<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[174746] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/174746">174746</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2014-10-15 17:05:37 -0700 (Wed, 15 Oct 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Use is&lt;&gt;() / downcast&lt;&gt;() for InlineBox subclasses
https://bugs.webkit.org/show_bug.cgi?id=137749

Reviewed by Darin Adler.

Use is&lt;&gt;() / downcast&lt;&gt;() for InlineBox subclasses and clean up the
surrounding code.

No new tests, no behavior change.

* dom/Position.cpp:
(WebCore::Position::upstream):
(WebCore::Position::downstream):
* editing/VisibleUnits.cpp:
(WebCore::wordBreakIteratorForMinOffsetBoundary):
(WebCore::wordBreakIteratorForMaxOffsetBoundary):
(WebCore::visualWordPosition):
(WebCore::startPositionForLine):
(WebCore::endPositionForLine):
* rendering/InlineBox.cpp:
(WebCore::InlineBox::root):
(WebCore::InlineBox::nextLeafChild):
(WebCore::InlineBox::prevLeafChild):
(WebCore::InlineBox::nextLeafChildIgnoringLineBreak):
* rendering/InlineBox.h:
* rendering/InlineElementBox.h:
* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::getFlowSpacingLogicalWidth):
(WebCore::InlineFlowBox::addToLine):
(WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
(WebCore::InlineFlowBox::placeBoxRangeInInlineDirection):
(WebCore::InlineFlowBox::requiresIdeographicBaseline):
(WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
(WebCore::InlineFlowBox::computeLogicalBoxHeights):
(WebCore::InlineFlowBox::placeBoxesInBlockDirection):
(WebCore::InlineFlowBox::computeMaxLogicalTop):
(WebCore::InlineFlowBox::flipLinesInBlockDirection):
(WebCore::InlineFlowBox::computeOverflow):
(WebCore::InlineFlowBox::firstLeafChild):
(WebCore::InlineFlowBox::lastLeafChild):
(WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
(WebCore::InlineFlowBox::computeUnderAnnotationAdjustment):
* rendering/InlineFlowBox.h:
* rendering/InlineTextBox.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::positionForBox):
* rendering/RenderBlockFlow.h:
(WebCore::RenderBlockFlow::firstRootBox):
(WebCore::RenderBlockFlow::lastRootBox):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::createLineBoxes):
(WebCore::RenderBlockFlow::constructLine):
(WebCore::setLogicalWidthForTextRun):
(WebCore::computeExpansionForJustifiedText):
(WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
(WebCore::RenderBlockFlow::computeBlockDirectionPositionsForLine):
(WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns):
* rendering/RenderText.cpp:
(WebCore::RenderText::localCaretRect):
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::isHyphenated):
(WebCore::RootInlineBox::ascentAndDescentForBox):
* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::nextRootBox):
(WebCore::RootInlineBox::prevRootBox):
* rendering/svg/RenderSVGInlineText.cpp:
(WebCore::RenderSVGInlineText::localCaretRect):
(WebCore::RenderSVGInlineText::positionForPoint):
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::positionForPoint):
* rendering/svg/SVGInlineFlowBox.cpp:
(WebCore::SVGInlineFlowBox::paintSelectionBackground):
(WebCore::SVGInlineFlowBox::paint):
(WebCore::SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer):
* rendering/svg/SVGInlineFlowBox.h:
* rendering/svg/SVGInlineTextBox.h:
* rendering/svg/SVGRenderTreeAsText.cpp:
(WebCore::writeRenderSVGTextBox):
(WebCore::writeSVGInlineTextBoxes):
* rendering/svg/SVGRootInlineBox.cpp:
(WebCore::SVGRootInlineBox::paint):
(WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
(WebCore::SVGRootInlineBox::layoutChildBoxes):
(WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
* rendering/svg/SVGRootInlineBox.h:
* rendering/svg/SVGTextQuery.cpp:
(WebCore::SVGTextQuery::collectTextBoxesInFlowBox):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomPositioncpp">trunk/Source/WebCore/dom/Position.cpp</a></li>
<li><a href="#trunkSourceWebCoreeditingVisibleUnitscpp">trunk/Source/WebCore/editing/VisibleUnits.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineBoxcpp">trunk/Source/WebCore/rendering/InlineBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineBoxh">trunk/Source/WebCore/rendering/InlineBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineElementBoxh">trunk/Source/WebCore/rendering/InlineElementBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineFlowBoxcpp">trunk/Source/WebCore/rendering/InlineFlowBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineFlowBoxh">trunk/Source/WebCore/rendering/InlineFlowBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineTextBoxh">trunk/Source/WebCore/rendering/InlineTextBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowcpp">trunk/Source/WebCore/rendering/RenderBlockFlow.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowh">trunk/Source/WebCore/rendering/RenderBlockFlow.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockLineLayoutcpp">trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderTextcpp">trunk/Source/WebCore/rendering/RenderText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRootInlineBoxcpp">trunk/Source/WebCore/rendering/RootInlineBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRootInlineBoxh">trunk/Source/WebCore/rendering/RootInlineBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgRenderSVGInlineTextcpp">trunk/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgRenderSVGTextcpp">trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGInlineFlowBoxcpp">trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGInlineFlowBoxh">trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGInlineTextBoxh">trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGRenderTreeAsTextcpp">trunk/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGRootInlineBoxcpp">trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGRootInlineBoxh">trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingsvgSVGTextQuerycpp">trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/ChangeLog        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -1,3 +1,93 @@
</span><ins>+2014-10-15  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for InlineBox subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=137749
+
+        Reviewed by Darin Adler.
+
+        Use is&lt;&gt;() / downcast&lt;&gt;() for InlineBox subclasses and clean up the
+        surrounding code.
+
+        No new tests, no behavior change.
+
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        * editing/VisibleUnits.cpp:
+        (WebCore::wordBreakIteratorForMinOffsetBoundary):
+        (WebCore::wordBreakIteratorForMaxOffsetBoundary):
+        (WebCore::visualWordPosition):
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::root):
+        (WebCore::InlineBox::nextLeafChild):
+        (WebCore::InlineBox::prevLeafChild):
+        (WebCore::InlineBox::nextLeafChildIgnoringLineBreak):
+        * rendering/InlineBox.h:
+        * rendering/InlineElementBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::getFlowSpacingLogicalWidth):
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::placeBoxRangeInInlineDirection):
+        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::computeMaxLogicalTop):
+        (WebCore::InlineFlowBox::flipLinesInBlockDirection):
+        (WebCore::InlineFlowBox::computeOverflow):
+        (WebCore::InlineFlowBox::firstLeafChild):
+        (WebCore::InlineFlowBox::lastLeafChild):
+        (WebCore::InlineFlowBox::computeOverAnnotationAdjustment):
+        (WebCore::InlineFlowBox::computeUnderAnnotationAdjustment):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::positionForBox):
+        * rendering/RenderBlockFlow.h:
+        (WebCore::RenderBlockFlow::firstRootBox):
+        (WebCore::RenderBlockFlow::lastRootBox):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::createLineBoxes):
+        (WebCore::RenderBlockFlow::constructLine):
+        (WebCore::setLogicalWidthForTextRun):
+        (WebCore::computeExpansionForJustifiedText):
+        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
+        (WebCore::RenderBlockFlow::computeBlockDirectionPositionsForLine):
+        (WebCore::RenderBlockFlow::createLineBoxesFromBidiRuns):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::isHyphenated):
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect):
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::positionForPoint):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paintSelectionBackground):
+        (WebCore::SVGInlineFlowBox::paint):
+        (WebCore::SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer):
+        * rendering/svg/SVGInlineFlowBox.h:
+        * rendering/svg/SVGInlineTextBox.h:
+        * rendering/svg/SVGRenderTreeAsText.cpp:
+        (WebCore::writeRenderSVGTextBox):
+        (WebCore::writeSVGInlineTextBoxes):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        (WebCore::SVGRootInlineBox::layoutChildBoxes):
+        (WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
+        * rendering/svg/SVGRootInlineBox.h:
+        * rendering/svg/SVGTextQuery.cpp:
+        (WebCore::SVGTextQuery::collectTextBoxesInFlowBox):
+
</ins><span class="cx"> 2014-10-15  Roger Fong  &lt;roger_fong@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         glReadPixels on NVIDIA cards returns the wrong values for the alpha channel when alpha is off.
</span></span></pre></div>
<a id="trunkSourceWebCoredomPositioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Position.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Position.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/dom/Position.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -661,7 +661,7 @@
</span><span class="cx">                     otherBox = otherBox-&gt;nextLeafChild();
</span><span class="cx">                     if (!otherBox)
</span><span class="cx">                         break;
</span><del>-                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; toInlineTextBox(otherBox)-&gt;start() &gt; textOffset))
</del><ins>+                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; downcast&lt;InlineTextBox&gt;(*otherBox).start() &gt; textOffset))
</ins><span class="cx">                         continuesOnNextLine = false;
</span><span class="cx">                 }
</span><span class="cx"> 
</span><span class="lines">@@ -670,7 +670,7 @@
</span><span class="cx">                     otherBox = otherBox-&gt;prevLeafChild();
</span><span class="cx">                     if (!otherBox)
</span><span class="cx">                         break;
</span><del>-                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; toInlineTextBox(otherBox)-&gt;start() &gt; textOffset))
</del><ins>+                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; downcast&lt;InlineTextBox&gt;(*otherBox).start() &gt; textOffset))
</ins><span class="cx">                         continuesOnNextLine = false;
</span><span class="cx">                 }
</span><span class="cx"> 
</span><span class="lines">@@ -789,7 +789,7 @@
</span><span class="cx">                     otherBox = otherBox-&gt;nextLeafChild();
</span><span class="cx">                     if (!otherBox)
</span><span class="cx">                         break;
</span><del>-                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; toInlineTextBox(otherBox)-&gt;start() &gt;= textOffset))
</del><ins>+                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; downcast&lt;InlineTextBox&gt;(*otherBox).start() &gt;= textOffset))
</ins><span class="cx">                         continuesOnNextLine = false;
</span><span class="cx">                 }
</span><span class="cx"> 
</span><span class="lines">@@ -798,7 +798,7 @@
</span><span class="cx">                     otherBox = otherBox-&gt;prevLeafChild();
</span><span class="cx">                     if (!otherBox)
</span><span class="cx">                         break;
</span><del>-                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; toInlineTextBox(otherBox)-&gt;start() &gt;= textOffset))
