<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[174714] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/174714">174714</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2014-10-14 17:29:51 -0700 (Tue, 14 Oct 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Use is&lt;&gt;() / downcast&lt;&gt;() for RenderInline
https://bugs.webkit.org/show_bug.cgi?id=137704

Reviewed by Darin Adler.

Use is&lt;&gt;() / downcast&lt;&gt;() for RenderInline and clean up the surrounding
code.

No new tests, no behavior change.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::firstChildInContinuation):
* editing/SimplifyMarkupCommand.cpp:
(WebCore::SimplifyMarkupCommand::doApply):
* inspector/InspectorOverlay.cpp:
(WebCore::buildRendererHighlight):
* page/FrameView.cpp:
(WebCore::FrameView::paintContents):
* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
(WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
(WebCore::InlineFlowBox::attachLineBoxToRenderObject):
(WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
(WebCore::InlineFlowBox::nodeAtPoint):
(WebCore::InlineFlowBox::paint):
* rendering/InlineIterator.h:
(WebCore::bidiFirstSkippingEmptyInlines):
* rendering/LayoutState.cpp:
(WebCore::LayoutState::LayoutState):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::willBeDestroyed):
(WebCore::RenderBlock::paintObject):
(WebCore::RenderBlock::inlineElementContinuation):
(WebCore::RenderBlock::addFocusRingRects):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
(WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
* rendering/RenderBlockFlow.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::constructBidiRunsForSegment):
(WebCore::RenderBlockFlow::layoutLineBoxes):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::offsetFromContainer):
(WebCore::RenderBox::computeRectForRepaint):
(WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
(WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
(WebCore::RenderBox::computePositionedLogicalWidthUsing):
(WebCore::RenderBox::computePositionedLogicalWidthReplaced):
(WebCore::RenderBox::layoutOverflowRectForPropagation):
* rendering/RenderBoxModelObject.cpp:
(WebCore::accumulateInFlowPositionOffsets):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::willBeRemovedFromTree):
* rendering/RenderElement.h:
(WebCore::RenderElement::dirtyLinesFromChangedChild):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::addRegionsOverflowFromChild):
* rendering/RenderInline.cpp:
(WebCore::RenderInline::willBeDestroyed):
(WebCore::RenderInline::updateAlwaysCreateLineBoxes):
(WebCore::RenderInline::clippedOverflowRectForRepaint):
* rendering/RenderInline.h:
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::updateLayerPosition):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
* rendering/RenderLineBoxList.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::insertedIntoTree):
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::overflowRectForFlowThreadPortion):
(WebCore::RenderRegion::visualOverflowRectForBox):
(WebCore::RenderRegion::visualOverflowRectForBoxForPropagation):
* rendering/RenderRegion.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::willBeDestroyed):
* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::removeAllFromParent):
(WebCore::RenderTextLineBoxes::dirtyRange):
* rendering/line/BreakingContextInlineHeaders.h:
(WebCore::inlineLogicalWidth):
(WebCore::BreakingContext::handleEmptyInline):
* rendering/line/LineInlineHeaders.h:
(WebCore::requiresLineBox):
(WebCore::setStaticPositions):
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::paint):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingSimplifyMarkupCommandcpp">trunk/Source/WebCore/editing/SimplifyMarkupCommand.cpp</a></li>
<li><a href="#trunkSourceWebCoreinspectorInspectorOverlaycpp">trunk/Source/WebCore/inspector/InspectorOverlay.cpp</a></li>
<li><a href="#trunkSourceWebCorepageFrameViewcpp">trunk/Source/WebCore/page/FrameView.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineFlowBoxcpp">trunk/Source/WebCore/rendering/InlineFlowBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineIteratorh">trunk/Source/WebCore/rendering/InlineIterator.h</a></li>
<li><a href="#trunkSourceWebCorerenderingLayoutStatecpp">trunk/Source/WebCore/rendering/LayoutState.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockcpp">trunk/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowcpp">trunk/Source/WebCore/rendering/RenderBlockFlow.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowh">trunk/Source/WebCore/rendering/RenderBlockFlow.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockLineLayoutcpp">trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxcpp">trunk/Source/WebCore/rendering/RenderBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxModelObjectcpp">trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderElementcpp">trunk/Source/WebCore/rendering/RenderElement.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderElementh">trunk/Source/WebCore/rendering/RenderElement.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderInlinecpp">trunk/Source/WebCore/rendering/RenderInline.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderInlineh">trunk/Source/WebCore/rendering/RenderInline.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLayercpp">trunk/Source/WebCore/rendering/RenderLayer.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLineBoxListcpp">trunk/Source/WebCore/rendering/RenderLineBoxList.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLineBoxListh">trunk/Source/WebCore/rendering/RenderLineBoxList.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowThreadcpp">trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderObjectcpp">trunk/Source/WebCore/rendering/RenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderRegioncpp">trunk/Source/WebCore/rendering/RenderRegion.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderRegionh">trunk/Source/WebCore/rendering/RenderRegion.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderReplacedcpp">trunk/Source/WebCore/rendering/RenderReplaced.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderTextLineBoxescpp">trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderinglineBreakingContextInlineHeadersh">trunk/Source/WebCore/rendering/line/BreakingContextInlineHeaders.h</a></li>
<li><a href="#trunkSourceWebCorerenderinglineLineInlineHeadersh">trunk/Source/WebCore/rendering/line/LineInlineHeaders.h</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGInlineTextBoxcpp">trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/ChangeLog        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -1,3 +1,96 @@
</span><ins>+2014-10-14  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for RenderInline
+        https://bugs.webkit.org/show_bug.cgi?id=137704
+
+        Reviewed by Darin Adler.
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for RenderInline and clean up the surrounding
+        code.
+
+        No new tests, no behavior change.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::firstChildInContinuation):
+        * editing/SimplifyMarkupCommand.cpp:
+        (WebCore::SimplifyMarkupCommand::doApply):
+        * inspector/InspectorOverlay.cpp:
+        (WebCore::buildRendererHighlight):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineIterator.h:
+        (WebCore::bidiFirstSkippingEmptyInlines):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::willBeDestroyed):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::inlineElementContinuation):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::willBeDestroyed):
+        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
+        * rendering/RenderBlockFlow.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::constructBidiRunsForSegment):
+        (WebCore::RenderBlockFlow::layoutLineBoxes):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::layoutOverflowRectForPropagation):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::accumulateInFlowPositionOffsets):
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::willBeRemovedFromTree):
+        * rendering/RenderElement.h:
+        (WebCore::RenderElement::dirtyLinesFromChangedChild):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::addRegionsOverflowFromChild):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::willBeDestroyed):
+        (WebCore::RenderInline::updateAlwaysCreateLineBoxes):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::insertedIntoTree):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
+        (WebCore::RenderRegion::visualOverflowRectForBox):
+        (WebCore::RenderRegion::visualOverflowRectForBoxForPropagation):
+        * rendering/RenderRegion.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::willBeDestroyed):
+        * rendering/RenderTextLineBoxes.cpp:
+        (WebCore::RenderTextLineBoxes::removeAllFromParent):
+        (WebCore::RenderTextLineBoxes::dirtyRange):
+        * rendering/line/BreakingContextInlineHeaders.h:
+        (WebCore::inlineLogicalWidth):
+        (WebCore::BreakingContext::handleEmptyInline):
+        * rendering/line/LineInlineHeaders.h:
+        (WebCore::requiresLineBox):
+        (WebCore::setStaticPositions):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paint):
+
</ins><span class="cx"> 2014-10-14  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [Win] Unreviewed build fix after r174710.
