSVGTextPath)
</span><del>-        RenderInline&amp; renderInline = toRenderInline(*renderer);
</del><ins>+        RenderInline&amp; renderInline = downcast&lt;RenderInline&gt;(*renderer);
</ins><span class="cx"> 
</span><span class="cx">         // RenderSVGInline only ever contains a single line box.
</span><span class="cx">         InlineFlowBox* flowBox = renderInline.firstLineBox();
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ASSERT_NOT_REACHED();
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> SVGTextQuery::SVGTextQuery(RenderObject* renderer)
</span></span></pre>
</div>
</div>

</body>
</html>