</del><ins>+                    if (otherBox == lastTextBox || (&amp;otherBox-&gt;renderer() == &amp;textRenderer &amp;&amp; downcast&lt;InlineTextBox&gt;(*otherBox).start() &gt;= textOffset))
</ins><span class="cx">                         continuesOnNextLine = false;
</span><span class="cx">                 }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreeditingVisibleUnitscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/editing/VisibleUnits.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/editing/VisibleUnits.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/editing/VisibleUnits.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -292,10 +292,10 @@
</span><span class="cx"> 
</span><span class="cx">     string.clear();
</span><span class="cx"> 
</span><del>-    if (previousBox &amp;&amp; previousBox-&gt;isInlineTextBox()) {
-        const InlineTextBox* previousTextBox = toInlineTextBox(previousBox);
-        previousBoxLength = previousTextBox-&gt;len();
-        append(string, StringView(previousTextBox-&gt;renderer().text()).substring(previousTextBox-&gt;start(), previousBoxLength));
</del><ins>+    if (is&lt;InlineTextBox&gt;(previousBox)) {
+        const auto&amp; previousTextBox = downcast&lt;InlineTextBox&gt;(*previousBox);
+        previousBoxLength = previousTextBox.len();
+        append(string, StringView(previousTextBox.renderer().text()).substring(previousTextBox.start(), previousBoxLength));
</ins><span class="cx">     }
</span><span class="cx">     append(string, StringView(textBox-&gt;renderer().text()).substring(textBox-&gt;start(), textBox-&gt;len()));
</span><span class="cx"> 
</span><span class="lines">@@ -312,9 +312,9 @@
</span><span class="cx"> 
</span><span class="cx">     string.clear();
</span><span class="cx">     append(string, StringView(textBox-&gt;renderer().text()).substring(textBox-&gt;start(), textBox-&gt;len()));
</span><del>-    if (nextBox &amp;&amp; nextBox-&gt;isInlineTextBox()) {
-        const InlineTextBox* nextTextBox = toInlineTextBox(nextBox);
-        append(string, StringView(nextTextBox-&gt;renderer().text()).substring(nextTextBox-&gt;start(), nextTextBox-&gt;len()));
</del><ins>+    if (is&lt;InlineTextBox&gt;(nextBox)) {
+        const auto&amp; nextTextBox = downcast&lt;InlineTextBox&gt;(*nextBox);
+        append(string, StringView(nextTextBox.renderer().text()).substring(nextTextBox.start(), nextTextBox.len()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return wordBreakIterator(StringView(string.data(), string.size()));
</span><span class="lines">@@ -364,23 +364,23 @@
</span><span class="cx">     
</span><span class="cx">         if (!box)
</span><span class="cx">             break;
</span><del>-        if (!box-&gt;isInlineTextBox()) {
</del><ins>+        if (!is&lt;InlineTextBox&gt;(*box)) {
</ins><span class="cx">             current = adjacentCharacterPosition;
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        InlineTextBox* textBox = toInlineTextBox(box);
</del><ins>+        InlineTextBox&amp; textBox = downcast&lt;InlineTextBox&gt;(*box);
</ins><span class="cx">         int previousBoxLength = 0;
</span><span class="cx">         bool previousBoxInDifferentBlock = false;
</span><span class="cx">         bool nextBoxInDifferentBlock = false;
</span><span class="cx">         bool movingIntoNewBox = previouslyVisitedBox != box;
</span><span class="cx"> 
</span><span class="cx">         if (offsetInBox == box-&gt;caretMinOffset())
</span><del>-            iter = wordBreakIteratorForMinOffsetBoundary(visiblePosition, textBox, previousBoxLength, previousBoxInDifferentBlock, string, leafBoxes);
</del><ins>+            iter = wordBreakIteratorForMinOffsetBoundary(visiblePosition, &amp;textBox, previousBoxLength, previousBoxInDifferentBlock, string, leafBoxes);
</ins><span class="cx">         else if (offsetInBox == box-&gt;caretMaxOffset())
</span><del>-            iter = wordBreakIteratorForMaxOffsetBoundary(visiblePosition, textBox, nextBoxInDifferentBlock, string, leafBoxes);
</del><ins>+            iter = wordBreakIteratorForMaxOffsetBoundary(visiblePosition, &amp;textBox, nextBoxInDifferentBlock, string, leafBoxes);
</ins><span class="cx">         else if (movingIntoNewBox) {
</span><del>-            iter = wordBreakIterator(StringView(textBox-&gt;renderer().text()).substring(textBox-&gt;start(), textBox-&gt;len()));
</del><ins>+            iter = wordBreakIterator(StringView(textBox.renderer().text()).substring(textBox.start(), textBox.len()));
</ins><span class="cx">             previouslyVisitedBox = box;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -388,17 +388,17 @@
</span><span class="cx">             break;
</span><span class="cx"> 
</span><span class="cx">         textBreakFirst(iter);
</span><del>-        int offsetInIterator = offsetInBox - textBox-&gt;start() + previousBoxLength;
</del><ins>+        int offsetInIterator = offsetInBox - textBox.start() + previousBoxLength;
</ins><span class="cx"> 
</span><span class="cx">         bool isWordBreak;
</span><span class="cx">         bool boxHasSameDirectionalityAsBlock = box-&gt;direction() == blockDirection;
</span><span class="cx">         bool movingBackward = (direction == MoveLeft &amp;&amp; box-&gt;direction() == LTR) || (direction == MoveRight &amp;&amp; box-&gt;direction() == RTL);
</span><span class="cx">         if ((skipsSpaceWhenMovingRight &amp;&amp; boxHasSameDirectionalityAsBlock)
</span><span class="cx">             || (!skipsSpaceWhenMovingRight &amp;&amp; movingBackward)) {
</span><del>-            bool logicalStartInRenderer = offsetInBox == static_cast&lt;int&gt;(textBox-&gt;start()) &amp;&amp; previousBoxInDifferentBlock;
</del><ins>+            bool logicalStartInRenderer = offsetInBox == static_cast&lt;int&gt;(textBox.start()) &amp;&amp; previousBoxInDifferentBlock;
</ins><span class="cx">             isWordBreak = isLogicalStartOfWord(iter, offsetInIterator, logicalStartInRenderer);
</span><span class="cx">         } else {
</span><del>-            bool logicalEndInRenderer = offsetInBox == static_cast&lt;int&gt;(textBox-&gt;start() + textBox-&gt;len()) &amp;&amp; nextBoxInDifferentBlock;
</del><ins>+            bool logicalEndInRenderer = offsetInBox == static_cast&lt;int&gt;(textBox.start() + textBox.len()) &amp;&amp; nextBoxInDifferentBlock;
</ins><span class="cx">             isWordBreak = islogicalEndOfWord(iter, offsetInIterator, logicalEndInRenderer);
</span><span class="cx">         }      
</span><span class="cx"> 
</span><span class="lines">@@ -767,7 +767,7 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return is&lt;Text&gt;(*startNode) ? Position(downcast&lt;Text&gt;(startNode), toInlineTextBox(startBox)-&gt;start())
</del><ins>+    return is&lt;Text&gt;(*startNode) ? Position(downcast&lt;Text&gt;(startNode), downcast&lt;InlineTextBox&gt;(*startBox).start())
</ins><span class="cx">         : positionBeforeNode(startNode);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -836,13 +836,13 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Position pos;
</span><del>-    if (endNode-&gt;hasTagName(brTag))
</del><ins>+    if (is&lt;HTMLBRElement&gt;(*endNode))
</ins><span class="cx">         pos = positionBeforeNode(endNode);
</span><del>-    else if (endBox-&gt;isInlineTextBox() &amp;&amp; is&lt;Text&gt;(*endNode)) {
-        InlineTextBox* endTextBox = toInlineTextBox(endBox);
-        int endOffset = endTextBox-&gt;start();
-        if (!endTextBox-&gt;isLineBreak())
-            endOffset += endTextBox-&gt;len();
</del><ins>+    else if (is&lt;InlineTextBox&gt;(*endBox) &amp;&amp; is&lt;Text&gt;(*endNode)) {
+        auto&amp; endTextBox = downcast&lt;InlineTextBox&gt;(*endBox);
+        int endOffset = endTextBox.start();
+        if (!endTextBox.isLineBreak())
+            endOffset += endTextBox.len();
</ins><span class="cx">         pos = Position(downcast&lt;Text&gt;(endNode), endOffset);
</span><span class="cx">     } else
</span><span class="cx">         pos = positionAfterNode(endNode);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineBox.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineBox.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineBox.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -184,16 +184,14 @@
</span><span class="cx"> { 
</span><span class="cx">     if (parent())
</span><span class="cx">         return parent()-&gt;root();
</span><del>-    ASSERT_WITH_SECURITY_IMPLICATION(isRootInlineBox());
-    return toRootInlineBox(*this);
</del><ins>+    return downcast&lt;RootInlineBox&gt;(*this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> RootInlineBox&amp; InlineBox::root()
</span><span class="cx"> { 
</span><span class="cx">     if (parent())
</span><span class="cx">         return parent()-&gt;root();
</span><del>-    ASSERT_WITH_SECURITY_IMPLICATION(isRootInlineBox());
-    return toRootInlineBox(*this);
</del><ins>+    return downcast&lt;RootInlineBox&gt;(*this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool InlineBox::nextOnLineExists() const
</span><span class="lines">@@ -222,9 +220,9 @@
</span><span class="cx"> 
</span><span class="cx"> InlineBox* InlineBox::nextLeafChild() const
</span><span class="cx"> {
</span><del>-    InlineBox* leaf = 0;
</del><ins>+    InlineBox* leaf = nullptr;
</ins><span class="cx">     for (InlineBox* box = nextOnLine(); box &amp;&amp; !leaf; box = box-&gt;nextOnLine())
</span><del>-        leaf = box-&gt;isLeaf() ? box : toInlineFlowBox(box)-&gt;firstLeafChild();
</del><ins>+        leaf = box-&gt;isLeaf() ? box : downcast&lt;InlineFlowBox&gt;(*box).firstLeafChild();
</ins><span class="cx">     if (!leaf &amp;&amp; parent())
</span><span class="cx">         leaf = parent()-&gt;nextLeafChild();
</span><span class="cx">     return leaf;
</span><span class="lines">@@ -232,9 +230,9 @@
</span><span class="cx">     
</span><span class="cx"> InlineBox* InlineBox::prevLeafChild() const
</span><span class="cx"> {
</span><del>-    InlineBox* leaf = 0;
</del><ins>+    InlineBox* leaf = nullptr;
</ins><span class="cx">     for (InlineBox* box = prevOnLine(); box &amp;&amp; !leaf; box = box-&gt;prevOnLine())
</span><del>-        leaf = box-&gt;isLeaf() ? box : toInlineFlowBox(box)-&gt;lastLeafChild();
</del><ins>+        leaf = box-&gt;isLeaf() ? box : downcast&lt;InlineFlowBox&gt;(*box).lastLeafChild();
</ins><span class="cx">     if (!leaf &amp;&amp; parent())
</span><span class="cx">         leaf = parent()-&gt;prevLeafChild();
</span><span class="cx">     return leaf;
</span><span class="lines">@@ -244,7 +242,7 @@
</span><span class="cx"> {
</span><span class="cx">     InlineBox* leaf = nextLeafChild();
</span><span class="cx">     if (leaf &amp;&amp; leaf-&gt;isLineBreak())
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx">     return leaf;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -24,6 +24,7 @@
</span><span class="cx"> #include &quot;RenderBoxModelObject.h&quot;
</span><span class="cx"> #include &quot;RenderText.h&quot;
</span><span class="cx"> #include &quot;TextDirection.h&quot;
</span><ins>+#include &lt;wtf/TypeCasts.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="lines">@@ -421,9 +422,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-#define INLINE_BOX_OBJECT_TYPE_CASTS(ToValueTypeName, predicate) \
-    TYPE_CASTS_BASE(ToValueTypeName, InlineBox, object, object-&gt;predicate, object.predicate)
-
</del><span class="cx"> #if ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><span class="cx"> 
</span><span class="cx"> inline InlineBox::~InlineBox()
</span><span class="lines">@@ -438,6 +436,11 @@
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+#define SPECIALIZE_TYPE_TRAITS_INLINE_BOX(ToValueTypeName, predicate) \
+SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::ToValueTypeName) \
+    static bool isType(const WebCore::InlineBox&amp; box) { return box.predicate; } \
+SPECIALIZE_TYPE_TRAITS_END()
+
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> // Outside the WebCore namespace for ease of invocation from gdb.