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -170,11 +170,11 @@
</span><span class="cx">     auto continuation = renderer.continuation();
</span><span class="cx"> 
</span><span class="cx">     while (continuation) {
</span><del>-        if (continuation-&gt;isRenderBlock())
</del><ins>+        if (is&lt;RenderBlock&gt;(*continuation))
</ins><span class="cx">             return continuation;
</span><span class="cx">         if (RenderObject* child = continuation-&gt;firstChild())
</span><span class="cx">             return child;
</span><del>-        continuation = toRenderInline(continuation)-&gt;continuation();
</del><ins>+        continuation = downcast&lt;RenderInline&gt;(*continuation).continuation();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingSimplifyMarkupCommandcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/SimplifyMarkupCommand.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/SimplifyMarkupCommand.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/editing/SimplifyMarkupCommand.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx">         if (!startingStyle)
</span><span class="cx">             continue;
</span><span class="cx">         Node* currentNode = startingNode;
</span><del>-        Node* topNodeWithStartingStyle = 0;
</del><ins>+        Node* topNodeWithStartingStyle = nullptr;
</ins><span class="cx">         while (currentNode != rootNode) {
</span><span class="cx">             if (currentNode-&gt;parentNode() != rootNode &amp;&amp; isRemovableBlock(currentNode))
</span><span class="cx">                 nodesToRemove.append(currentNode);
</span><span class="lines">@@ -70,11 +70,11 @@
</span><span class="cx">             if (!currentNode)
</span><span class="cx">                 break;
</span><span class="cx"> 
</span><del>-            if (!currentNode-&gt;renderer() || !currentNode-&gt;renderer()-&gt;isRenderInline() || toRenderInline(currentNode-&gt;renderer())-&gt;alwaysCreateLineBoxes())
</del><ins>+            if (!is&lt;RenderInline&gt;(currentNode-&gt;renderer()) || downcast&lt;RenderInline&gt;(*currentNode-&gt;renderer()).alwaysCreateLineBoxes())
</ins><span class="cx">                 continue;
</span><span class="cx">             
</span><span class="cx">             if (currentNode-&gt;firstChild() != currentNode-&gt;lastChild()) {
</span><del>-                topNodeWithStartingStyle = 0;
</del><ins>+                topNodeWithStartingStyle = nullptr;
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             
</span></span></pre></div>
<a id="trunkSourceWebCoreinspectorInspectorOverlaycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorOverlay.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/inspector/InspectorOverlay.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/inspector/InspectorOverlay.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -97,43 +97,43 @@
</span><span class="cx">         renderer-&gt;absoluteQuads(highlight-&gt;quads);
</span><span class="cx">         for (size_t i = 0; i &lt; highlight-&gt;quads.size(); ++i)
</span><span class="cx">             contentsQuadToCoordinateSystem(mainView, containingView, highlight-&gt;quads[i], coordinateSystem);
</span><del>-    } else if (renderer-&gt;isBox() || renderer-&gt;isRenderInline()) {
</del><ins>+    } else if (is&lt;RenderBox&gt;(*renderer) || is&lt;RenderInline&gt;(*renderer)) {
</ins><span class="cx">         LayoutRect contentBox;
</span><span class="cx">         LayoutRect paddingBox;
</span><span class="cx">         LayoutRect borderBox;
</span><span class="cx">         LayoutRect marginBox;
</span><span class="cx"> 
</span><del>-        if (renderer-&gt;isBox()) {
-            RenderBox* renderBox = toRenderBox(renderer);
</del><ins>+        if (is&lt;RenderBox&gt;(*renderer)) {
+            auto&amp; renderBox = downcast&lt;RenderBox&gt;(*renderer);
</ins><span class="cx"> 
</span><del>-            LayoutBoxExtent margins(renderBox-&gt;marginTop(), renderBox-&gt;marginRight(), renderBox-&gt;marginBottom(), renderBox-&gt;marginLeft());
</del><ins>+            LayoutBoxExtent margins(renderBox.marginTop(), renderBox.marginRight(), renderBox.marginBottom(), renderBox.marginLeft());
</ins><span class="cx"> 
</span><del>-            if (!renderBox-&gt;isOutOfFlowPositioned() &amp;&amp; region) {
</del><ins>+            if (!renderBox.isOutOfFlowPositioned() &amp;&amp; region) {
</ins><span class="cx">                 RenderBox::LogicalExtentComputedValues computedValues;
</span><del>-                renderBox-&gt;computeLogicalWidthInRegion(computedValues, region);
-                margins.mutableLogicalLeft(renderBox-&gt;style().writingMode()) = computedValues.m_margins.m_start;
-                margins.mutableLogicalRight(renderBox-&gt;style().writingMode()) = computedValues.m_margins.m_end;
</del><ins>+                renderBox.computeLogicalWidthInRegion(computedValues, region);
+                margins.mutableLogicalLeft(renderBox.style().writingMode()) = computedValues.m_margins.m_start;
+                margins.mutableLogicalRight(renderBox.style().writingMode()) = computedValues.m_margins.m_end;
</ins><span class="cx">             }
</span><span class="cx"> 
</span><del>-            paddingBox = renderBox-&gt;clientBoxRectInRegion(region);
-            contentBox = LayoutRect(paddingBox.x() + renderBox-&gt;paddingLeft(), paddingBox.y() + renderBox-&gt;paddingTop(),
-                paddingBox.width() - renderBox-&gt;paddingLeft() - renderBox-&gt;paddingRight(), paddingBox.height() - renderBox-&gt;paddingTop() - renderBox-&gt;paddingBottom());
-            borderBox = LayoutRect(paddingBox.x() - renderBox-&gt;borderLeft(), paddingBox.y() - renderBox-&gt;borderTop(),
-                paddingBox.width() + renderBox-&gt;borderLeft() + renderBox-&gt;borderRight(), paddingBox.height() + renderBox-&gt;borderTop() + renderBox-&gt;borderBottom());
</del><ins>+            paddingBox = renderBox.clientBoxRectInRegion(region);
+            contentBox = LayoutRect(paddingBox.x() + renderBox.paddingLeft(), paddingBox.y() + renderBox.paddingTop(),
+                paddingBox.width() - renderBox.paddingLeft() - renderBox.paddingRight(), paddingBox.height() - renderBox.paddingTop() - renderBox.paddingBottom());
+            borderBox = LayoutRect(paddingBox.x() - renderBox.borderLeft(), paddingBox.y() - renderBox.borderTop(),
+                paddingBox.width() + renderBox.borderLeft() + renderBox.borderRight(), paddingBox.height() + renderBox.borderTop() + renderBox.borderBottom());
</ins><span class="cx">             marginBox = LayoutRect(borderBox.x() - margins.left(), borderBox.y() - margins.top(),
</span><span class="cx">                 borderBox.width() + margins.left() + margins.right(), borderBox.height() + margins.top() + margins.bottom());
</span><span class="cx">         } else {
</span><del>-            RenderInline* renderInline = toRenderInline(renderer);
</del><ins>+            auto&amp; renderInline = downcast&lt;RenderInline&gt;(*renderer);
</ins><span class="cx"> 
</span><span class="cx">             // RenderInline's bounding box includes paddings and borders, excludes margins.
</span><del>-            borderBox = renderInline-&gt;linesBoundingBox();
-            paddingBox = LayoutRect(borderBox.x() + renderInline-&gt;borderLeft(), borderBox.y() + renderInline-&gt;borderTop(),
-                borderBox.width() - renderInline-&gt;borderLeft() - renderInline-&gt;borderRight(), borderBox.height() - renderInline-&gt;borderTop() - renderInline-&gt;borderBottom());
-            contentBox = LayoutRect(paddingBox.x() + renderInline-&gt;paddingLeft(), paddingBox.y() + renderInline-&gt;paddingTop(),
-                paddingBox.width() - renderInline-&gt;paddingLeft() - renderInline-&gt;paddingRight(), paddingBox.height() - renderInline-&gt;paddingTop() - renderInline-&gt;paddingBottom());
</del><ins>+            borderBox = renderInline.linesBoundingBox();
+            paddingBox = LayoutRect(borderBox.x() + renderInline.borderLeft(), borderBox.y() + renderInline.borderTop(),
+                borderBox.width() - renderInline.borderLeft() - renderInline.borderRight(), borderBox.height() - renderInline.borderTop() - renderInline.borderBottom());
+            contentBox = LayoutRect(paddingBox.x() + renderInline.paddingLeft(), paddingBox.y() + renderInline.paddingTop(),
+                paddingBox.width() - renderInline.paddingLeft() - renderInline.paddingRight(), paddingBox.height() - renderInline.paddingTop() - renderInline.paddingBottom());
</ins><span class="cx">             // Ignore marginTop and marginBottom for inlines.
</span><del>-            marginBox = LayoutRect(borderBox.x() - renderInline-&gt;marginLeft(), borderBox.y(),
-                borderBox.width() + renderInline-&gt;horizontalMarginExtent(), borderBox.height());
</del><ins>+            marginBox = LayoutRect(borderBox.x() - renderInline.marginLeft(), borderBox.y(),
+                borderBox.width() + renderInline.horizontalMarginExtent(), borderBox.height());
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         FloatQuad absContentQuad;
</span></span></pre></div>
<a id="trunkSourceWebCorepageFrameViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/FrameView.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/FrameView.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/page/FrameView.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -3795,7 +3795,7 @@
</span><span class="cx">     FontCachePurgePreventer fontCachePurgePreventer;
</span><span class="cx"> 
</span><span class="cx">     // m_nodeToDraw is used to draw only one element (and its descendants)
</span><del>-    RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw-&gt;renderer() : 0;
</del><ins>+    RenderObject* renderer = m_nodeToDraw ? m_nodeToDraw-&gt;renderer() : nullptr;
</ins><span class="cx">     RenderLayer* rootLayer = renderView-&gt;layer();
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -3804,12 +3804,12 @@
</span><span class="cx"> 
</span><span class="cx">     // To work around http://webkit.org/b/135106, ensure that the paint root isn't an inline with culled line boxes.
</span><span class="cx">     // FIXME: This can cause additional content to be included in the snapshot, so remove this once that bug is fixed.
</span><del>-    while (eltRenderer &amp;&amp; eltRenderer-&gt;isRenderInline() &amp;&amp; !toRenderInline(eltRenderer)-&gt;firstLineBox())
-        eltRenderer = eltRenderer-&gt;parent();
</del><ins>+    while (is&lt;RenderInline&gt;(renderer) &amp;&amp; !downcast&lt;RenderInline&gt;(*renderer).firstLineBox())
+        renderer = renderer-&gt;parent();
</ins><span class="cx"> 
</span><del>-    rootLayer-&gt;paint(context, dirtyRect, LayoutSize(), m_paintBehavior, eltRenderer);
</del><ins>+    rootLayer-&gt;paint(context, dirtyRect, LayoutSize(), m_paintBehavior, renderer);
</ins><span class="cx">     if (rootLayer-&gt;containsDirtyOverlayScrollbars())
</span><del>-        rootLayer-&gt;paintOverlayScrollbars(context, dirtyRect, m_paintBehavior, eltRenderer);
</del><ins>+        rootLayer-&gt;paintOverlayScrollbars(context, dirtyRect, m_paintBehavior, renderer);
</ins><span class="cx"> 
</span><span class="cx">     didPaintContents(context, dirtyRect, paintingState);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineFlowBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineFlowBox.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineFlowBox.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/InlineFlowBox.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -219,7 +219,7 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::removeLineBoxFromRenderObject()
</span><span class="cx"> {
</span><del>-    toRenderInline(renderer()).lineBoxes().removeLineBox(this);
</del><ins>+    downcast&lt;RenderInline&gt;(renderer()).lineBoxes().removeLineBox(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::extractLine()
</span><span class="lines">@@ -232,7 +232,7 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::extractLineBoxFromRenderObject()
</span><span class="cx"> {
</span><del>-    toRenderInline(renderer()).lineBoxes().extractLineBox(this);
</del><ins>+    downcast&lt;RenderInline&gt;(renderer()).lineBoxes().extractLineBox(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::attachLine()
</span><span class="lines">@@ -245,7 +245,7 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::attachLineBoxToRenderObject()
</span><span class="cx"> {
</span><del>-    toRenderInline(renderer()).lineBoxes().attachLineBox(this);
</del><ins>+    downcast&lt;RenderInline&gt;(renderer()).lineBoxes().attachLineBox(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::adjustPosition(float dx, float dy)
</span><span class="lines">@@ -300,7 +300,7 @@
</span><span class="cx"> 
</span><span class="cx">     // The root inline box never has borders/margins/padding.