</span><span class="cx"> void showNodeTree(const WebCore::InlineBox*);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineElementBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineElementBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineElementBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineElementBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -55,8 +55,8 @@
</span><span class="cx">     virtual bool isInlineElementBox() const override final { return true; }
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(InlineElementBox, isInlineElementBox())
</del><ins>+} // namespace WebCore
</ins><span class="cx"> 
</span><del>-}
</del><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(InlineElementBox, isInlineElementBox())
</ins><span class="cx"> 
</span><span class="cx"> #endif // InlineElementBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineFlowBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineFlowBox.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineFlowBox.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineFlowBox.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx"> #include &quot;RenderBlock.h&quot;
</span><span class="cx"> #include &quot;RenderInline.h&quot;
</span><span class="cx"> #include &quot;RenderLayer.h&quot;
</span><ins>+#include &quot;RenderLineBreak.h&quot;
</ins><span class="cx"> #include &quot;RenderListMarker.h&quot;
</span><span class="cx"> #include &quot;RenderRubyBase.h&quot;
</span><span class="cx"> #include &quot;RenderRubyRun.h&quot;
</span><span class="lines">@@ -70,12 +71,12 @@
</span><span class="cx"> 
</span><span class="cx"> LayoutUnit InlineFlowBox::getFlowSpacingLogicalWidth()
</span><span class="cx"> {
</span><del>-    LayoutUnit totWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;isInlineFlowBox())
-            totWidth += toInlineFlowBox(curr)-&gt;getFlowSpacingLogicalWidth();
</del><ins>+    LayoutUnit totalWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (is&lt;InlineFlowBox&gt;(*child))
+            totalWidth += downcast&lt;InlineFlowBox&gt;(*child).getFlowSpacingLogicalWidth();
</ins><span class="cx">     }
</span><del>-    return totWidth;
</del><ins>+    return totalWidth;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void setHasTextDescendantsOnAncestors(InlineFlowBox* box)
</span><span class="lines">@@ -108,8 +109,8 @@
</span><span class="cx">         if (child-&gt;renderer().parent() == &amp;renderer())
</span><span class="cx">             m_hasTextChildren = true;
</span><span class="cx">         setHasTextDescendantsOnAncestors(this);
</span><del>-    } else if (child-&gt;isInlineFlowBox()) {
-        if (toInlineFlowBox(child)-&gt;hasTextDescendants())
</del><ins>+    } else if (is&lt;InlineFlowBox&gt;(*child)) {
+        if (downcast&lt;InlineFlowBox&gt;(*child).hasTextDescendants())
</ins><span class="cx">             setHasTextDescendantsOnAncestors(this);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -134,10 +135,9 @@
</span><span class="cx">                 // Other than making a zillion tests have to regenerate results, there's no reason to ditch the optimization here.
</span><span class="cx">                 shouldClearDescendantsHaveSameLineHeightAndBaseline = child-&gt;renderer().isBR();
</span><span class="cx">             } else {
</span><del>-                ASSERT(isInlineFlowBox());
-                InlineFlowBox* childFlowBox = toInlineFlowBox(child);
</del><ins>+                auto&amp; childFlowBox = downcast&lt;InlineFlowBox&gt;(*child);
</ins><span class="cx">                 // Check the child's bit, and then also check for differences in font, line-height, vertical-align
</span><del>-                if (!childFlowBox-&gt;descendantsHaveSameLineHeightAndBaseline()
</del><ins>+                if (!childFlowBox.descendantsHaveSameLineHeightAndBaseline()
</ins><span class="cx">                     || !parentStyle.font().fontMetrics().hasIdenticalAscentDescentAndLineGap(childStyle.font().fontMetrics())
</span><span class="cx">                     || parentStyle.lineHeight() != childStyle.lineHeight()
</span><span class="cx">                     || (parentStyle.verticalAlign() != BASELINE &amp;&amp; !isRootInlineBox()) || childStyle.verticalAlign() != BASELINE
</span><span class="lines">@@ -165,7 +165,7 @@
</span><span class="cx">             || childStyle.hasBorderImageOutsets()))
</span><span class="cx">             child-&gt;clearKnownToHaveNoOverflow();
</span><span class="cx">         
</span><del>-        if (knownToHaveNoOverflow() &amp;&amp; child-&gt;isInlineFlowBox() &amp;&amp; !toInlineFlowBox(child)-&gt;knownToHaveNoOverflow())
</del><ins>+        if (knownToHaveNoOverflow() &amp;&amp; is&lt;InlineFlowBox&gt;(*child) &amp;&amp; !downcast&lt;InlineFlowBox&gt;(*child).knownToHaveNoOverflow())
</ins><span class="cx">             clearKnownToHaveNoOverflow();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -347,11 +347,9 @@
</span><span class="cx">     setEdges(includeLeftEdge, includeRightEdge);
</span><span class="cx"> 
</span><span class="cx">     // Recur into our children.
</span><del>-    for (InlineBox* currChild = firstChild(); currChild; currChild = currChild-&gt;nextOnLine()) {
-        if (currChild-&gt;isInlineFlowBox()) {
-            InlineFlowBox* currFlow = toInlineFlowBox(currChild);
-            currFlow-&gt;determineSpacingForFlowBoxes(lastLine, isLogicallyLastRunWrapped, logicallyLastRunRenderer);
-        }
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (is&lt;InlineFlowBox&gt;(*child))
+            downcast&lt;InlineFlowBox&gt;(*child).determineSpacingForFlowBoxes(lastLine, isLogicallyLastRunWrapped, logicallyLastRunRenderer);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -375,52 +373,52 @@
</span><span class="cx"> 
</span><span class="cx"> float InlineFlowBox::placeBoxRangeInInlineDirection(InlineBox* firstChild, InlineBox* lastChild, float&amp; logicalLeft, float&amp; minLogicalLeft, float&amp; maxLogicalRight, bool&amp; needsWordSpacing)
</span><span class="cx"> {
</span><del>-    for (InlineBox* curr = firstChild; curr &amp;&amp; curr != lastChild; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isText()) {
-            InlineTextBox* text = toInlineTextBox(curr);
-            RenderText&amp; rt = text-&gt;renderer();
-            if (rt.textLength()) {
-                if (needsWordSpacing &amp;&amp; isSpaceOrNewline(rt.characterAt(text-&gt;start())))
-                    logicalLeft += text-&gt;lineStyle().font().wordSpacing();
-                needsWordSpacing = !isSpaceOrNewline(rt.characterAt(text-&gt;end()));
</del><ins>+    for (InlineBox* child = firstChild; child &amp;&amp; child != lastChild; child = child-&gt;nextOnLine()) {
+        if (is&lt;RenderText&gt;(child-&gt;renderer())) {
+            auto&amp; textBox = downcast&lt;InlineTextBox&gt;(*child);
+            RenderText&amp; renderText = textBox.renderer();
+            if (renderText.textLength()) {
+                if (needsWordSpacing &amp;&amp; isSpaceOrNewline(renderText.characterAt(textBox.start())))
+                    logicalLeft += textBox.lineStyle().font().wordSpacing();
+                needsWordSpacing = !isSpaceOrNewline(renderText.characterAt(textBox.end()));
</ins><span class="cx">             }
</span><del>-            text-&gt;setLogicalLeft(logicalLeft);
</del><ins>+            textBox.setLogicalLeft(logicalLeft);
</ins><span class="cx">             if (knownToHaveNoOverflow())
</span><span class="cx">                 minLogicalLeft = std::min(logicalLeft, minLogicalLeft);
</span><del>-            logicalLeft += text-&gt;logicalWidth();
</del><ins>+            logicalLeft += textBox.logicalWidth();
</ins><span class="cx">             if (knownToHaveNoOverflow())
</span><span class="cx">                 maxLogicalRight = std::max(logicalLeft, maxLogicalRight);
</span><span class="cx">         } else {
</span><del>-            if (curr-&gt;renderer().isOutOfFlowPositioned()) {
-                if (curr-&gt;renderer().parent()-&gt;style().isLeftToRightDirection())
-                    curr-&gt;setLogicalLeft(logicalLeft);
</del><ins>+            if (child-&gt;renderer().isOutOfFlowPositioned()) {
+                if (child-&gt;renderer().parent()-&gt;style().isLeftToRightDirection())
+                    child-&gt;setLogicalLeft(logicalLeft);
</ins><span class="cx">                 else
</span><span class="cx">                     // Our offset that we cache needs to be from the edge of the right border box and
</span><span class="cx">                     // not the left border box.  We have to subtract |x| from the width of the block
</span><span class="cx">                     // (which can be obtained from the root line box).
</span><del>-                    curr-&gt;setLogicalLeft(root().blockFlow().logicalWidth() - logicalLeft);
</del><ins>+                    child-&gt;setLogicalLeft(root().blockFlow().logicalWidth() - logicalLeft);
</ins><span class="cx">                 continue; // The positioned object has no effect on the width.
</span><span class="cx">             }
</span><del>-            if (curr-&gt;renderer().isRenderInline()) {
-                InlineFlowBox* flow = toInlineFlowBox(curr);
-                logicalLeft += flow-&gt;marginLogicalLeft();
</del><ins>+            if (is&lt;RenderInline&gt;(child-&gt;renderer())) {
+                auto&amp; flow = downcast&lt;InlineFlowBox&gt;(*child);
+                logicalLeft += flow.marginLogicalLeft();
</ins><span class="cx">                 if (knownToHaveNoOverflow())
</span><span class="cx">                     minLogicalLeft = std::min(logicalLeft, minLogicalLeft);
</span><del>-                logicalLeft = flow-&gt;placeBoxesInInlineDirection(logicalLeft, needsWordSpacing);
</del><ins>+                logicalLeft = flow.placeBoxesInInlineDirection(logicalLeft, needsWordSpacing);
</ins><span class="cx">                 if (knownToHaveNoOverflow())
</span><span class="cx">                     maxLogicalRight = std::max(logicalLeft, maxLogicalRight);
</span><del>-                logicalLeft += flow-&gt;marginLogicalRight();
-            } else if (!curr-&gt;renderer().isListMarker() || toRenderListMarker(curr-&gt;renderer()).isInside()) {
</del><ins>+                logicalLeft += flow.marginLogicalRight();
+            } else if (!child-&gt;renderer().isListMarker() || toRenderListMarker(child-&gt;renderer()).isInside()) {
</ins><span class="cx">                 // The box can have a different writing-mode than the overall line, so this is a bit complicated.
</span><span class="cx">                 // Just get all the physical margin and overflow values by hand based off |isVertical|.
</span><del>-                LayoutUnit logicalLeftMargin = isHorizontal() ? curr-&gt;boxModelObject()-&gt;marginLeft() : curr-&gt;boxModelObject()-&gt;marginTop();
-                LayoutUnit logicalRightMargin = isHorizontal() ? curr-&gt;boxModelObject()-&gt;marginRight() : curr-&gt;boxModelObject()-&gt;marginBottom();
</del><ins>+                LayoutUnit logicalLeftMargin = isHorizontal() ? child-&gt;boxModelObject()-&gt;marginLeft() : child-&gt;boxModelObject()-&gt;marginTop();
+                LayoutUnit logicalRightMargin = isHorizontal() ? child-&gt;boxModelObject()-&gt;marginRight() : child-&gt;boxModelObject()-&gt;marginBottom();
</ins><span class="cx">                 
</span><span class="cx">                 logicalLeft += logicalLeftMargin;
</span><del>-                curr-&gt;setLogicalLeft(logicalLeft);
</del><ins>+                child-&gt;setLogicalLeft(logicalLeft);
</ins><span class="cx">                 if (knownToHaveNoOverflow())
</span><span class="cx">                     minLogicalLeft = std::min(logicalLeft, minLogicalLeft);
</span><del>-                logicalLeft += curr-&gt;logicalWidth();
</del><ins>+                logicalLeft += child-&gt;logicalWidth();
</ins><span class="cx">                 if (knownToHaveNoOverflow())
</span><span class="cx">                     maxLogicalRight = std::max(logicalLeft, maxLogicalRight);
</span><span class="cx">                 logicalLeft += logicalRightMargin;
</span><span class="lines">@@ -442,26 +440,26 @@
</span><span class="cx">         || lineStyle.font().primaryFont()-&gt;hasVerticalGlyphs())
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx">         
</span><del>-        if (curr-&gt;isInlineFlowBox()) {
-            if (toInlineFlowBox(curr)-&gt;requiresIdeographicBaseline(textBoxDataMap))
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child)) {
+            if (downcast&lt;InlineFlowBox&gt;(*child).requiresIdeographicBaseline(textBoxDataMap))
</ins><span class="cx">                 return true;
</span><span class="cx">         } else {
</span><del>-            if (curr-&gt;lineStyle().font().primaryFont()-&gt;hasVerticalGlyphs())
</del><ins>+            if (child-&gt;lineStyle().font().primaryFont()-&gt;hasVerticalGlyphs())
</ins><span class="cx">                 return true;
</span><span class="cx">             
</span><del>-            const Vector&lt;const SimpleFontData*&gt;* usedFonts = 0;
-            if (curr-&gt;isInlineTextBox()) {
-                GlyphOverflowAndFallbackFontsMap::const_iterator it = textBoxDataMap.find(toInlineTextBox(curr));
-                usedFonts = it == textBoxDataMap.end() ? 0 : &amp;it-&gt;value.first;
</del><ins>+            const Vector&lt;const SimpleFontData*&gt;* usedFonts = nullptr;
+            if (is&lt;InlineTextBox&gt;(*child)) {
+                GlyphOverflowAndFallbackFontsMap::const_iterator it = textBoxDataMap.find(downcast&lt;InlineTextBox&gt;(child));
+                usedFonts = it == textBoxDataMap.end() ? nullptr : &amp;it-&gt;value.first;
</ins><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             if (usedFonts) {
</span><del>-                for (size_t i = 0; i &lt; usedFonts-&gt;size(); ++i) {
-                    if (usedFonts-&gt;at(i)-&gt;hasVerticalGlyphs())
</del><ins>+                for (const SimpleFontData* fontData : *usedFonts) {
+                    if (fontData-&gt;hasVerticalGlyphs())
</ins><span class="cx">                         return true;
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="lines">@@ -480,15 +478,15 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::adjustMaxAscentAndDescent(int&amp; maxAscent, int&amp; maxDescent, int maxPositionTop, int maxPositionBottom)
</span><span class="cx"> {
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
</ins><span class="cx">         // The computed lineheight needs to be extended for the
</span><span class="cx">         // positioned elements
</span><del>-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx"> 
</span><del>-        if ((curr-&gt;verticalAlign() == TOP || curr-&gt;verticalAlign() == BOTTOM) &amp;&amp; verticalAlignApplies(curr-&gt;renderer())) {
-            int lineHeight = curr-&gt;lineHeight();
-            if (curr-&gt;verticalAlign() == TOP) {
</del><ins>+        if ((child-&gt;verticalAlign() == TOP || child-&gt;verticalAlign() == BOTTOM) &amp;&amp; verticalAlignApplies(child-&gt;renderer())) {
+            int lineHeight = child-&gt;lineHeight();
+            if (child-&gt;verticalAlign() == TOP) {
</ins><span class="cx">                 if (maxAscent + maxDescent &lt; lineHeight)
</span><span class="cx">                     maxDescent = lineHeight - maxAscent;
</span><span class="cx">             }
</span><span class="lines">@@ -501,8 +499,8 @@
</span><span class="cx">                 break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (curr-&gt;isInlineFlowBox())
-            toInlineFlowBox(curr)-&gt;adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child))
+            downcast&lt;InlineFlowBox&gt;(*child).adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -550,11 +548,11 @@
</span><span class="cx">     if (!checkChildren)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx">         
</span><del>-        InlineFlowBox* inlineFlowBox = curr-&gt;isInlineFlowBox() ? toInlineFlowBox(curr) : 0;
</del><ins>+        InlineFlowBox* inlineFlowBox = is&lt;InlineFlowBox&gt;(*child) ? downcast&lt;InlineFlowBox&gt;(child) : nullptr;
</ins><span class="cx">         
</span><span class="cx">         bool affectsAscent = false;
</span><span class="cx">         bool affectsDescent = false;
</span><span class="lines">@@ -562,17 +560,17 @@
</span><span class="cx">         // The verticalPositionForBox function returns the distance between the child box's baseline
</span><span class="cx">         // and the root box's baseline.  The value is negative if the child box's baseline is above the
</span><span class="cx">         // root box's baseline, and it is positive if the child box's baseline is below the root box's baseline.
</span><del>-        curr-&gt;setLogicalTop(rootBox.verticalPositionForBox(curr, verticalPositionCache));
</del><ins>+        child-&gt;setLogicalTop(rootBox.verticalPositionForBox(child, verticalPositionCache));
</ins><span class="cx">         
</span><span class="cx">         int ascent = 0;
</span><span class="cx">         int descent = 0;
</span><del>-        rootBox.ascentAndDescentForBox(*curr, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
</del><ins>+        rootBox.ascentAndDescentForBox(*child, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
</ins><span class="cx"> 
</span><span class="cx">         LayoutUnit boxHeight = ascent + descent;
</span><del>-        if (curr-&gt;verticalAlign() == TOP &amp;&amp; verticalAlignApplies(curr-&gt;renderer())) {
</del><ins>+        if (child-&gt;verticalAlign() == TOP &amp;&amp; verticalAlignApplies(child-&gt;renderer())) {
</ins><span class="cx">             if (maxPositionTop &lt; boxHeight)
</span><span class="cx">                 maxPositionTop = boxHeight;
</span><del>-        } else if (curr-&gt;verticalAlign() == BOTTOM &amp;&amp; verticalAlignApplies(curr-&gt;renderer())) {
</del><ins>+        } else if (child-&gt;verticalAlign() == BOTTOM &amp;&amp; verticalAlignApplies(child-&gt;renderer())) {
</ins><span class="cx">             if (maxPositionBottom &lt; boxHeight)
</span><span class="cx">                 maxPositionBottom = boxHeight;
</span><span class="cx">         } else if (!inlineFlowBox || strictMode || inlineFlowBox-&gt;hasTextChildren() || (inlineFlowBox-&gt;descendantsHaveSameLineHeightAndBaseline() &amp;&amp; inlineFlowBox-&gt;hasTextDescendants())
</span><span class="lines">@@ -583,8 +581,8 @@
</span><span class="cx">             // means is that ascent and descent (including leading), can end up being negative.  The setMaxAscent and
</span><span class="cx">             // setMaxDescent booleans are used to ensure that we're willing to initially set maxAscent/Descent to negative
</span><span class="cx">             // values.
</span><del>-            ascent -= curr-&gt;logicalTop();
-            descent += curr-&gt;logicalTop();
</del><ins>+            ascent -= child-&gt;logicalTop();
+            descent += child-&gt;logicalTop();
</ins><span class="cx">             if (affectsAscent &amp;&amp; (maxAscent &lt; ascent || !setMaxAscent)) {
</span><span class="cx">                 maxAscent = ascent;
</span><span class="cx">                 setMaxAscent = true;
</span><span class="lines">@@ -621,78 +619,78 @@
</span><span class="cx">             adjustmentForChildrenWithSameLineHeightAndBaseline += renderer().borderAndPaddingBefore();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx"> 
</span><span class="cx">         if (descendantsHaveSameLineHeightAndBaseline()) {
</span><del>-            curr-&gt;adjustBlockDirectionPosition(adjustmentForChildrenWithSameLineHeightAndBaseline);
</del><ins>+            child-&gt;adjustBlockDirectionPosition(adjustmentForChildrenWithSameLineHeightAndBaseline);
</ins><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        InlineFlowBox* inlineFlowBox = curr-&gt;isInlineFlowBox() ? toInlineFlowBox(curr) : 0;
</del><ins>+        InlineFlowBox* inlineFlowBox = is&lt;InlineFlowBox&gt;(*child) ? downcast&lt;InlineFlowBox&gt;(child) : nullptr;
</ins><span class="cx">         bool childAffectsTopBottomPos = true;
</span><span class="cx"> 
</span><del>-        if (curr-&gt;verticalAlign() == TOP &amp;&amp; verticalAlignApplies(curr-&gt;renderer()))
-            curr-&gt;setLogicalTop(top);
-        else if (curr-&gt;verticalAlign() == BOTTOM &amp;&amp; verticalAlignApplies(curr-&gt;renderer()))
-            curr-&gt;setLogicalTop(top + maxHeight - curr-&gt;lineHeight());
</del><ins>+        if (child-&gt;verticalAlign() == TOP &amp;&amp; verticalAlignApplies(child-&gt;renderer()))
+            child-&gt;setLogicalTop(top);
+        else if (child-&gt;verticalAlign() == BOTTOM &amp;&amp; verticalAlignApplies(child-&gt;renderer()))
+            child-&gt;setLogicalTop(top + maxHeight - child-&gt;lineHeight());
</ins><span class="cx">         else {
</span><span class="cx">             if (!strictMode &amp;&amp; inlineFlowBox &amp;&amp; !inlineFlowBox-&gt;hasTextChildren() &amp;&amp; !inlineFlowBox-&gt;renderer().hasInlineDirectionBordersOrPadding()
</span><span class="cx">                 &amp;&amp; !(inlineFlowBox-&gt;descendantsHaveSameLineHeightAndBaseline() &amp;&amp; inlineFlowBox-&gt;hasTextDescendants()))
</span><span class="cx">                 childAffectsTopBottomPos = false;
</span><del>-            LayoutUnit posAdjust = maxAscent - curr-&gt;baselinePosition(baselineType);
-            curr-&gt;setLogicalTop(curr-&gt;logicalTop() + top + posAdjust);
</del><ins>+            LayoutUnit posAdjust = maxAscent - child-&gt;baselinePosition(baselineType);
+            child-&gt;setLogicalTop(child-&gt;logicalTop() + top + posAdjust);
</ins><span class="cx">         }
</span><span class="cx">         
</span><del>-        LayoutUnit newLogicalTop = curr-&gt;logicalTop();
</del><ins>+        LayoutUnit newLogicalTop = child-&gt;logicalTop();
</ins><span class="cx">         LayoutUnit newLogicalTopIncludingMargins = newLogicalTop;
</span><del>-        LayoutUnit boxHeight = curr-&gt;logicalHeight();
</del><ins>+        LayoutUnit boxHeight = child-&gt;logicalHeight();
</ins><span class="cx">         LayoutUnit boxHeightIncludingMargins = boxHeight;
</span><span class="cx"> 
</span><del>-        const RenderStyle&amp; childLineStyle = curr-&gt;lineStyle();
-        if (curr-&gt;behavesLikeText() || curr-&gt;isInlineFlowBox()) {
</del><ins>+        const RenderStyle&amp; childLineStyle = child-&gt;lineStyle();
+        if (child-&gt;behavesLikeText() || is&lt;InlineFlowBox&gt;(*child)) {
</ins><span class="cx">             const FontMetrics&amp; fontMetrics = childLineStyle.fontMetrics();
</span><del>-            newLogicalTop += curr-&gt;baselinePosition(baselineType) - fontMetrics.ascent(baselineType);
-            if (curr-&gt;isInlineFlowBox()) {
-                RenderBoxModelObject&amp; boxObject = downcast&lt;RenderBoxModelObject&gt;(curr-&gt;renderer());
</del><ins>+            newLogicalTop += child-&gt;baselinePosition(baselineType) - fontMetrics.ascent(baselineType);
+            if (is&lt;InlineFlowBox&gt;(*child)) {
+                RenderBoxModelObject&amp; boxObject = downcast&lt;InlineFlowBox&gt;(*child).renderer();
</ins><span class="cx">                 newLogicalTop -= childLineStyle.isHorizontalWritingMode()
</span><span class="cx">                     ? boxObject.borderTop() + boxObject.paddingTop()
</span><span class="cx">                     : boxObject.borderRight() + boxObject.paddingRight();
</span><span class="cx">             }
</span><span class="cx">             newLogicalTopIncludingMargins = newLogicalTop;
</span><del>-        } else if (!curr-&gt;renderer().isBR()) {
-            const RenderBox&amp; box = toRenderBox(curr-&gt;renderer());
</del><ins>+        } else if (!child-&gt;renderer().isBR()) {
+            const auto&amp; box = downcast&lt;RenderBox&gt;(child-&gt;renderer());
</ins><span class="cx">             newLogicalTopIncludingMargins = newLogicalTop;
</span><del>-            LayoutUnit overSideMargin = curr-&gt;isHorizontal() ? box.marginTop() : box.marginRight();
-            LayoutUnit underSideMargin = curr-&gt;isHorizontal() ? box.marginBottom() : box.marginLeft();
</del><ins>+            LayoutUnit overSideMargin = child-&gt;isHorizontal() ? box.marginTop() : box.marginRight();
+            LayoutUnit underSideMargin = child-&gt;isHorizontal() ? box.marginBottom() : box.marginLeft();
</ins><span class="cx">             newLogicalTop += overSideMargin;
</span><span class="cx">             boxHeightIncludingMargins += overSideMargin + underSideMargin;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        curr-&gt;setLogicalTop(newLogicalTop);
</del><ins>+        child-&gt;setLogicalTop(newLogicalTop);
</ins><span class="cx"> 
</span><span class="cx">         if (childAffectsTopBottomPos) {
</span><del>-            if (curr-&gt;renderer().isRubyRun()) {
</del><ins>+            if (is&lt;RenderRubyRun&gt;(child-&gt;renderer())) {
</ins><span class="cx">                 // Treat the leading on the first and last lines of ruby runs as not being part of the overall lineTop/lineBottom.