</span><span class="cx">     if (parent()) {
</span><del>-        const auto&amp; inlineFlow = toRenderInline(renderer());
</del><ins>+        const auto&amp; inlineFlow = downcast&lt;RenderInline&gt;(renderer());
</ins><span class="cx"> 
</span><span class="cx">         bool ltr = renderer().style().isLeftToRightDirection();
</span><span class="cx"> 
</span><span class="lines">@@ -1007,29 +1007,29 @@
</span><span class="cx"> 
</span><span class="cx">     // Check children first.
</span><span class="cx">     // We need to account for culled inline parents of the hit-tested nodes, so that they may also get included in area-based hit-tests.
</span><del>-    RenderElement* culledParent = 0;
-    for (InlineBox* curr = lastChild(); curr; curr = curr-&gt;prevOnLine()) {
-        if (curr-&gt;renderer().isText() || !curr-&gt;boxModelObject()-&gt;hasSelfPaintingLayer()) {
-            RenderElement* newParent = 0;
</del><ins>+    RenderElement* culledParent = nullptr;
+    for (InlineBox* child = lastChild(); child; child = child-&gt;prevOnLine()) {
+        if (is&lt;RenderText&gt;(child-&gt;renderer()) || !child-&gt;boxModelObject()-&gt;hasSelfPaintingLayer()) {
+            RenderElement* newParent = nullptr;
</ins><span class="cx">             // Culled parents are only relevant for area-based hit-tests, so ignore it in point-based ones.
</span><span class="cx">             if (locationInContainer.isRectBasedTest()) {
</span><del>-                newParent = curr-&gt;renderer().parent();
</del><ins>+                newParent = child-&gt;renderer().parent();
</ins><span class="cx">                 if (newParent == &amp;renderer())
</span><del>-                    newParent = 0;
</del><ins>+                    newParent = nullptr;
</ins><span class="cx">             }
</span><span class="cx">             // Check the culled parent after all its children have been checked, to do this we wait until
</span><span class="cx">             // we are about to test an element with a different parent.
</span><span class="cx">             if (newParent != culledParent) {
</span><span class="cx">                 if (!newParent || !newParent-&gt;isDescendantOf(culledParent)) {
</span><span class="cx">                     while (culledParent &amp;&amp; culledParent != &amp;renderer() &amp;&amp; culledParent != newParent) {
</span><del>-                        if (culledParent-&gt;isRenderInline() &amp;&amp; toRenderInline(culledParent)-&gt;hitTestCulledInline(request, result, locationInContainer, accumulatedOffset))
</del><ins>+                        if (is&lt;RenderInline&gt;(*culledParent) &amp;&amp; downcast&lt;RenderInline&gt;(*culledParent).hitTestCulledInline(request, result, locationInContainer, accumulatedOffset))
</ins><span class="cx">                             return true;
</span><span class="cx">                         culledParent = culledParent-&gt;parent();
</span><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx">                 culledParent = newParent;
</span><span class="cx">             }
</span><del>-            if (curr-&gt;nodeAtPoint(request, result, locationInContainer, accumulatedOffset, lineTop, lineBottom)) {
</del><ins>+            if (child-&gt;nodeAtPoint(request, result, locationInContainer, accumulatedOffset, lineTop, lineBottom)) {
</ins><span class="cx">                 renderer().updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
</span><span class="cx">                 return true;
</span><span class="cx">             }
</span><span class="lines">@@ -1037,7 +1037,7 @@
</span><span class="cx">     }
</span><span class="cx">     // Check any culled ancestor of the final children tested.
</span><span class="cx">     while (culledParent &amp;&amp; culledParent != &amp;renderer()) {
</span><del>-        if (culledParent-&gt;isRenderInline() &amp;&amp; toRenderInline(culledParent)-&gt;hitTestCulledInline(request, result, locationInContainer, accumulatedOffset))
</del><ins>+        if (is&lt;RenderInline&gt;(*culledParent) &amp;&amp; downcast&lt;RenderInline&gt;(*culledParent).hitTestCulledInline(request, result, locationInContainer, accumulatedOffset))
</ins><span class="cx">             return true;
</span><span class="cx">         culledParent = culledParent-&gt;parent();
</span><span class="cx">     }
</span><span class="lines">@@ -1103,9 +1103,9 @@
</span><span class="cx">             // Add ourselves to the paint info struct's list of inlines that need to paint their
</span><span class="cx">             // outlines.
</span><span class="cx">             if (renderer().style().visibility() == VISIBLE &amp;&amp; renderer().hasOutline() &amp;&amp; !isRootInlineBox()) {
</span><del>-                RenderInline&amp; inlineFlow = toRenderInline(renderer());
</del><ins>+                RenderInline&amp; inlineFlow = downcast&lt;RenderInline&gt;(renderer());
</ins><span class="cx"> 
</span><del>-                RenderBlock* cb = 0;
</del><ins>+                RenderBlock* containingBlock = nullptr;
</ins><span class="cx">                 bool containingBlockPaintsContinuationOutline = inlineFlow.continuation() || inlineFlow.isInlineElementContinuation();
</span><span class="cx">                 if (containingBlockPaintsContinuationOutline) {           
</span><span class="cx">                     // FIXME: See https://bugs.webkit.org/show_bug.cgi?id=54690. We currently don't reconnect inline continuations
</span><span class="lines">@@ -1115,8 +1115,8 @@
</span><span class="cx">                     if (!enclosingAnonymousBlock-&gt;isAnonymousBlock())
</span><span class="cx">                         containingBlockPaintsContinuationOutline = false;
</span><span class="cx">                     else {
</span><del>-                        cb = enclosingAnonymousBlock-&gt;containingBlock();
-                        for (auto box = &amp;renderer(); box != cb; box = &amp;box-&gt;parent()-&gt;enclosingBoxModelObject()) {
</del><ins>+                        containingBlock = enclosingAnonymousBlock-&gt;containingBlock();
+                        for (auto box = &amp;renderer(); box != containingBlock; box = &amp;box-&gt;parent()-&gt;enclosingBoxModelObject()) {
</ins><span class="cx">                             if (box-&gt;hasSelfPaintingLayer()) {
</span><span class="cx">                                 containingBlockPaintsContinuationOutline = false;
</span><span class="cx">                                 break;
</span><span class="lines">@@ -1128,7 +1128,7 @@
</span><span class="cx">                 if (containingBlockPaintsContinuationOutline) {
</span><span class="cx">                     // Add ourselves to the containing block of the entire continuation so that it can
</span><span class="cx">                     // paint us atomically.
</span><del>-                    cb-&gt;addContinuationWithOutline(toRenderInline(renderer().element()-&gt;renderer()));
</del><ins>+                    containingBlock-&gt;addContinuationWithOutline(downcast&lt;RenderInline&gt;(renderer().element()-&gt;renderer()));
</ins><span class="cx">                 } else if (!inlineFlow.isInlineElementContinuation())
</span><span class="cx">                     paintInfo.outlineObjects-&gt;add(&amp;inlineFlow);
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineIterator.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineIterator.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/InlineIterator.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -288,31 +288,31 @@
</span><span class="cx">     return bidiNextShared(root, current, observer, IncludeEmptyInlines, endOfInlinePtr);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline RenderObject* bidiFirstSkippingEmptyInlines(RenderElement&amp; root, InlineBidiResolver* resolver = 0)
</del><ins>+static inline RenderObject* bidiFirstSkippingEmptyInlines(RenderElement&amp; root, InlineBidiResolver* resolver = nullptr)
</ins><span class="cx"> {
</span><del>-    RenderObject* o = root.firstChild();
-    if (!o)
</del><ins>+    RenderObject* renderer = root.firstChild();
+    if (!renderer)
</ins><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    if (o-&gt;isRenderInline()) {
-        notifyObserverEnteredObject(resolver, o);
-        if (!isEmptyInline(toRenderInline(*o)))
-            o = bidiNextSkippingEmptyInlines(root, o, resolver);
</del><ins>+    if (is&lt;RenderInline&gt;(*renderer)) {
+        notifyObserverEnteredObject(resolver, renderer);
+        if (!isEmptyInline(downcast&lt;RenderInline&gt;(*renderer)))
+            renderer = bidiNextSkippingEmptyInlines(root, renderer, resolver);
</ins><span class="cx">         else {
</span><span class="cx">             // Never skip empty inlines.
</span><span class="cx">             if (resolver)
</span><span class="cx">                 resolver-&gt;commitExplicitEmbedding();
</span><del>-            return o; 
</del><ins>+            return renderer;
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Unify this with the bidiNext call above.
</span><del>-    if (o &amp;&amp; !isIteratorTarget(o))
-        o = bidiNextSkippingEmptyInlines(root, o, resolver);
</del><ins>+    if (renderer &amp;&amp; !isIteratorTarget(renderer))
+        renderer = bidiNextSkippingEmptyInlines(root, renderer, resolver);
</ins><span class="cx"> 
</span><span class="cx">     if (resolver)
</span><span class="cx">         resolver-&gt;commitExplicitEmbedding();
</span><del>-    return o;
</del><ins>+    return renderer;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // FIXME: This method needs to be renamed when bidiNext finds a good name.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingLayoutStatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/LayoutState.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/LayoutState.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/LayoutState.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -53,8 +53,8 @@
</span><span class="cx"> 
</span><span class="cx">     if (renderer-&gt;isOutOfFlowPositioned() &amp;&amp; !fixed) {
</span><span class="cx">         if (RenderElement* container = renderer-&gt;container()) {
</span><del>-            if (container-&gt;isInFlowPositioned() &amp;&amp; container-&gt;isRenderInline())
-                m_paintOffset += toRenderInline(container)-&gt;offsetForInFlowPositionedInline(renderer);
</del><ins>+            if (container-&gt;isInFlowPositioned() &amp;&amp; is&lt;RenderInline&gt;(*container))
+                m_paintOffset += downcast&lt;RenderInline&gt;(*container).offsetForInFlowPositionedInline(renderer);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -253,7 +253,7 @@
</span><span class="cx">     
</span><span class="cx">     if (!documentBeingDestroyed()) {
</span><span class="cx">         if (parent())
</span><del>-            parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+            parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     removeFromUpdateScrollInfoAfterLayoutTransaction();
</span><span class="lines">@@ -1630,11 +1630,11 @@
</span><span class="cx">     if ((paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseChildOutlines)) {
</span><span class="cx">         RenderInline* inlineCont = inlineElementContinuation();
</span><span class="cx">         if (inlineCont &amp;&amp; inlineCont-&gt;hasOutline() &amp;&amp; inlineCont-&gt;style().visibility() == VISIBLE) {
</span><del>-            RenderInline* inlineRenderer = toRenderInline(inlineCont-&gt;element()-&gt;renderer());
-            RenderBlock* cb = containingBlock();
</del><ins>+            RenderInline* inlineRenderer = downcast&lt;RenderInline&gt;(inlineCont-&gt;element()-&gt;renderer());
+            RenderBlock* containingBlock = this-&gt;containingBlock();
</ins><span class="cx"> 
</span><span class="cx">             bool inlineEnclosedInSelfPaintingLayer = false;
</span><del>-            for (RenderBoxModelObject* box = inlineRenderer; box != cb; box = &amp;box-&gt;parent()-&gt;enclosingBoxModelObject()) {
</del><ins>+            for (RenderBoxModelObject* box = inlineRenderer; box != containingBlock; box = &amp;box-&gt;parent()-&gt;enclosingBoxModelObject()) {
</ins><span class="cx">                 if (box-&gt;hasSelfPaintingLayer()) {
</span><span class="cx">                     inlineEnclosedInSelfPaintingLayer = true;
</span><span class="cx">                     break;
</span><span class="lines">@@ -1645,7 +1645,7 @@
</span><span class="cx">             // anonymous block (i.e. have our own layer), paint them straightaway instead. This is because a block depends on renderers in its continuation table being
</span><span class="cx">             // in the same layer. 
</span><span class="cx">             if (!inlineEnclosedInSelfPaintingLayer &amp;&amp; !hasLayer())
</span><del>-                cb-&gt;addContinuationWithOutline(inlineRenderer);
</del><ins>+                containingBlock-&gt;addContinuationWithOutline(inlineRenderer);
</ins><span class="cx">             else if (!inlineRenderer-&gt;firstLineBox() || (!inlineEnclosedInSelfPaintingLayer &amp;&amp; hasLayer()))
</span><span class="cx">                 inlineRenderer-&gt;paintOutline(paintInfo, paintOffset - locationOffset() + inlineRenderer-&gt;containingBlock()-&gt;location());
</span><span class="cx">         }
</span><span class="lines">@@ -1664,7 +1664,7 @@
</span><span class="cx"> RenderInline* RenderBlock::inlineElementContinuation() const
</span><span class="cx"> { 
</span><span class="cx">     RenderBoxModelObject* continuation = this-&gt;continuation();
</span><del>-    return continuation &amp;&amp; continuation-&gt;isRenderInline() ? toRenderInline(continuation) : 0;
</del><ins>+    return is&lt;RenderInline&gt;(continuation) ? downcast&lt;RenderInline&gt;(continuation) : nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RenderBlock* RenderBlock::blockElementContinuation() const
</span><span class="lines">@@ -3400,7 +3400,7 @@
</span><span class="cx">         // FIXME: This is wrong. The principal renderer may not be the continuation preceding this block.
</span><span class="cx">         // FIXME: This is wrong for block-flows that are horizontal.
</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=46781
</span><del>-        bool prevInlineHasLineBox = toRenderInline(inlineElementContinuation()-&gt;element()-&gt;renderer())-&gt;firstLineBox();
</del><ins>+        bool prevInlineHasLineBox = downcast&lt;RenderInline&gt;(*inlineElementContinuation()-&gt;element()-&gt;renderer()).firstLineBox();
</ins><span class="cx">         float topMargin = prevInlineHasLineBox ? collapsedMarginBefore() : LayoutUnit();
</span><span class="cx">         float bottomMargin = nextInlineHasLineBox ? collapsedMarginAfter() : LayoutUnit();
</span><span class="cx">         LayoutRect rect(additionalOffset.x(), additionalOffset.y() - topMargin, width(), height() + topMargin + bottomMargin);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -179,7 +179,7 @@
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx">         } else if (parent())
</span><del>-            parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+            parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_lineBoxes.deleteLineBoxes();
</span><span class="lines">@@ -4032,10 +4032,10 @@
</span><span class="cx">                     continue;
</span><span class="cx">                 }
</span><span class="cx">                 // Case (1) and (2). Inline replaced and inline flow elements.
</span><del>-                if (child-&gt;isRenderInline()) {
</del><ins>+                if (is&lt;RenderInline&gt;(*child)) {
</ins><span class="cx">                     // Add in padding/border/margin from the appropriate side of
</span><span class="cx">                     // the element.
</span><del>-                    float bpm = getBorderPaddingMargin(*toRenderInline(child), childIterator.endOfInline);
</del><ins>+                    float bpm = getBorderPaddingMargin(downcast&lt;RenderInline&gt;(*child), childIterator.endOfInline);
</ins><span class="cx">                     childMin += bpm;
</span><span class="cx">                     childMax += bpm;
</span><span class="cx"> 
</span><span class="lines">@@ -4057,7 +4057,7 @@
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            if (!child-&gt;isRenderInline() &amp;&amp; !child-&gt;isText()) {
</del><ins>+            if (!is&lt;RenderInline&gt;(*child) &amp;&amp; !is&lt;RenderText&gt;(*child)) {
</ins><span class="cx">                 // Case (2). Inline replaced elements and floats.
</span><span class="cx">                 // Go ahead and terminate the current line as far as
</span><span class="cx">                 // minwidth is concerned.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     virtual LayoutUnit collapsedMarginBefore() const override final { return maxPositiveMarginBefore() - maxNegativeMarginBefore(); }
</span><span class="cx">     virtual LayoutUnit collapsedMarginAfter() const override final { return maxPositiveMarginAfter() - maxNegativeMarginAfter(); }
</span><span class="cx"> 
</span><del>-    virtual void dirtyLinesFromChangedChild(RenderObject* child) override final { lineBoxes().dirtyLinesFromChangedChild(this, child); }
</del><ins>+    virtual void dirtyLinesFromChangedChild(RenderObject&amp; child) override final { lineBoxes().dirtyLinesFromChangedChild(*this, child); }
</ins><span class="cx">     virtual void updateLogicalHeight() override;
</span><span class="cx"> 
</span><span class="cx">     virtual void paintColumnRules(PaintInfo&amp;, const LayoutPoint&amp;) override;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockLineLayoutcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -925,7 +925,7 @@
</span><span class="cx">         // tree to see which parent inline is the isolate. We could change enterIsolate
</span><span class="cx">         // to take a RenderObject and do this logic there, but that would be a layering
</span><span class="cx">         // violation for BidiResolver (which knows nothing about RenderObject).
</span><del>-        RenderInline* isolatedInline = toRenderInline(highestContainingIsolateWithinRoot(startObject, currentRoot));
</del><ins>+        RenderInline* isolatedInline = downcast&lt;RenderInline&gt;(highestContainingIsolateWithinRoot(startObject, currentRoot));
</ins><span class="cx">         ASSERT(isolatedInline);
</span><span class="cx"> 
</span><span class="cx">         InlineBidiResolver isolatedResolver;
</span><span class="lines">@@ -1487,9 +1487,9 @@
</span><span class="cx">                     else
</span><span class="cx">                         box.layoutIfNeeded();
</span><span class="cx">                 }
</span><del>-            } else if (o.isTextOrLineBreak() || (o.isRenderInline() &amp;&amp; !walker.atEndOfInline())) {
-                if (o.isRenderInline())
-                    toRenderInline(o).updateAlwaysCreateLineBoxes(layoutState.isFullLayout());
</del><ins>+            } else if (o.isTextOrLineBreak() || (is&lt;RenderInline&gt;(o) &amp;&amp; !walker.atEndOfInline())) {
+                if (is&lt;RenderInline&gt;(o))
+                    downcast&lt;RenderInline&gt;(o).updateAlwaysCreateLineBoxes(layoutState.isFullLayout());
</ins><span class="cx">                 if (layoutState.isFullLayout() || o.selfNeedsLayout())
</span><span class="cx">                     dirtyLineBoxesForRenderer(o, layoutState.isFullLayout());
</span><span class="cx">                 o.clearNeedsLayout();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -2007,10 +2007,10 @@
</span><span class="cx">     RenderBoxModelObject::mapAbsoluteToLocalPoint(mode, transformState);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LayoutSize RenderBox::offsetFromContainer(RenderObject* o, const LayoutPoint&amp;, bool* offsetDependsOnPoint) const
</del><ins>+LayoutSize RenderBox::offsetFromContainer(RenderObject* renderer, const LayoutPoint&amp;, bool* offsetDependsOnPoint) const
</ins><span class="cx"> {
</span><span class="cx">     // A region &quot;has&quot; boxes inside it without being their container. 
</span><del>-    ASSERT(o == container() || o-&gt;isRenderRegion());
</del><ins>+    ASSERT(renderer == container() || is&lt;RenderRegion&gt;(*renderer));
</ins><span class="cx"> 
</span><span class="cx">     LayoutSize offset;    
</span><span class="cx">     if (isInFlowPositioned())
</span><span class="lines">@@ -2019,14 +2019,14 @@
</span><span class="cx">     if (!isInline() || isReplaced())
</span><span class="cx">         offset += topLeftLocationOffset();
</span><span class="cx"> 
</span><del>-    if (o-&gt;isBox())
-        offset -= toRenderBox(o)-&gt;scrolledContentOffset();
</del><ins>+    if (is&lt;RenderBox&gt;(*renderer))
+        offset -= downcast&lt;RenderBox&gt;(*renderer).scrolledContentOffset();
</ins><span class="cx"> 
</span><del>-    if (style().position() == AbsolutePosition &amp;&amp; o-&gt;isInFlowPositioned() &amp;&amp; o-&gt;isRenderInline())
-        offset += toRenderInline(o)-&gt;offsetForInFlowPositionedInline(this);
</del><ins>+    if (style().position() == AbsolutePosition &amp;&amp; renderer-&gt;isInFlowPositioned() &amp;&amp; is&lt;RenderInline&gt;(*renderer))
+        offset += downcast&lt;RenderInline&gt;(*renderer).offsetForInFlowPositionedInline(this);
</ins><span class="cx"> 
</span><span class="cx">     if (offsetDependsOnPoint)
</span><del>-        *offsetDependsOnPoint |= o-&gt;isRenderFlowThread();
</del><ins>+        *offsetDependsOnPoint |= is&lt;RenderFlowThread&gt;(*renderer);
</ins><span class="cx"> 
</span><span class="cx">     return offset;
</span><span class="cx"> }
</span><span class="lines">@@ -2165,8 +2165,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     bool containerSkipped;
</span><del>-    auto o = container(repaintContainer, &amp;containerSkipped);
-    if (!o)
</del><ins>+    auto* renderer = container(repaintContainer, &amp;containerSkipped);
+    if (!renderer)
</ins><span class="cx">         return;
</span><span class="cx">     
</span><span class="cx">     EPosition position = styleToUse.position();
</span><span class="lines">@@ -2178,10 +2178,10 @@
</span><span class="cx">     // us to add the height twice.