</span><span class="cx">                 // Really this is a workaround hack for the fact that ruby should have been done as line layout and not done using
</span><span class="cx">                 // inline-block.
</span><del>-                if (renderer().style().isFlippedLinesWritingMode() == (curr-&gt;renderer().style().rubyPosition() == RubyPositionAfter))
</del><ins>+                if (renderer().style().isFlippedLinesWritingMode() == (child-&gt;renderer().style().rubyPosition() == RubyPositionAfter))
</ins><span class="cx">                     hasAnnotationsBefore = true;
</span><span class="cx">                 else
</span><span class="cx">                     hasAnnotationsAfter = true;
</span><span class="cx"> 
</span><del>-                RenderRubyRun&amp; rubyRun = toRenderRubyRun(curr-&gt;renderer());
</del><ins>+                auto&amp; rubyRun = downcast&lt;RenderRubyRun&gt;(child-&gt;renderer());
</ins><span class="cx">                 if (RenderRubyBase* rubyBase = rubyRun.rubyBase()) {
</span><del>-                    LayoutUnit bottomRubyBaseLeading = (curr-&gt;logicalHeight() - rubyBase-&gt;logicalBottom()) + rubyBase-&gt;logicalHeight() - (rubyBase-&gt;lastRootBox() ? rubyBase-&gt;lastRootBox()-&gt;lineBottom() : LayoutUnit());
</del><ins>+                    LayoutUnit bottomRubyBaseLeading = (child-&gt;logicalHeight() - rubyBase-&gt;logicalBottom()) + rubyBase-&gt;logicalHeight() - (rubyBase-&gt;lastRootBox() ? rubyBase-&gt;lastRootBox()-&gt;lineBottom() : LayoutUnit());
</ins><span class="cx">                     LayoutUnit topRubyBaseLeading = rubyBase-&gt;logicalTop() + (rubyBase-&gt;firstRootBox() ? rubyBase-&gt;firstRootBox()-&gt;lineTop() : LayoutUnit());
</span><span class="cx">                     newLogicalTop += !renderer().style().isFlippedLinesWritingMode() ? topRubyBaseLeading : bottomRubyBaseLeading;
</span><span class="cx">                     boxHeight -= (topRubyBaseLeading + bottomRubyBaseLeading);
</span><span class="cx">                 }
</span><span class="cx">             }
</span><del>-            if (curr-&gt;isInlineTextBox()) {
</del><ins>+            if (is&lt;InlineTextBox&gt;(*child)) {
</ins><span class="cx">                 bool emphasisMarkIsOver;
</span><del>-                if (toInlineTextBox(curr)-&gt;emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsOver)) {
</del><ins>+                if (downcast&lt;InlineTextBox&gt;(*child).emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsOver)) {
</ins><span class="cx">                     if (emphasisMarkIsOver != childLineStyle.isFlippedLinesWritingMode())
</span><span class="cx">                         hasAnnotationsBefore = true;
</span><span class="cx">                     else
</span><span class="lines">@@ -740,17 +738,17 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineFlowBox::computeMaxLogicalTop(float&amp; maxLogicalTop) const
</span><span class="cx"> {
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx"> 
</span><span class="cx">         if (descendantsHaveSameLineHeightAndBaseline())
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        maxLogicalTop = std::max&lt;float&gt;(maxLogicalTop, curr-&gt;y());
</del><ins>+        maxLogicalTop = std::max&lt;float&gt;(maxLogicalTop, child-&gt;y());
</ins><span class="cx">         float localMaxLogicalTop = 0;
</span><del>-        if (curr-&gt;isInlineFlowBox())
-            toInlineFlowBox(curr)-&gt;computeMaxLogicalTop(localMaxLogicalTop);
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child))
+            downcast&lt;InlineFlowBox&gt;(*child).computeMaxLogicalTop(localMaxLogicalTop);
</ins><span class="cx">         maxLogicalTop = std::max&lt;float&gt;(maxLogicalTop, localMaxLogicalTop);
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -760,14 +758,14 @@
</span><span class="cx">     // Flip the box on the line such that the top is now relative to the lineBottom instead of the lineTop.
</span><span class="cx">     setLogicalTop(lineBottom - (logicalTop() - lineTop) - logicalHeight());
</span><span class="cx">     
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders aren't affected here.
</span><span class="cx">         
</span><del>-        if (curr-&gt;isInlineFlowBox())
-            toInlineFlowBox(curr)-&gt;flipLinesInBlockDirection(lineTop, lineBottom);
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child))
+            downcast&lt;InlineFlowBox&gt;(*child).flipLinesInBlockDirection(lineTop, lineBottom);
</ins><span class="cx">         else
</span><del>-            curr-&gt;setLogicalTop(lineBottom - (curr-&gt;logicalTop() - lineTop) - curr-&gt;logicalHeight());
</del><ins>+            child-&gt;setLogicalTop(lineBottom - (child-&gt;logicalTop() - lineTop) - child-&gt;logicalHeight());
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -938,27 +936,27 @@
</span><span class="cx">     addBoxShadowVisualOverflow(logicalVisualOverflow);
</span><span class="cx">     addBorderOutsetVisualOverflow(logicalVisualOverflow);
</span><span class="cx"> 
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx"> 
</span><del>-        if (curr-&gt;renderer().isLineBreak())
</del><ins>+        if (is&lt;RenderLineBreak&gt;(child-&gt;renderer()))
</ins><span class="cx">             continue;
</span><del>-        if (curr-&gt;renderer().isText()) {
-            InlineTextBox* text = toInlineTextBox(curr);
-            LayoutRect textBoxOverflow(enclosingLayoutRect(text-&gt;logicalFrameRect()));
-            addTextBoxVisualOverflow(*text, textBoxDataMap, textBoxOverflow);
</del><ins>+        if (is&lt;RenderText&gt;(child-&gt;renderer())) {
+            auto&amp; textBox = downcast&lt;InlineTextBox&gt;(*child);
+            LayoutRect textBoxOverflow(enclosingLayoutRect(textBox.logicalFrameRect()));
+            addTextBoxVisualOverflow(textBox, textBoxDataMap, textBoxOverflow);
</ins><span class="cx">             logicalVisualOverflow.unite(textBoxOverflow);
</span><del>-        } else if (curr-&gt;renderer().isRenderInline()) {
-            InlineFlowBox* flow = toInlineFlowBox(curr);
-            flow-&gt;computeOverflow(lineTop, lineBottom, textBoxDataMap);
-            if (!flow-&gt;renderer().hasSelfPaintingLayer())
-                logicalVisualOverflow.unite(flow-&gt;logicalVisualOverflowRect(lineTop, lineBottom));
-            LayoutRect childLayoutOverflow = flow-&gt;logicalLayoutOverflowRect(lineTop, lineBottom);
-            childLayoutOverflow.move(flow-&gt;renderer().relativePositionLogicalOffset());
</del><ins>+        } else if (is&lt;RenderInline&gt;(child-&gt;renderer())) {
+            auto&amp; flow = downcast&lt;InlineFlowBox&gt;(*child);
+            flow.computeOverflow(lineTop, lineBottom, textBoxDataMap);
+            if (!flow.renderer().hasSelfPaintingLayer())
+                logicalVisualOverflow.unite(flow.logicalVisualOverflowRect(lineTop, lineBottom));
+            LayoutRect childLayoutOverflow = flow.logicalLayoutOverflowRect(lineTop, lineBottom);
+            childLayoutOverflow.move(flow.renderer().relativePositionLogicalOffset());
</ins><span class="cx">             logicalLayoutOverflow.unite(childLayoutOverflow);
</span><span class="cx">         } else
</span><del>-            addReplacedChildOverflow(curr, logicalLayoutOverflow, logicalVisualOverflow);
</del><ins>+            addReplacedChildOverflow(child, logicalLayoutOverflow, logicalVisualOverflow);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     setOverflowFromLogicalRects(logicalLayoutOverflow, logicalVisualOverflow, lineTop, lineBottom);
</span><span class="lines">@@ -1424,17 +1422,17 @@
</span><span class="cx"> 
</span><span class="cx"> InlineBox* InlineFlowBox::firstLeafChild() const
</span><span class="cx"> {
</span><del>-    InlineBox* leaf = 0;
</del><ins>+    InlineBox* leaf = nullptr;
</ins><span class="cx">     for (InlineBox* child = firstChild(); child &amp;&amp; !leaf; child = child-&gt;nextOnLine())
</span><del>-        leaf = child-&gt;isLeaf() ? child : toInlineFlowBox(child)-&gt;firstLeafChild();
</del><ins>+        leaf = child-&gt;isLeaf() ? child : downcast&lt;InlineFlowBox&gt;(*child).firstLeafChild();
</ins><span class="cx">     return leaf;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> InlineBox* InlineFlowBox::lastLeafChild() const
</span><span class="cx"> {
</span><del>-    InlineBox* leaf = 0;
</del><ins>+    InlineBox* leaf = nullptr;
</ins><span class="cx">     for (InlineBox* child = lastChild(); child &amp;&amp; !leaf; child = child-&gt;prevOnLine())
</span><del>-        leaf = child-&gt;isLeaf() ? child : toInlineFlowBox(child)-&gt;lastLeafChild();
</del><ins>+        leaf = child-&gt;isLeaf() ? child : downcast&lt;InlineFlowBox&gt;(*child).lastLeafChild();
</ins><span class="cx">     return leaf;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1491,15 +1489,15 @@
</span><span class="cx"> LayoutUnit InlineFlowBox::computeOverAnnotationAdjustment(LayoutUnit allowedPosition) const
</span><span class="cx"> {
</span><span class="cx">     LayoutUnit result = 0;
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx">         
</span><del>-        if (curr-&gt;isInlineFlowBox())
-            result = std::max(result, toInlineFlowBox(curr)-&gt;computeOverAnnotationAdjustment(allowedPosition));
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child))
+            result = std::max(result, downcast&lt;InlineFlowBox&gt;(*child).computeOverAnnotationAdjustment(allowedPosition));
</ins><span class="cx">         
</span><del>-        if (curr-&gt;renderer().isReplaced() &amp;&amp; curr-&gt;renderer().isRubyRun() &amp;&amp; curr-&gt;renderer().style().rubyPosition() == RubyPositionBefore) {
-            RenderRubyRun&amp; rubyRun = toRenderRubyRun(curr-&gt;renderer());
</del><ins>+        if (child-&gt;renderer().isReplaced() &amp;&amp; is&lt;RenderRubyRun&gt;(child-&gt;renderer()) &amp;&amp; child-&gt;renderer().style().rubyPosition() == RubyPositionBefore) {
+            auto&amp; rubyRun = downcast&lt;RenderRubyRun&gt;(child-&gt;renderer());
</ins><span class="cx">             RenderRubyText* rubyText = rubyRun.rubyText();
</span><span class="cx">             if (!rubyText)
</span><span class="cx">                 continue;
</span><span class="lines">@@ -1508,26 +1506,26 @@
</span><span class="cx">                 LayoutUnit topOfFirstRubyTextLine = rubyText-&gt;logicalTop() + (rubyText-&gt;firstRootBox() ? rubyText-&gt;firstRootBox()-&gt;lineTop() : LayoutUnit());
</span><span class="cx">                 if (topOfFirstRubyTextLine &gt;= 0)
</span><span class="cx">                     continue;
</span><del>-                topOfFirstRubyTextLine += curr-&gt;logicalTop();
</del><ins>+                topOfFirstRubyTextLine += child-&gt;logicalTop();
</ins><span class="cx">                 result = std::max(result, allowedPosition - topOfFirstRubyTextLine);
</span><span class="cx">             } else {
</span><span class="cx">                 LayoutUnit bottomOfLastRubyTextLine = rubyText-&gt;logicalTop() + (rubyText-&gt;lastRootBox() ? rubyText-&gt;lastRootBox()-&gt;lineBottom() : rubyText-&gt;logicalHeight());