</span><span class="cx">     // The same logic applies for elements flowed directly into the flow thread. Their topLeft member
</span><span class="cx">     // will already contain the portion rect of the region.
</span><del>-    if (o-&gt;isOutOfFlowRenderFlowThread() &amp;&amp; position != AbsolutePosition &amp;&amp; containingBlock() != flowThreadContainingBlock()) {
</del><ins>+    if (renderer-&gt;isOutOfFlowRenderFlowThread() &amp;&amp; position != AbsolutePosition &amp;&amp; containingBlock() != flowThreadContainingBlock()) {
</ins><span class="cx">         RenderRegion* firstRegion = nullptr;
</span><span class="cx">         RenderRegion* lastRegion = nullptr;
</span><del>-        if (toRenderFlowThread(o)-&gt;getRegionRangeForBox(this, firstRegion, lastRegion))
</del><ins>+        if (downcast&lt;RenderFlowThread&gt;(*renderer).getRegionRangeForBox(this, firstRegion, lastRegion))
</ins><span class="cx">             rect.moveBy(firstRegion-&gt;flowThreadPortionRect().location());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2201,8 +2201,8 @@
</span><span class="cx">     } else if (position == FixedPosition)
</span><span class="cx">         fixed = true;
</span><span class="cx"> 
</span><del>-    if (position == AbsolutePosition &amp;&amp; o-&gt;isInFlowPositioned() &amp;&amp; o-&gt;isRenderInline())
-        topLeft += toRenderInline(o)-&gt;offsetForInFlowPositionedInline(this);
</del><ins>+    if (position == AbsolutePosition &amp;&amp; renderer-&gt;isInFlowPositioned() &amp;&amp; is&lt;RenderInline&gt;(*renderer))
+        topLeft += downcast&lt;RenderInline&gt;(*renderer).offsetForInFlowPositionedInline(this);
</ins><span class="cx">     else if (styleToUse.hasInFlowPosition() &amp;&amp; layer()) {
</span><span class="cx">         // Apply the relative position offset when invalidating a rectangle.  The layer
</span><span class="cx">         // is translated, but the render box isn't, so we need to do this to get the
</span><span class="lines">@@ -2214,10 +2214,10 @@
</span><span class="cx">     // FIXME: We ignore the lightweight clipping rect that controls use, since if |o| is in mid-layout,
</span><span class="cx">     // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
</span><span class="cx">     rect.setLocation(topLeft);
</span><del>-    if (o-&gt;hasOverflowClip()) {
-        RenderBox* containerBox = toRenderBox(o);
-        if (shouldApplyContainersClipAndOffset(repaintContainer, containerBox)) {
-            containerBox-&gt;applyCachedClipAndScrollOffsetForRepaint(rect);
</del><ins>+    if (renderer-&gt;hasOverflowClip()) {
+        RenderBox&amp; containerBox = downcast&lt;RenderBox&gt;(*renderer);
+        if (shouldApplyContainersClipAndOffset(repaintContainer, &amp;containerBox)) {
+            containerBox.applyCachedClipAndScrollOffsetForRepaint(rect);
</ins><span class="cx">             if (rect.isEmpty())
</span><span class="cx">                 return;
</span><span class="cx">         }
</span><span class="lines">@@ -2225,12 +2225,12 @@
</span><span class="cx"> 
</span><span class="cx">     if (containerSkipped) {
</span><span class="cx">         // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
</span><del>-        LayoutSize containerOffset = repaintContainer-&gt;offsetFromAncestorContainer(o);
</del><ins>+        LayoutSize containerOffset = repaintContainer-&gt;offsetFromAncestorContainer(renderer);
</ins><span class="cx">         rect.move(-containerOffset);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    o-&gt;computeRectForRepaint(repaintContainer, rect, fixed);
</del><ins>+    renderer-&gt;computeRectForRepaint(repaintContainer, rect, fixed);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderBox::repaintDuringLayoutIfMoved(const LayoutRect&amp; oldRect)
</span><span class="lines">@@ -3107,11 +3107,11 @@
</span><span class="cx">         return (boxInfo) ? std::max&lt;LayoutUnit&gt;(0, cb.clientLogicalWidth() - (cb.logicalWidth() - boxInfo-&gt;logicalWidth())) : cb.clientLogicalWidth();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ASSERT(containingBlock-&gt;isRenderInline() &amp;&amp; containingBlock-&gt;isInFlowPositioned());
</del><ins>+    ASSERT(containingBlock-&gt;isInFlowPositioned());
</ins><span class="cx"> 
</span><del>-    const RenderInline* flow = toRenderInline(containingBlock);
-    InlineFlowBox* first = flow-&gt;firstLineBox();
-    InlineFlowBox* last = flow-&gt;lastLineBox();
</del><ins>+    const auto&amp; flow = downcast&lt;RenderInline&gt;(*containingBlock);
+    InlineFlowBox* first = flow.firstLineBox();
+    InlineFlowBox* last = flow.lastLineBox();
</ins><span class="cx"> 
</span><span class="cx">     // If the containing block is empty, return a width of 0.
</span><span class="cx">     if (!first || !last)
</span><span class="lines">@@ -3152,9 +3152,9 @@
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    ASSERT(is&lt;RenderInline&gt;(*containingBlock) &amp;&amp; containingBlock-&gt;isInFlowPositioned());
</del><ins>+    ASSERT(containingBlock-&gt;isInFlowPositioned());
</ins><span class="cx"> 
</span><del>-    const RenderInline&amp; flow = downcast&lt;RenderInline&gt;(*containingBlock);
</del><ins>+    const auto&amp; flow = downcast&lt;RenderInline&gt;(*containingBlock);
</ins><span class="cx">     InlineFlowBox* first = flow.firstLineBox();
</span><span class="cx">     InlineFlowBox* last = flow.lastLineBox();
</span><span class="cx"> 
</span><span class="lines">@@ -3533,10 +3533,10 @@
</span><span class="cx">     // positioned, inline because right now, it is using the logical left position
</span><span class="cx">     // of the first line box when really it should use the last line box.  When
</span><span class="cx">     // this is fixed elsewhere, this block should be removed.
</span><del>-    if (containerBlock-&gt;isRenderInline() &amp;&amp; !containerBlock-&gt;style().isLeftToRightDirection()) {
-        const RenderInline* flow = toRenderInline(containerBlock);
-        InlineFlowBox* firstLine = flow-&gt;firstLineBox();
-        InlineFlowBox* lastLine = flow-&gt;lastLineBox();
</del><ins>+    if (is&lt;RenderInline&gt;(*containerBlock) &amp;&amp; !containerBlock-&gt;style().isLeftToRightDirection()) {
+        const auto&amp; flow = downcast&lt;RenderInline&gt;(*containerBlock);
+        InlineFlowBox* firstLine = flow.firstLineBox();
+        InlineFlowBox* lastLine = flow.lastLineBox();
</ins><span class="cx">         if (firstLine &amp;&amp; lastLine &amp;&amp; firstLine != lastLine) {
</span><span class="cx">             computedValues.m_position = logicalLeftValue + marginLogicalLeftValue + lastLine-&gt;borderLogicalLeft() + (lastLine-&gt;logicalLeft() - firstLine-&gt;logicalLeft());
</span><span class="cx">             return;
</span><span class="lines">@@ -3973,10 +3973,10 @@
</span><span class="cx">     // positioned, inline containing block because right now, it is using the logical left position
</span><span class="cx">     // of the first line box when really it should use the last line box.  When
</span><span class="cx">     // this is fixed elsewhere, this block should be removed.