</span><del>-                if (bottomOfLastRubyTextLine &lt;= curr-&gt;logicalHeight())
</del><ins>+                if (bottomOfLastRubyTextLine &lt;= child-&gt;logicalHeight())
</ins><span class="cx">                     continue;
</span><del>-                bottomOfLastRubyTextLine += curr-&gt;logicalTop();
</del><ins>+                bottomOfLastRubyTextLine += child-&gt;logicalTop();
</ins><span class="cx">                 result = std::max(result, bottomOfLastRubyTextLine - allowedPosition);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (curr-&gt;isInlineTextBox()) {
-            const RenderStyle&amp; childLineStyle = curr-&gt;lineStyle();
</del><ins>+        if (is&lt;InlineTextBox&gt;(*child)) {
+            const RenderStyle&amp; childLineStyle = child-&gt;lineStyle();
</ins><span class="cx">             bool emphasisMarkIsAbove;
</span><del>-            if (childLineStyle.textEmphasisMark() != TextEmphasisMarkNone &amp;&amp; toInlineTextBox(curr)-&gt;emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsAbove) &amp;&amp; emphasisMarkIsAbove) {
</del><ins>+            if (childLineStyle.textEmphasisMark() != TextEmphasisMarkNone &amp;&amp; downcast&lt;InlineTextBox&gt;(*child).emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsAbove) &amp;&amp; emphasisMarkIsAbove) {
</ins><span class="cx">                 if (!childLineStyle.isFlippedLinesWritingMode()) {
</span><del>-                    int topOfEmphasisMark = curr-&gt;logicalTop() - childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</del><ins>+                    int topOfEmphasisMark = child-&gt;logicalTop() - childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</ins><span class="cx">                     result = std::max(result, allowedPosition - topOfEmphasisMark);
</span><span class="cx">                 } else {
</span><del>-                    int bottomOfEmphasisMark = curr-&gt;logicalBottom() + childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</del><ins>+                    int bottomOfEmphasisMark = child-&gt;logicalBottom() + childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</ins><span class="cx">                     result = std::max(result, bottomOfEmphasisMark - allowedPosition);
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="lines">@@ -1539,15 +1537,15 @@
</span><span class="cx"> LayoutUnit InlineFlowBox::computeUnderAnnotationAdjustment(LayoutUnit allowedPosition) const
</span><span class="cx"> {
</span><span class="cx">     LayoutUnit result = 0;
</span><del>-    for (InlineBox* curr = firstChild(); curr; curr = curr-&gt;nextOnLine()) {
-        if (curr-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+    for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
+        if (child-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             continue; // Positioned placeholders don't affect calculations.
</span><span class="cx"> 
</span><del>-        if (curr-&gt;isInlineFlowBox())
-            result = std::max(result, toInlineFlowBox(curr)-&gt;computeUnderAnnotationAdjustment(allowedPosition));
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child))
+            result = std::max(result, downcast&lt;InlineFlowBox&gt;(*child).computeUnderAnnotationAdjustment(allowedPosition));
</ins><span class="cx"> 
</span><del>-        if (curr-&gt;renderer().isReplaced() &amp;&amp; curr-&gt;renderer().isRubyRun() &amp;&amp; curr-&gt;renderer().style().rubyPosition() == RubyPositionAfter) {
-            RenderRubyRun&amp; rubyRun = toRenderRubyRun(curr-&gt;renderer());
</del><ins>+        if (child-&gt;renderer().isReplaced() &amp;&amp; is&lt;RenderRubyRun&gt;(child-&gt;renderer()) &amp;&amp; child-&gt;renderer().style().rubyPosition() == RubyPositionAfter) {
+            auto&amp; rubyRun = downcast&lt;RenderRubyRun&gt;(child-&gt;renderer());
</ins><span class="cx">             RenderRubyText* rubyText = rubyRun.rubyText();
</span><span class="cx">             if (!rubyText)
</span><span class="cx">                 continue;
</span><span class="lines">@@ -1556,27 +1554,27 @@
</span><span class="cx">                 LayoutUnit topOfFirstRubyTextLine = rubyText-&gt;logicalTop() + (rubyText-&gt;firstRootBox() ? rubyText-&gt;firstRootBox()-&gt;lineTop() : LayoutUnit());
</span><span class="cx">                 if (topOfFirstRubyTextLine &gt;= 0)
</span><span class="cx">                     continue;
</span><del>-                topOfFirstRubyTextLine += curr-&gt;logicalTop();
</del><ins>+                topOfFirstRubyTextLine += child-&gt;logicalTop();
</ins><span class="cx">                 result = std::max(result, allowedPosition - topOfFirstRubyTextLine);
</span><span class="cx">             } else {
</span><span class="cx">                 LayoutUnit bottomOfLastRubyTextLine = rubyText-&gt;logicalTop() + (rubyText-&gt;lastRootBox() ? rubyText-&gt;lastRootBox()-&gt;lineBottom() : rubyText-&gt;logicalHeight());
</span><del>-                if (bottomOfLastRubyTextLine &lt;= curr-&gt;logicalHeight())
</del><ins>+                if (bottomOfLastRubyTextLine &lt;= child-&gt;logicalHeight())
</ins><span class="cx">                     continue;
</span><del>-                bottomOfLastRubyTextLine += curr-&gt;logicalTop();
</del><ins>+                bottomOfLastRubyTextLine += child-&gt;logicalTop();
</ins><span class="cx">                 result = std::max(result, bottomOfLastRubyTextLine - allowedPosition);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (curr-&gt;isInlineTextBox()) {
-            const RenderStyle&amp; childLineStyle = curr-&gt;lineStyle();
</del><ins>+        if (is&lt;InlineTextBox&gt;(*child)) {
+            const RenderStyle&amp; childLineStyle = child-&gt;lineStyle();
</ins><span class="cx">             bool emphasisMarkIsAbove;
</span><del>-            toInlineTextBox(curr)-&gt;emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsAbove);
</del><ins>+            downcast&lt;InlineTextBox&gt;(*child).emphasisMarkExistsAndIsAbove(childLineStyle, emphasisMarkIsAbove);
</ins><span class="cx">             if (childLineStyle.textEmphasisMark() != TextEmphasisMarkNone &amp;&amp; !emphasisMarkIsAbove) {
</span><span class="cx">                 if (!childLineStyle.isFlippedLinesWritingMode()) {
</span><del>-                    LayoutUnit bottomOfEmphasisMark = curr-&gt;logicalBottom() + childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</del><ins>+                    LayoutUnit bottomOfEmphasisMark = child-&gt;logicalBottom() + childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</ins><span class="cx">                     result = std::max(result, bottomOfEmphasisMark - allowedPosition);
</span><span class="cx">                 } else {
</span><del>-                    LayoutUnit topOfEmphasisMark = curr-&gt;logicalTop() - childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</del><ins>+                    LayoutUnit topOfEmphasisMark = child-&gt;logicalTop() - childLineStyle.font().emphasisMarkHeight(childLineStyle.textEmphasisMarkString());
</ins><span class="cx">                     result = std::max(result, allowedPosition - topOfEmphasisMark);
</span><span class="cx">                 }
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineFlowBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineFlowBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineFlowBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineFlowBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -344,8 +344,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(InlineFlowBox, isInlineFlowBox())
-
</del><span class="cx"> #ifdef NDEBUG
</span><span class="cx"> 
</span><span class="cx"> inline void InlineFlowBox::checkConsistency() const
</span><span class="lines">@@ -364,6 +362,8 @@
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(InlineFlowBox, isInlineFlowBox())
+
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> // Outside the WebCore namespace for ease of invocation from gdb.
</span><span class="cx"> void showTree(const WebCore::InlineFlowBox*);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineTextBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineTextBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineTextBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/InlineTextBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -179,8 +179,8 @@
</span><span class="cx">     unsigned short m_truncation;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(InlineTextBox, isInlineTextBox())
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(InlineTextBox, isInlineTextBox())
+
</ins><span class="cx"> #endif // InlineTextBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -3270,11 +3270,11 @@
</span><span class="cx">     if (!box-&gt;renderer().nonPseudoNode())
</span><span class="cx">         return createLegacyEditingPosition(nonPseudoElement(), start ? caretMinOffset() : caretMaxOffset());
</span><span class="cx"> 
</span><del>-    if (!box-&gt;isInlineTextBox())
</del><ins>+    if (!is&lt;InlineTextBox&gt;(*box))
</ins><span class="cx">         return createLegacyEditingPosition(box-&gt;renderer().nonPseudoNode(), start ? box-&gt;renderer().caretMinOffset() : box-&gt;renderer().caretMaxOffset());
</span><span class="cx"> 
</span><del>-    InlineTextBox* textBox = toInlineTextBox(box);
-    return createLegacyEditingPosition(box-&gt;renderer().nonPseudoNode(), start ? textBox-&gt;start() : textBox-&gt;start() + textBox-&gt;len());
</del><ins>+    auto&amp; textBox = downcast&lt;InlineTextBox&gt;(*box);
+    return createLegacyEditingPosition(textBox.renderer().nonPseudoNode(), start ? textBox.start() : textBox.start() + textBox.len());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> VisiblePosition RenderBlockFlow::positionForPointWithInlineChildren(const LayoutPoint&amp; pointInLogicalContents, const RenderRegion* region)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -338,8 +338,8 @@
</span><span class="cx">     RenderLineBoxList&amp; lineBoxes() { return m_lineBoxes; }
</span><span class="cx">     const RenderLineBoxList&amp; lineBoxes() const { return m_lineBoxes; }
</span><span class="cx"> 
</span><del>-    RootInlineBox* firstRootBox() const { return toRootInlineBox(m_lineBoxes.firstLineBox()); }
-    RootInlineBox* lastRootBox() const { return toRootInlineBox(m_lineBoxes.lastLineBox()); }
</del><ins>+    RootInlineBox* firstRootBox() const { return downcast&lt;RootInlineBox&gt;(m_lineBoxes.firstLineBox()); }
+    RootInlineBox* lastRootBox() const { return downcast&lt;RootInlineBox&gt;(m_lineBoxes.lastLineBox()); }
</ins><span class="cx"> 
</span><span class="cx">     virtual bool hasLines() const override final;
</span><span class="cx">     virtual void invalidateLineLayoutPath() override final;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockLineLayoutcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -213,8 +213,7 @@
</span><span class="cx">             // We need to make a new box for this render object.  Once
</span><span class="cx">             // made, we need to place it at the end of the current line.