</span><del>-    if (containerBlock-&gt;isRenderInline() &amp;&amp; !containerBlock-&gt;style().isLeftToRightDirection()) {
-        const RenderInline* flow = toRenderInline(containerBlock);
-        InlineFlowBox* firstLine = flow-&gt;firstLineBox();
-        InlineFlowBox* lastLine = flow-&gt;lastLineBox();
</del><ins>+    if (is&lt;RenderInline&gt;(*containerBlock) &amp;&amp; !containerBlock-&gt;style().isLeftToRightDirection()) {
+        const auto&amp; flow = downcast&lt;RenderInline&gt;(*containerBlock);
+        InlineFlowBox* firstLine = flow.firstLineBox();
+        InlineFlowBox* lastLine = flow.lastLineBox();
</ins><span class="cx">         if (firstLine &amp;&amp; lastLine &amp;&amp; firstLine != lastLine) {
</span><span class="cx">             computedValues.m_position = logicalLeftValue + marginLogicalLeftAlias + lastLine-&gt;borderLogicalLeft() + (lastLine-&gt;logicalLeft() - firstLine-&gt;logicalLeft());
</span><span class="cx">             return;
</span><span class="lines">@@ -4624,7 +4624,7 @@
</span><span class="cx">         RenderRegion* startRegion = nullptr;
</span><span class="cx">         RenderRegion* endRegion = nullptr;
</span><span class="cx">         if (flowThread-&gt;getRegionRangeForBox(this, startRegion, endRegion))
</span><del>-            overflowRect.unite(namedFlowFragment-&gt;visualOverflowRectForBox(this));
</del><ins>+            overflowRect.unite(namedFlowFragment-&gt;visualOverflowRectForBox(*this));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (!m_overflow || !usesCompositedScrolling())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxModelObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -213,13 +213,9 @@
</span><span class="cx">     if (!child-&gt;isAnonymousBlock() || !child-&gt;isInFlowPositioned())
</span><span class="cx">         return LayoutSize();
</span><span class="cx">     LayoutSize offset;
</span><del>-    RenderElement* p = downcast&lt;RenderBlock&gt;(*child).inlineElementContinuation();
-    while (is&lt;RenderInline&gt;(p)) {
-        if (p-&gt;isInFlowPositioned()) {
-            RenderInline&amp; renderInline = downcast&lt;RenderInline&gt;(*p);
-            offset += renderInline.offsetForInFlowPosition();
-        }
-        p = p-&gt;parent();
</del><ins>+    for (RenderElement* parent = downcast&lt;RenderBlock&gt;(*child).inlineElementContinuation(); is&lt;RenderInline&gt;(parent); parent = parent-&gt;parent()) {
+        if (parent-&gt;isInFlowPositioned())
+            offset += downcast&lt;RenderInline&gt;(*parent).offsetForInFlowPosition();
</ins><span class="cx">     }
</span><span class="cx">     return offset;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderElement.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -996,7 +996,7 @@
</span><span class="cx">         view().frameView().removeSlowRepaintObject(this);
</span><span class="cx"> 
</span><span class="cx">     if (isOutOfFlowPositioned() &amp;&amp; parent()-&gt;childrenInline())
</span><del>-        parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+        parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx"> 
</span><span class="cx">     if (auto* containerFlowThread = parent()-&gt;renderNamedFlowThreadWrapper())
</span><span class="cx">         containerFlowThread-&gt;removeFlowChild(*this);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderElement.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderElement.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderElement.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual RenderElement* hoverAncestor() const;
</span><span class="cx"> 
</span><del>-    virtual void dirtyLinesFromChangedChild(RenderObject*) { }
</del><ins>+    virtual void dirtyLinesFromChangedChild(RenderObject&amp;) { }
</ins><span class="cx"> 
</span><span class="cx">     bool ancestorLineBoxDirty() const { return m_ancestorLineBoxDirty; }
</span><span class="cx">     void setAncestorLineBoxDirty(bool f = true);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -1446,7 +1446,7 @@
</span><span class="cx">                 break;
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><del>-        LayoutRect childVisualOverflowRect = region-&gt;visualOverflowRectForBoxForPropagation(child);
</del><ins>+        LayoutRect childVisualOverflowRect = region-&gt;visualOverflowRectForBoxForPropagation(*child);
</ins><span class="cx">         childVisualOverflowRect.move(delta);
</span><span class="cx">         region-&gt;addVisualOverflowForBox(box, childVisualOverflowRect);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderInlinecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderInline.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderInline.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderInline.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -107,7 +107,7 @@
</span><span class="cx">                     box-&gt;removeFromParent();
</span><span class="cx">             }
</span><span class="cx">         } else if (parent()) 
</span><del>-            parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+            parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_lineBoxes.deleteLineBoxes();
</span><span class="lines">@@ -217,7 +217,7 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     RenderStyle* parentStyle = &amp;parent()-&gt;style();
</span><del>-    RenderInline* parentRenderInline = parent()-&gt;isRenderInline() ? toRenderInline(parent()) : 0;
</del><ins>+    RenderInline* parentRenderInline = is&lt;RenderInline&gt;(*parent()) ? downcast&lt;RenderInline&gt;(parent()) : nullptr;
</ins><span class="cx">     bool checkFonts = document().inNoQuirksMode();
</span><span class="cx">     RenderFlowThread* flowThread = flowThreadContainingBlock();
</span><span class="cx">     bool alwaysCreateLineBoxes = (parentRenderInline &amp;&amp; parentRenderInline-&gt;alwaysCreateLineBoxes())
</span><span class="lines">@@ -1107,27 +1107,27 @@
</span><span class="cx"> 
</span><span class="cx">     // We need to add in the in-flow position offsets of any inlines (including us) up to our
</span><span class="cx">     // containing block.
</span><del>-    RenderBlock* cb = containingBlock();
-    for (const RenderObject* inlineFlow = this; inlineFlow &amp;&amp; inlineFlow-&gt;isRenderInline() &amp;&amp; inlineFlow != cb;
</del><ins>+    RenderBlock* containingBlock = this-&gt;containingBlock();
+    for (const RenderElement* inlineFlow = this; is&lt;RenderInline&gt;(inlineFlow) &amp;&amp; inlineFlow != containingBlock;
</ins><span class="cx">          inlineFlow = inlineFlow-&gt;parent()) {
</span><span class="cx">          if (inlineFlow == repaintContainer) {
</span><span class="cx">             hitRepaintContainer = true;
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         if (inlineFlow-&gt;style().hasInFlowPosition() &amp;&amp; inlineFlow-&gt;hasLayer())
</span><del>-            repaintRect.move(toRenderInline(inlineFlow)-&gt;layer()-&gt;offsetForInFlowPosition());
</del><ins>+            repaintRect.move(downcast&lt;RenderInline&gt;(*inlineFlow).layer()-&gt;offsetForInFlowPosition());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     LayoutUnit outlineSize = style().outlineSize();
</span><span class="cx">     repaintRect.inflate(outlineSize);
</span><span class="cx"> 
</span><del>-    if (hitRepaintContainer || !cb)
</del><ins>+    if (hitRepaintContainer || !containingBlock)
</ins><span class="cx">         return repaintRect;
</span><span class="cx"> 
</span><del>-    if (cb-&gt;hasOverflowClip())
-        cb-&gt;applyCachedClipAndScrollOffsetForRepaint(repaintRect);
</del><ins>+    if (containingBlock-&gt;hasOverflowClip())
+        containingBlock-&gt;applyCachedClipAndScrollOffsetForRepaint(repaintRect);
</ins><span class="cx"> 
</span><del>-    cb-&gt;computeRectForRepaint(repaintContainer, repaintRect);
</del><ins>+    containingBlock-&gt;computeRectForRepaint(repaintContainer, repaintRect);
</ins><span class="cx"> 
</span><span class="cx">     if (outlineSize) {
</span><span class="cx">         for (auto&amp; child : childrenOfType&lt;RenderElement&gt;(*this))
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderInlineh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderInline.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderInline.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderInline.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -156,7 +156,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual std::unique_ptr&lt;InlineFlowBox&gt; createInlineFlowBox(); // Subclassed by RenderSVGInline
</span><span class="cx"> 
</span><del>-    virtual void dirtyLinesFromChangedChild(RenderObject* child) override final { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
</del><ins>+    virtual void dirtyLinesFromChangedChild(RenderObject&amp; child) override final { m_lineBoxes.dirtyLinesFromChangedChild(*this, child); }
</ins><span class="cx"> 
</span><span class="cx">     virtual LayoutUnit lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const override final;
</span><span class="cx">     virtual int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const override final;
</span><span class="lines">@@ -180,8 +180,6 @@
</span><span class="cx">     RenderLineBoxList m_lineBoxes;   // All of the line boxes created for this inline flow.  For example, &lt;i&gt;Hello&lt;br&gt;world.&lt;/i&gt; will have two &lt;i&gt; line boxes.
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-RENDER_OBJECT_TYPE_CASTS(RenderInline, isRenderInline())
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><span class="cx"> SPECIALIZE_TYPE_TRAITS_RENDER_OBJECT(RenderInline, isRenderInline())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -1198,8 +1198,8 @@
</span><span class="cx"> {
</span><span class="cx">     LayoutPoint localPoint;
</span><span class="cx">     LayoutSize inlineBoundingBoxOffset; // We don't put this into the RenderLayer x/y for inlines, so we need to subtract it out when done.
</span><del>-    if (renderer().isInline() &amp;&amp; renderer().isRenderInline()) {
-        RenderInline&amp; inlineFlow = toRenderInline(renderer());
</del><ins>+    if (renderer().isInline() &amp;&amp; is&lt;RenderInline&gt;(renderer())) {
+        auto&amp; inlineFlow = downcast&lt;RenderInline&gt;(renderer());
</ins><span class="cx">         IntRect lineBox = inlineFlow.linesBoundingBox();
</span><span class="cx">         setSize(lineBox.size());
</span><span class="cx">         inlineBoundingBoxOffset = toLayoutSize(lineBox.location());
</span><span class="lines">@@ -1238,8 +1238,8 @@
</span><span class="cx">             localPoint -= offset;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        if (renderer().isOutOfFlowPositioned() &amp;&amp; positionedParent-&gt;renderer().isInFlowPositioned() &amp;&amp; positionedParent-&gt;renderer().isRenderInline()) {
-            LayoutSize offset = toRenderInline(positionedParent-&gt;renderer()).offsetForInFlowPositionedInline(&amp;toRenderBox(renderer()));
</del><ins>+        if (renderer().isOutOfFlowPositioned() &amp;&amp; positionedParent-&gt;renderer().isInFlowPositioned() &amp;&amp; is&lt;RenderInline&gt;(positionedParent-&gt;renderer())) {
+            LayoutSize offset = downcast&lt;RenderInline&gt;(positionedParent-&gt;renderer()).offsetForInFlowPositionedInline(&amp;toRenderBox(renderer()));
</ins><span class="cx">             localPoint += offset;
</span><span class="cx">         }
</span><span class="cx">     } else if (parent()) {
</span><span class="lines">@@ -5408,7 +5408,7 @@
</span><span class="cx">     if (isSelfPaintingLayer() &amp;&amp; flowThread &amp;&amp; !renderer().isInFlowRenderFlowThread()) {
</span><span class="cx">         ASSERT(namedFlowFragment-&gt;isValid());
</span><span class="cx">         const RenderBoxModelObject&amp; boxModelObject = downcast&lt;RenderBoxModelObject&gt;(renderer());
</span><del>-        LayoutRect layerBoundsWithVisualOverflow = namedFlowFragment-&gt;visualOverflowRectForBox(&amp;boxModelObject);
</del><ins>+        LayoutRect layerBoundsWithVisualOverflow = namedFlowFragment-&gt;visualOverflowRectForBox(boxModelObject);
</ins><span class="cx"> 
</span><span class="cx">         // Layers are in physical coordinates so the origin must be moved to the physical top-left of the flowthread.