</span><span class="cx">             InlineBox* newBox = createInlineBoxForRenderer(obj, obj == this);
</span><del>-            ASSERT_WITH_SECURITY_IMPLICATION(newBox-&gt;isInlineFlowBox());
-            parentBox = toInlineFlowBox(newBox);
</del><ins>+            parentBox = downcast&lt;InlineFlowBox&gt;(newBox);
</ins><span class="cx">             parentBox-&gt;setIsFirstLine(lineInfo.isFirstLine());
</span><span class="cx">             parentBox-&gt;setIsHorizontal(isHorizontalWritingMode());
</span><span class="cx">             if (!hasDefaultLineBoxContain)
</span><span class="lines">@@ -314,13 +313,13 @@
</span><span class="cx">         bool visuallyOrdered = r-&gt;renderer().style().rtlOrdering() == VisualOrder;
</span><span class="cx">         box-&gt;setBidiLevel(r-&gt;level());
</span><span class="cx"> 
</span><del>-        if (box-&gt;isInlineTextBox()) {
-            InlineTextBox* text = toInlineTextBox(box);
-            text-&gt;setStart(r-&gt;m_start);
-            text-&gt;setLen(r-&gt;m_stop - r-&gt;m_start);
-            text-&gt;setDirOverride(r-&gt;dirOverride(visuallyOrdered));
</del><ins>+        if (is&lt;InlineTextBox&gt;(*box)) {
+            auto&amp; textBox = downcast&lt;InlineTextBox&gt;(*box);
+            textBox.setStart(r-&gt;m_start);
+            textBox.setLen(r-&gt;m_stop - r-&gt;m_start);
+            textBox.setDirOverride(r-&gt;dirOverride(visuallyOrdered));
</ins><span class="cx">             if (r-&gt;m_hasHyphen)
</span><del>-                text-&gt;setHasHyphen(true);
</del><ins>+                textBox.setHasHyphen(true);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -478,7 +477,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     LayoutUnit hyphenWidth = 0;
</span><del>-    if (toInlineTextBox(run-&gt;box())-&gt;hasHyphen())
</del><ins>+    if (downcast&lt;InlineTextBox&gt;(*run-&gt;box()).hasHyphen())
</ins><span class="cx">         hyphenWidth = measureHyphenWidth(renderer, font, &amp;fallbackFonts);
</span><span class="cx"> 
</span><span class="cx">     float measuredWidth = 0;
</span><span class="lines">@@ -528,7 +527,7 @@
</span><span class="cx">     run-&gt;box()-&gt;setLogicalWidth(measuredWidth + hyphenWidth);
</span><span class="cx">     if (!fallbackFonts.isEmpty()) {
</span><span class="cx">         ASSERT(run-&gt;box()-&gt;behavesLikeText());
</span><del>-        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(toInlineTextBox(run-&gt;box()), std::make_pair(Vector&lt;const SimpleFontData*&gt;(), GlyphOverflow())).iterator;
</del><ins>+        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(downcast&lt;InlineTextBox&gt;(run-&gt;box()), std::make_pair(Vector&lt;const SimpleFontData*&gt;(), GlyphOverflow())).iterator;
</ins><span class="cx">         ASSERT(it-&gt;value.first.isEmpty());
</span><span class="cx">         copyToVector(fallbackFonts, it-&gt;value.first);
</span><span class="cx">         run-&gt;box()-&gt;parent()-&gt;clearDescendantsHaveSameLineHeightAndBaseline();
</span><span class="lines">@@ -536,11 +535,11 @@
</span><span class="cx"> 
</span><span class="cx">     // Include text decoration visual overflow as part of the glyph overflow.
</span><span class="cx">     if (renderer-&gt;style().textDecorationsInEffect() != TextDecorationNone)
</span><del>-        glyphOverflow.extendTo(visualOverflowForDecorations(run-&gt;box()-&gt;lineStyle(), toInlineTextBox(run-&gt;box())));
</del><ins>+        glyphOverflow.extendTo(visualOverflowForDecorations(run-&gt;box()-&gt;lineStyle(), downcast&lt;InlineTextBox&gt;(run-&gt;box())));
</ins><span class="cx"> 
</span><span class="cx">     if (!glyphOverflow.isEmpty()) {
</span><span class="cx">         ASSERT(run-&gt;box()-&gt;behavesLikeText());
</span><del>-        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(toInlineTextBox(run-&gt;box()), std::make_pair(Vector&lt;const SimpleFontData*&gt;(), GlyphOverflow())).iterator;
</del><ins>+        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(downcast&lt;InlineTextBox&gt;(run-&gt;box()), std::make_pair(Vector&lt;const SimpleFontData*&gt;(), GlyphOverflow())).iterator;
</ins><span class="cx">         it-&gt;value.second = glyphOverflow;
</span><span class="cx">         run-&gt;box()-&gt;clearKnownToHaveNoOverflow();
</span><span class="cx">     }
</span><span class="lines">@@ -586,25 +585,25 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     size_t i = 0;
</span><del>-    for (BidiRun* r = firstRun; r; r = r-&gt;next()) {
-        if (!r-&gt;box() || r == trailingSpaceRun)
</del><ins>+    for (BidiRun* run = firstRun; run; run = run-&gt;next()) {
+        if (!run-&gt;box() || run == trailingSpaceRun)
</ins><span class="cx">             continue;
</span><span class="cx">         
</span><del>-        if (r-&gt;renderer().isText()) {
</del><ins>+        if (is&lt;RenderText&gt;(run-&gt;renderer())) {
</ins><span class="cx">             unsigned opportunitiesInRun = expansionOpportunities[i++];
</span><span class="cx">             
</span><span class="cx">             ASSERT(opportunitiesInRun &lt;= expansionOpportunityCount);
</span><span class="cx">             
</span><span class="cx">             // Only justify text if whitespace is collapsed.
</span><del>-            if (r-&gt;renderer().style().collapseWhiteSpace()) {
-                InlineTextBox* textBox = toInlineTextBox(r-&gt;box());
</del><ins>+            if (run-&gt;renderer().style().collapseWhiteSpace()) {
+                InlineTextBox&amp; textBox = downcast&lt;InlineTextBox&gt;(*run-&gt;box());
</ins><span class="cx">                 float expansion = (availableLogicalWidth - totalLogicalWidth) * opportunitiesInRun / expansionOpportunityCount;
</span><del>-                textBox-&gt;setExpansion(expansion);
</del><ins>+                textBox.setExpansion(expansion);
</ins><span class="cx">                 totalLogicalWidth += expansion;
</span><span class="cx">             }
</span><span class="cx">             expansionOpportunityCount -= opportunitiesInRun;
</span><del>-        } else if (r-&gt;renderer().isRubyRun())
-            updateRubyForJustifiedText(toRenderRubyRun(r-&gt;renderer()), *r, expansionOpportunities, expansionOpportunityCount, totalLogicalWidth, availableLogicalWidth, i);
</del><ins>+        } else if (is&lt;RenderRubyRun&gt;(run-&gt;renderer()))
+            updateRubyForJustifiedText(downcast&lt;RenderRubyRun&gt;(run-&gt;renderer()), *run, expansionOpportunities, expansionOpportunityCount, totalLogicalWidth, availableLogicalWidth, i);
</ins><span class="cx"> 
</span><span class="cx">         if (!expansionOpportunityCount)
</span><span class="cx">             break;
</span><span class="lines">@@ -709,39 +708,40 @@
</span><span class="cx">     Vector&lt;unsigned, 16&gt; expansionOpportunities;
</span><span class="cx">     RenderObject* previousObject = nullptr;
</span><span class="cx"> 
</span><del>-    BidiRun* r = firstRun;
-    for (; r; r = r-&gt;next()) {
-        if (!r-&gt;box() || r-&gt;renderer().isOutOfFlowPositioned() || r-&gt;box()-&gt;isLineBreak())
</del><ins>+    BidiRun* run = firstRun;
+    for (; run; run = run-&gt;next()) {
+        if (!run-&gt;box() || run-&gt;renderer().isOutOfFlowPositioned() || run-&gt;box()-&gt;isLineBreak()) {
</ins><span class="cx">             continue; // Positioned objects are only participating to figure out their
</span><span class="cx">                       // correct static x position.  They have no effect on the width.
</span><span class="cx">                       // Similarly, line break boxes have no effect on the width.
</span><del>-        if (is&lt;RenderText&gt;(r-&gt;renderer())) {
-            RenderText&amp; renderText = downcast&lt;RenderText&gt;(r-&gt;renderer());
-            if (textAlign == JUSTIFY &amp;&amp; r != trailingSpaceRun) {
</del><ins>+        }
+        if (is&lt;RenderText&gt;(run-&gt;renderer())) {
+            auto&amp; renderText = downcast&lt;RenderText&gt;(run-&gt;renderer());
+            if (textAlign == JUSTIFY &amp;&amp; run != trailingSpaceRun) {
</ins><span class="cx">                 if (!isAfterExpansion)
</span><del>-                    toInlineTextBox(r-&gt;box())-&gt;setCanHaveLeadingExpansion(true);
-                unsigned opportunitiesInRun = Font::expansionOpportunityCount(renderText.stringView(r-&gt;m_start, r-&gt;m_stop), r-&gt;box()-&gt;direction(), isAfterExpansion);
</del><ins>+                    downcast&lt;InlineTextBox&gt;(*run-&gt;box()).setCanHaveLeadingExpansion(true);
+                unsigned opportunitiesInRun = Font::expansionOpportunityCount(renderText.stringView(run-&gt;m_start, run-&gt;m_stop), run-&gt;box()-&gt;direction(), isAfterExpansion);
</ins><span class="cx">                 expansionOpportunities.append(opportunitiesInRun);
</span><span class="cx">                 expansionOpportunityCount += opportunitiesInRun;
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             if (int length = renderText.textLength()) {
</span><del>-                if (!r-&gt;m_start &amp;&amp; needsWordSpacing &amp;&amp; isSpaceOrNewline(renderText.characterAt(r-&gt;m_start)))
</del><ins>+                if (!run-&gt;m_start &amp;&amp; needsWordSpacing &amp;&amp; isSpaceOrNewline(renderText.characterAt(run-&gt;m_start)))
</ins><span class="cx">                     totalLogicalWidth += lineStyle(*renderText.parent(), lineInfo).font().wordSpacing();
</span><del>-                needsWordSpacing = !isSpaceOrNewline(renderText.characterAt(r-&gt;m_stop - 1)) &amp;&amp; r-&gt;m_stop == length;
</del><ins>+                needsWordSpacing = !isSpaceOrNewline(renderText.characterAt(run-&gt;m_stop - 1)) &amp;&amp; run-&gt;m_stop == length;
</ins><span class="cx">             }
</span><span class="cx"> 
</span><del>-            setLogicalWidthForTextRun(lineBox, r, &amp;renderText, totalLogicalWidth, lineInfo, textBoxDataMap, verticalPositionCache, wordMeasurements);
</del><ins>+            setLogicalWidthForTextRun(lineBox, run, &amp;renderText, totalLogicalWidth, lineInfo, textBoxDataMap, verticalPositionCache, wordMeasurements);
</ins><span class="cx">         } else {
</span><span class="cx">             bool encounteredJustifiedRuby = false;
</span><del>-            if (r-&gt;renderer().isRubyRun() &amp;&amp; textAlign == JUSTIFY &amp;&amp; r != trailingSpaceRun &amp;&amp; toRenderRubyRun(r-&gt;renderer()).rubyBase()) {
-                auto* rubyBase = toRenderRubyRun(r-&gt;renderer()).rubyBase();
-                if (rubyBase-&gt;firstRootBox() &amp;&amp; !rubyBase-&gt;firstRootBox()-&gt;nextRootBox() &amp;&amp; r-&gt;renderer().style().collapseWhiteSpace()) {
</del><ins>+            if (is&lt;RenderRubyRun&gt;(run-&gt;renderer()) &amp;&amp; textAlign == JUSTIFY &amp;&amp; run != trailingSpaceRun &amp;&amp; toRenderRubyRun(run-&gt;renderer()).rubyBase()) {
+                auto* rubyBase = downcast&lt;RenderRubyRun&gt;(run-&gt;renderer()).rubyBase();
+                if (rubyBase-&gt;firstRootBox() &amp;&amp; !rubyBase-&gt;firstRootBox()-&gt;nextRootBox() &amp;&amp; run-&gt;renderer().style().collapseWhiteSpace()) {
</ins><span class="cx">                     for (auto* leafChild = rubyBase-&gt;firstRootBox()-&gt;firstLeafChild(); leafChild; leafChild = leafChild-&gt;nextLeafChild()) {
</span><del>-                        if (!leafChild-&gt;isInlineTextBox())
</del><ins>+                        if (!is&lt;InlineTextBox&gt;(*leafChild))
</ins><span class="cx">                             continue;
</span><span class="cx">                         if (!isAfterExpansion)
</span><del>-                            toInlineTextBox(leafChild)-&gt;setCanHaveLeadingExpansion(true);
</del><ins>+                            downcast&lt;InlineTextBox&gt;(*leafChild).setCanHaveLeadingExpansion(true);
</ins><span class="cx">                         encounteredJustifiedRuby = true;
</span><span class="cx">                         auto&amp; renderText = downcast&lt;RenderText&gt;(leafChild-&gt;renderer());
</span><span class="cx">                         unsigned opportunitiesInRun = Font::expansionOpportunityCount(renderText.stringView(), leafChild-&gt;direction(), isAfterExpansion);
</span><span class="lines">@@ -754,17 +754,17 @@
</span><span class="cx">             if (!encounteredJustifiedRuby)
</span><span class="cx">                 isAfterExpansion = false;
</span><span class="cx"> 
</span><del>-            if (!r-&gt;renderer().isRenderInline()) {
-                RenderBox&amp; renderBox = toRenderBox(r-&gt;renderer());
-                if (renderBox.isRubyRun())
-                    setMarginsForRubyRun(r, toRenderRubyRun(renderBox), previousObject, lineInfo);
-                r-&gt;box()-&gt;setLogicalWidth(logicalWidthForChild(renderBox));
</del><ins>+            if (!is&lt;RenderInline&gt;(run-&gt;renderer())) {
+                auto&amp; renderBox = downcast&lt;RenderBox&gt;(run-&gt;renderer());
+                if (is&lt;RenderRubyRun&gt;(renderBox))
+                    setMarginsForRubyRun(run, downcast&lt;RenderRubyRun&gt;(renderBox), previousObject, lineInfo);
+                run-&gt;box()-&gt;setLogicalWidth(logicalWidthForChild(renderBox));
</ins><span class="cx">                 totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        totalLogicalWidth += r-&gt;box()-&gt;logicalWidth();
-        previousObject = &amp;r-&gt;renderer();
</del><ins>+        totalLogicalWidth += run-&gt;box()-&gt;logicalWidth();
+        previousObject = &amp;run-&gt;renderer();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (isAfterExpansion &amp;&amp; !expansionOpportunities.isEmpty()) {
</span><span class="lines">@@ -776,7 +776,7 @@
</span><span class="cx"> 
</span><span class="cx">     computeExpansionForJustifiedText(firstRun, trailingSpaceRun, expansionOpportunities, expansionOpportunityCount, totalLogicalWidth, availableLogicalWidth);
</span><span class="cx"> 
</span><del>-    return r;
</del><ins>+    return run;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderBlockFlow::computeBlockDirectionPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun, GlyphOverflowAndFallbackFontsMap&amp; textBoxDataMap,
</span><span class="lines">@@ -785,26 +785,26 @@
</span><span class="cx">     setLogicalHeight(lineBox-&gt;alignBoxesInBlockDirection(logicalHeight(), textBoxDataMap, verticalPositionCache));
</span><span class="cx"> 
</span><span class="cx">     // Now make sure we place replaced render objects correctly.