</span><span class="cx">         if (&amp;boxModelObject == flowThread &amp;&amp; flowThread-&gt;style().isFlippedBlocksWritingMode()) {
</span><span class="lines">@@ -5457,7 +5457,7 @@
</span><span class="cx">         if (renderBox()-&gt;hasVisualOverflow()) {
</span><span class="cx">             // FIXME: Does not do the right thing with CSS regions yet, since we don't yet factor in the
</span><span class="cx">             // individual region boxes as overflow.
</span><del>-            LayoutRect layerBoundsWithVisualOverflow = namedFlowFragment ? namedFlowFragment-&gt;visualOverflowRectForBox(renderBox()) : renderBox()-&gt;visualOverflowRect();
</del><ins>+            LayoutRect layerBoundsWithVisualOverflow = namedFlowFragment ? namedFlowFragment-&gt;visualOverflowRectForBox(*renderBox()) : renderBox()-&gt;visualOverflowRect();
</ins><span class="cx">             renderBox()-&gt;flipForWritingMode(layerBoundsWithVisualOverflow); // Layers are in physical coordinates, so the overflow has to be flipped.
</span><span class="cx">             layerBoundsWithVisualOverflow.move(offsetFromRootLocal);
</span><span class="cx">             if (this != clipRectsContext.rootLayer || clipRectsContext.respectOverflowClip == RespectOverflowClip)
</span><span class="lines">@@ -5593,7 +5593,7 @@
</span><span class="cx">     // to the flow thread, not the last region (in which it will end up because of bottom:0px)
</span><span class="cx">     if (namedFlowFragment &amp;&amp; renderer().flowThreadContainingBlock()) {
</span><span class="cx">         LayoutRect b = layerBounds;
</span><del>-        b.moveBy(namedFlowFragment-&gt;visualOverflowRectForBox(downcast&lt;RenderBoxModelObject&gt;(&amp;renderer())).location());
</del><ins>+        b.moveBy(namedFlowFragment-&gt;visualOverflowRectForBox(downcast&lt;RenderBoxModelObject&gt;(renderer())).location());
</ins><span class="cx">         b.inflate(renderer().view().maximalOutlineSize());
</span><span class="cx">         if (b.intersects(damageRect))
</span><span class="cx">             return true;
</span><span class="lines">@@ -5620,10 +5620,10 @@
</span><span class="cx">     // as part of our bounding box.  We do this because we are the responsible layer for both hit testing and painting those
</span><span class="cx">     // floats.
</span><span class="cx">     LayoutRect result;
</span><del>-    if (renderer().isInline() &amp;&amp; renderer().isRenderInline())
-        result = toRenderInline(renderer()).linesVisualOverflowBoundingBox();
</del><ins>+    if (renderer().isInline() &amp;&amp; is&lt;RenderInline&gt;(renderer()))
+        result = downcast&lt;RenderInline&gt;(renderer()).linesVisualOverflowBoundingBox();
</ins><span class="cx">     else if (is&lt;RenderTableRow&gt;(renderer())) {
</span><del>-        RenderTableRow&amp; tableRow = downcast&lt;RenderTableRow&gt;(renderer());
</del><ins>+        auto&amp; tableRow = downcast&lt;RenderTableRow&gt;(renderer());
</ins><span class="cx">         // Our bounding box is just the union of all of our cells' border/overflow rects.
</span><span class="cx">         for (RenderTableCell* cell = tableRow.firstCell(); cell; cell = cell-&gt;nextCell()) {
</span><span class="cx">             LayoutRect bbox = cell-&gt;borderBoxRect();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLineBoxListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -312,22 +312,22 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderLineBoxList::dirtyLinesFromChangedChild(RenderBoxModelObject* container, RenderObject* child)
</del><ins>+void RenderLineBoxList::dirtyLinesFromChangedChild(RenderBoxModelObject&amp; container, RenderObject&amp; child)
</ins><span class="cx"> {
</span><del>-    ASSERT(container-&gt;isRenderInline() || container-&gt;isRenderBlockFlow());
-    if (!container-&gt;parent() || (container-&gt;isRenderBlockFlow() &amp;&amp; container-&gt;selfNeedsLayout()))
</del><ins>+    ASSERT(is&lt;RenderInline&gt;(container) || is&lt;RenderBlockFlow&gt;(container));
+    if (!container.parent() || (is&lt;RenderBlockFlow&gt;(container) &amp;&amp; container.selfNeedsLayout()))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RenderInline* inlineContainer = container-&gt;isRenderInline() ? toRenderInline(container) : 0;
</del><ins>+    RenderInline* inlineContainer = is&lt;RenderInline&gt;(container) ? &amp;downcast&lt;RenderInline&gt;(container) : nullptr;
</ins><span class="cx">     InlineBox* firstBox = inlineContainer ? inlineContainer-&gt;firstLineBoxIncludingCulling() : firstLineBox();
</span><span class="cx"> 
</span><span class="cx">     // If we have no first line box, then just bail early.
</span><span class="cx">     if (!firstBox) {
</span><span class="cx">         // For an empty inline, go ahead and propagate the check up to our parent, unless the parent
</span><span class="cx">         // is already dirty.
</span><del>-        if (container-&gt;isInline() &amp;&amp; !container-&gt;ancestorLineBoxDirty()) {
-            container-&gt;parent()-&gt;dirtyLinesFromChangedChild(container);
-            container-&gt;setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
</del><ins>+        if (container.isInline() &amp;&amp; !container.ancestorLineBoxDirty()) {
+            container.parent()-&gt;dirtyLinesFromChangedChild(container);
+            container.setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
</ins><span class="cx">         }
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -337,7 +337,7 @@
</span><span class="cx">     // parent's first line box.
</span><span class="cx">     RootInlineBox* box = nullptr;
</span><span class="cx">     RenderObject* current;
</span><del>-    for (current = child-&gt;previousSibling(); current; current = current-&gt;previousSibling()) {
</del><ins>+    for (current = child.previousSibling(); current; current = current-&gt;previousSibling()) {
</ins><span class="cx">         if (current-&gt;isFloatingOrOutOfFlowPositioned())
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="lines">@@ -367,7 +367,7 @@
</span><span class="cx">             // This isn't good enough, since we won't locate the root line box that encloses the removed
</span><span class="cx">             // &lt;br&gt;. We have to just over-invalidate a bit and go up to our parent.
</span><span class="cx">             if (!inlineContainer-&gt;ancestorLineBoxDirty()) {
</span><del>-                inlineContainer-&gt;parent()-&gt;dirtyLinesFromChangedChild(inlineContainer);
</del><ins>+                inlineContainer-&gt;parent()-&gt;dirtyLinesFromChangedChild(*inlineContainer);
</ins><span class="cx">                 inlineContainer-&gt;setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
</span><span class="cx">             }
</span><span class="cx">             return;
</span><span class="lines">@@ -394,9 +394,9 @@
</span><span class="cx">         // If |child| has been inserted before the first element in the linebox, but after collapsed leading
</span><span class="cx">         // space, the search for |child|'s linebox will go past the leading space to the previous linebox and select that
</span><span class="cx">         // one as |box|. If we hit that situation here, dirty the |box| actually containing the child too. 
</span><del>-        bool insertedAfterLeadingSpace = box-&gt;lineBreakObj() == child-&gt;previousSibling();
-        if (adjacentBox &amp;&amp; (adjacentBox-&gt;lineBreakObj() == child || child-&gt;isBR() || (current &amp;&amp; current-&gt;isBR())
-            || insertedAfterLeadingSpace || isIsolated(container-&gt;style().unicodeBidi())))
</del><ins>+        bool insertedAfterLeadingSpace = box-&gt;lineBreakObj() == child.previousSibling();
+        if (adjacentBox &amp;&amp; (adjacentBox-&gt;lineBreakObj() == &amp;child || child.isBR() || (current &amp;&amp; current-&gt;isBR())
+            || insertedAfterLeadingSpace || isIsolated(container.style().unicodeBidi())))
</ins><span class="cx">             adjacentBox-&gt;markDirty();
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLineBoxListh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLineBoxList.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx">     void removeLineBox(InlineFlowBox*);
</span><span class="cx">     
</span><span class="cx">     void dirtyLineBoxes();
</span><del>-    void dirtyLinesFromChangedChild(RenderBoxModelObject* parent, RenderObject* child);
</del><ins>+    void dirtyLinesFromChangedChild(RenderBoxModelObject&amp; parent, RenderObject&amp; child);
</ins><span class="cx"> 
</span><span class="cx">     void paint(RenderBoxModelObject*, PaintInfo&amp;, const LayoutPoint&amp;) const;
</span><span class="cx">     bool hitTest(RenderBoxModelObject*, const HitTestRequest&amp;, HitTestResult&amp;, const HitTestLocation&amp; locationInContainer, const LayoutPoint&amp; accumulatedOffset, HitTestAction) const;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -284,7 +284,7 @@
</span><span class="cx"> 
</span><span class="cx"> LayoutRect RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment(const RenderBox&amp; box, RenderNamedFlowFragment&amp; fragment) const
</span><span class="cx"> {
</span><del>-    LayoutRect visualOverflowRect = fragment.visualOverflowRectForBox(&amp;box);
</del><ins>+    LayoutRect visualOverflowRect = fragment.visualOverflowRectForBox(box);
</ins><span class="cx">     LayoutUnit initialLogicalX = style().isHorizontalWritingMode() ? visualOverflowRect.x() : visualOverflowRect.y();
</span><span class="cx"> 
</span><span class="cx">     // The visual overflow rect returned by visualOverflowRectForBox is already flipped but the
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -2047,7 +2047,7 @@
</span><span class="cx">     // FIXME: We should ASSERT(isRooted()) here but generated content makes some out-of-order insertion.
</span><span class="cx"> 
</span><span class="cx">     if (!isFloating() &amp;&amp; parent()-&gt;childrenInline())
</span><del>-        parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+        parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx">     
</span><span class="cx">     // We have to unset the current layout RenderFlowThread here, since insertedIntoTree() can happen in
</span><span class="cx">     // the middle of layout but for objects inside a nested flow thread that is still being populated. This
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderRegioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderRegion.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderRegion.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderRegion.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -156,7 +156,7 @@
</span><span class="cx">     if (shouldClipFlowThreadContent())
</span><span class="cx">         return flowThreadPortionRect;
</span><span class="cx"> 
</span><del>-    LayoutRect flowThreadOverflow = overflowType == VisualOverflow ? visualOverflowRectForBox(m_flowThread) : layoutOverflowRectForBox(m_flowThread);
</del><ins>+    LayoutRect flowThreadOverflow = overflowType == VisualOverflow ? visualOverflowRectForBox(*m_flowThread) : layoutOverflowRectForBox(m_flowThread);
</ins><span class="cx"> 
</span><span class="cx">     // We are interested about the outline size only when computing the visual overflow.
</span><span class="cx">     LayoutUnit outlineSize = overflowType == VisualOverflow ? LayoutUnit(maximalOutlineSize(PaintPhaseOutline)) : LayoutUnit();
</span><span class="lines">@@ -523,16 +523,16 @@
</span><span class="cx">     return overflow-&gt;layoutOverflowRect();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LayoutRect RenderRegion::visualOverflowRectForBox(const RenderBoxModelObject* box)
</del><ins>+LayoutRect RenderRegion::visualOverflowRectForBox(const RenderBoxModelObject&amp; box)
</ins><span class="cx"> {
</span><del>-    if (box-&gt;isRenderInline()) {
-        const RenderInline* inlineBox = toRenderInline(box);
-        return inlineBox-&gt;linesVisualOverflowBoundingBoxInRegion(this);
</del><ins>+    if (is&lt;RenderInline&gt;(box)) {
+        const RenderInline&amp; inlineBox = downcast&lt;RenderInline&gt;(box);
+        return inlineBox.linesVisualOverflowBoundingBoxInRegion(this);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (box-&gt;isBox()) {
</del><ins>+    if (is&lt;RenderBox&gt;(box)) {
</ins><span class="cx">         RefPtr&lt;RenderOverflow&gt; overflow;
</span><del>-        ensureOverflowForBox(toRenderBox(box), overflow, true);
</del><ins>+        ensureOverflowForBox(&amp;downcast&lt;RenderBox&gt;(box), overflow, true);
</ins><span class="cx"> 
</span><span class="cx">         ASSERT(overflow);
</span><span class="cx">         return overflow-&gt;visualOverflowRect();
</span><span class="lines">@@ -563,7 +563,7 @@
</span><span class="cx">     return rect;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LayoutRect RenderRegion::visualOverflowRectForBoxForPropagation(const RenderBoxModelObject* box)
</del><ins>+LayoutRect RenderRegion::visualOverflowRectForBoxForPropagation(const RenderBoxModelObject&amp; box)
</ins><span class="cx"> {
</span><span class="cx">     LayoutRect rect = visualOverflowRectForBox(box);
</span><span class="cx">     flowThread()-&gt;flipForWritingModeLocalCoordinates(rect);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderRegionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderRegion.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderRegion.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderRegion.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -113,9 +113,9 @@
</span><span class="cx">     void addLayoutOverflowForBox(const RenderBox*, const LayoutRect&amp;);
</span><span class="cx">     void addVisualOverflowForBox(const RenderBox*, const LayoutRect&amp;);
</span><span class="cx">     LayoutRect layoutOverflowRectForBox(const RenderBox*);
</span><del>-    LayoutRect visualOverflowRectForBox(const RenderBoxModelObject*);
</del><ins>+    LayoutRect visualOverflowRectForBox(const RenderBoxModelObject&amp;);
</ins><span class="cx">     LayoutRect layoutOverflowRectForBoxForPropagation(const RenderBox*);
</span><del>-    LayoutRect visualOverflowRectForBoxForPropagation(const RenderBoxModelObject*);
</del><ins>+    LayoutRect visualOverflowRectForBoxForPropagation(const RenderBoxModelObject&amp;);
</ins><span class="cx"> 
</span><span class="cx">     LayoutRect rectFlowPortionForBox(const RenderBox*, const LayoutRect&amp;) const;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderReplacedcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderReplaced.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderReplaced.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderReplaced.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx"> void RenderReplaced::willBeDestroyed()
</span><span class="cx"> {
</span><span class="cx">     if (!documentBeingDestroyed() &amp;&amp; parent())
</span><del>-        parent()-&gt;dirtyLinesFromChangedChild(this);
</del><ins>+        parent()-&gt;dirtyLinesFromChangedChild(*this);
</ins><span class="cx"> 
</span><span class="cx">     RenderBox::willBeDestroyed();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderTextLineBoxescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -109,7 +109,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (!m_first) {
</span><span class="cx">         if (renderer.parent())
</span><del>-            renderer.parent()-&gt;dirtyLinesFromChangedChild(&amp;renderer);
</del><ins>+            renderer.parent()-&gt;dirtyLinesFromChangedChild(renderer);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     for (auto box = m_first; box; box = box-&gt;nextTextBox())
</span><span class="lines">@@ -683,7 +683,7 @@
</span><span class="cx">     
</span><span class="cx">     // If the text node is empty, dirty the line where new text will be inserted.
</span><span class="cx">     if (!m_first &amp;&amp; renderer.parent()) {
</span><del>-        renderer.parent()-&gt;dirtyLinesFromChangedChild(&amp;renderer);
</del><ins>+        renderer.parent()-&gt;dirtyLinesFromChangedChild(renderer);
</ins><span class="cx">         dirtiedLines = true;
</span><span class="cx">     }
</span><span class="cx">     return dirtiedLines;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderinglineBreakingContextInlineHeadersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/line/BreakingContextInlineHeaders.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/line/BreakingContextInlineHeaders.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/line/BreakingContextInlineHeaders.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -286,8 +286,8 @@
</span><span class="cx">     unsigned lineDepth = 1;
</span><span class="cx">     LayoutUnit extraWidth = 0;
</span><span class="cx">     RenderElement* parent = child-&gt;parent();
</span><del>-    while (parent-&gt;isRenderInline() &amp;&amp; lineDepth++ &lt; cMaxLineDepth) {
-        const RenderInline&amp; parentAsRenderInline = toRenderInline(*parent);
</del><ins>+    while (is&lt;RenderInline&gt;(*parent) &amp;&amp; lineDepth++ &lt; cMaxLineDepth) {
+        const auto&amp; parentAsRenderInline = downcast&lt;RenderInline&gt;(*parent);
</ins><span class="cx">         if (!isEmptyInline(parentAsRenderInline)) {
</span><span class="cx">             checkStartEdge = checkStartEdge &amp;&amp; shouldAddBorderPaddingMargin(previousInFlowSibling(child));
</span><span class="cx">             if (checkStartEdge)
</span><span class="lines">@@ -373,7 +373,7 @@
</span><span class="cx"> 
</span><span class="cx"> inline void BreakingContext::handleEmptyInline()
</span><span class="cx"> {
</span><del>-    RenderInline&amp; flowBox = toRenderInline(*m_current.renderer());
</del><ins>+    RenderInline&amp; flowBox = downcast&lt;RenderInline&gt;(*m_current.renderer());
</ins><span class="cx"> 
</span><span class="cx">     // This should only end up being called on empty inlines
</span><span class="cx">     ASSERT(isEmptyInline(flowBox));
</span></span></pre></div>
<a id="trunkSourceWebCorerenderinglineLineInlineHeadersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/line/LineInlineHeaders.h (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/line/LineInlineHeaders.h        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/line/LineInlineHeaders.h        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -105,8 +105,8 @@
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     bool rendererIsEmptyInline = false;
</span><del>-    if (it.renderer()-&gt;isRenderInline()) {
-        const RenderInline&amp; inlineRenderer = toRenderInline(*it.renderer());
</del><ins>+    if (is&lt;RenderInline&gt;(*it.renderer())) {
+        const auto&amp; inlineRenderer = downcast&lt;RenderInline&gt;(*it.renderer());
</ins><span class="cx">         if (!alwaysRequiresLineBox(inlineRenderer) &amp;&amp; !requiresLineBoxForContent(inlineRenderer, lineInfo))
</span><span class="cx">             return false;
</span><span class="cx">         rendererIsEmptyInline = isEmptyInline(inlineRenderer);
</span><span class="lines">@@ -126,12 +126,12 @@
</span><span class="cx">     // will work for the common cases
</span><span class="cx">     RenderElement* containerBlock = child.container();
</span><span class="cx">     LayoutUnit blockHeight = block.logicalHeight();
</span><del>-    if (containerBlock-&gt;isRenderInline()) {
</del><ins>+    if (is&lt;RenderInline&gt;(*containerBlock)) {
</ins><span class="cx">         // A relative positioned inline encloses us. In this case, we also have to determine our
</span><span class="cx">         // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
</span><span class="cx">         // inline so that we can obtain the value later.
</span><del>-        toRenderInline(containerBlock)-&gt;layer()-&gt;setStaticInlinePosition(block.startAlignedOffsetForLine(blockHeight, false));
-        toRenderInline(containerBlock)-&gt;layer()-&gt;setStaticBlockPosition(blockHeight);
</del><ins>+        downcast&lt;RenderInline&gt;(*containerBlock).layer()-&gt;setStaticInlinePosition(block.startAlignedOffsetForLine(blockHeight, false));
+        downcast&lt;RenderInline&gt;(*containerBlock).layer()-&gt;setStaticBlockPosition(blockHeight);
</ins><span class="cx">     }
</span><span class="cx">     block.updateStaticInlinePositionForChild(child, blockHeight);
</span><span class="cx">     child.layer()-&gt;setStaticBlockPosition(blockHeight);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGInlineTextBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp (174713 => 174714)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp        2014-10-15 00:02:24 UTC (rev 174713)
+++ trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp        2014-10-15 00:29:51 UTC (rev 174714)
</span><span class="lines">@@ -338,8 +338,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Finally, paint the outline if any.
</span><del>-    if (renderer().style().hasOutline() &amp;&amp; parentRenderer.isRenderInline())
-        toRenderInline(parentRenderer).paintOutline(paintInfo, paintOffset);
</del><ins>+    if (renderer().style().hasOutline() &amp;&amp; is&lt;RenderInline&gt;(parentRenderer))
+        downcast&lt;RenderInline&gt;(parentRenderer).paintOutline(paintInfo, paintOffset);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(!m_paintingResource);
</span><span class="cx"> }
</span></span></pre>
</div>
</div>

</body>
</html>