</span><del>-    for (BidiRun* r = firstRun; r; r = r-&gt;next()) {
-        ASSERT(r-&gt;box());
-        if (!r-&gt;box())
</del><ins>+    for (BidiRun* run = firstRun; run; run = run-&gt;next()) {
+        ASSERT(run-&gt;box());
+        if (!run-&gt;box())
</ins><span class="cx">             continue; // Skip runs with no line boxes.
</span><span class="cx"> 
</span><del>-        InlineBox&amp; box = *r-&gt;box();
</del><ins>+        InlineBox&amp; box = *run-&gt;box();
</ins><span class="cx"> 
</span><span class="cx">         // Align positioned boxes with the top of the line box.  This is
</span><span class="cx">         // a reasonable approximation of an appropriate y position.
</span><del>-        if (r-&gt;renderer().isOutOfFlowPositioned())
</del><ins>+        if (run-&gt;renderer().isOutOfFlowPositioned())
</ins><span class="cx">             box.setLogicalTop(logicalHeight());
</span><span class="cx"> 
</span><span class="cx">         // Position is used to properly position both replaced elements and
</span><span class="cx">         // to update the static normal flow x/y of positioned elements.
</span><del>-        if (is&lt;RenderText&gt;(r-&gt;renderer()))
-            downcast&lt;RenderText&gt;(r-&gt;renderer()).positionLineBox(toInlineTextBox(box));
-        else if (is&lt;RenderBox&gt;(r-&gt;renderer()))
-            downcast&lt;RenderBox&gt;(r-&gt;renderer()).positionLineBox(toInlineElementBox(box));
-        else if (is&lt;RenderLineBreak&gt;(r-&gt;renderer()))
-            downcast&lt;RenderLineBreak&gt;(r-&gt;renderer()).replaceInlineBoxWrapper(toInlineElementBox(box));
</del><ins>+        if (is&lt;RenderText&gt;(run-&gt;renderer()))
+            downcast&lt;RenderText&gt;(run-&gt;renderer()).positionLineBox(downcast&lt;InlineTextBox&gt;(box));
+        else if (is&lt;RenderBox&gt;(run-&gt;renderer()))
+            downcast&lt;RenderBox&gt;(run-&gt;renderer()).positionLineBox(downcast&lt;InlineElementBox&gt;(box));
+        else if (is&lt;RenderLineBreak&gt;(run-&gt;renderer()))
+            downcast&lt;RenderLineBreak&gt;(run-&gt;renderer()).replaceInlineBoxWrapper(downcast&lt;InlineElementBox&gt;(box));
</ins><span class="cx">     }
</span><span class="cx">     // Positioned objects and zero-length text nodes destroy their boxes in
</span><span class="cx">     // position(), which unnecessarily dirties the line.
</span><span class="lines">@@ -984,7 +984,7 @@
</span><span class="cx">     lineBox-&gt;setBidiLevel(bidiLevel);
</span><span class="cx">     lineBox-&gt;setEndsWithBreak(lineInfo.previousLineBrokeCleanly());
</span><span class="cx">     
</span><del>-    bool isSVGRootInlineBox = lineBox-&gt;isSVGRootInlineBox();
</del><ins>+    bool isSVGRootInlineBox = is&lt;SVGRootInlineBox&gt;(*lineBox);
</ins><span class="cx">     
</span><span class="cx">     GlyphOverflowAndFallbackFontsMap textBoxDataMap;
</span><span class="cx">     
</span><span class="lines">@@ -1002,7 +1002,7 @@
</span><span class="cx">     // text selection in RTL boxes would not work as expected.
</span><span class="cx">     if (isSVGRootInlineBox) {
</span><span class="cx">         ASSERT_WITH_SECURITY_IMPLICATION(isSVGText());
</span><del>-        toSVGRootInlineBox(lineBox)-&gt;computePerCharacterLayoutInformation();
</del><ins>+        downcast&lt;SVGRootInlineBox&gt;(*lineBox).computePerCharacterLayoutInformation();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     // Compute our overflow now.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderText.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderText.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RenderText.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -431,9 +431,9 @@
</span><span class="cx">     if (!inlineBox)
</span><span class="cx">         return LayoutRect();
</span><span class="cx"> 
</span><del>-    InlineTextBox* box = toInlineTextBox(inlineBox);
-    float left = box-&gt;positionForOffset(caretOffset);
-    return box-&gt;root().computeCaretRect(left, caretWidth, extraWidthToEndOfLine);
</del><ins>+    auto&amp; box = downcast&lt;InlineTextBox&gt;(*inlineBox);
+    float left = box.positionForOffset(caretOffset);
+    return box.root().computeCaretRect(left, caretWidth, extraWidthToEndOfLine);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE float RenderText::widthFromCache(const Font&amp; f, int start, int len, float xPos, HashSet&lt;const SimpleFontData*&gt;* fallbackFonts, GlyphOverflow* glyphOverflow, const RenderStyle&amp; style) const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRootInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RootInlineBox.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RootInlineBox.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RootInlineBox.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -95,12 +95,9 @@
</span><span class="cx"> bool RootInlineBox::isHyphenated() const
</span><span class="cx"> {
</span><span class="cx">     for (InlineBox* box = firstLeafChild(); box; box = box-&gt;nextLeafChild()) {
</span><del>-        if (box-&gt;isInlineTextBox()) {
-            if (toInlineTextBox(box)-&gt;hasHyphen())
-                return true;
-        }
</del><ins>+        if (is&lt;InlineTextBox&gt;(*box) &amp;&amp; downcast&lt;InlineTextBox&gt;(*box).hasHyphen())
+            return true;
</ins><span class="cx">     }
</span><del>-
</del><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -830,10 +827,10 @@
</span><span class="cx"> 
</span><span class="cx">     Vector&lt;const SimpleFontData*&gt;* usedFonts = nullptr;
</span><span class="cx">     GlyphOverflow* glyphOverflow = nullptr;
</span><del>-    if (box.isInlineTextBox()) {
-        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(toInlineTextBox(&amp;box));
-        usedFonts = it == textBoxDataMap.end() ? 0 : &amp;it-&gt;value.first;
-        glyphOverflow = it == textBoxDataMap.end() ? 0 : &amp;it-&gt;value.second;
</del><ins>+    if (is&lt;InlineTextBox&gt;(box)) {
+        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(&amp;downcast&lt;InlineTextBox&gt;(box));
+        usedFonts = it == textBoxDataMap.end() ? nullptr : &amp;it-&gt;value.first;
+        glyphOverflow = it == textBoxDataMap.end() ? nullptr : &amp;it-&gt;value.second;
</ins><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     bool includeLeading = includeLeadingForBox(box);
</span><span class="lines">@@ -1017,7 +1014,7 @@
</span><span class="cx">     if (box.renderer().isReplaced() || (box.renderer().isTextOrLineBreak() &amp;&amp; !box.behavesLikeText()))
</span><span class="cx">         return false;
</span><span class="cx">     
</span><del>-    if (!box.behavesLikeText() &amp;&amp; box.isInlineFlowBox() &amp;&amp; !toInlineFlowBox(&amp;box)-&gt;hasTextChildren())
</del><ins>+    if (!box.behavesLikeText() &amp;&amp; is&lt;InlineFlowBox&gt;(box) &amp;&amp; !downcast&lt;InlineFlowBox&gt;(box).hasTextChildren())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // For now map &quot;glyphs&quot; to &quot;font&quot; in vertical text mode until the bounds returned by glyphs aren't garbage.
</span><span class="lines">@@ -1030,7 +1027,7 @@
</span><span class="cx">     if (box.renderer().isReplaced() || (box.renderer().isTextOrLineBreak() &amp;&amp; !box.behavesLikeText()))
</span><span class="cx">         return false;
</span><span class="cx">     
</span><del>-    if (!box.behavesLikeText() &amp;&amp; box.isInlineFlowBox() &amp;&amp; !toInlineFlowBox(&amp;box)-&gt;hasTextChildren())
</del><ins>+    if (!box.behavesLikeText() &amp;&amp; is&lt;InlineFlowBox&gt;(box) &amp;&amp; !downcast&lt;InlineFlowBox&gt;(box).hasTextChildren())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     // FIXME: We can't fit to glyphs yet for vertical text, since the bounds returned are garbage.
</span><span class="lines">@@ -1043,7 +1040,7 @@
</span><span class="cx">     if (box.renderer().isReplaced() || (box.renderer().isTextOrLineBreak() &amp;&amp; !box.behavesLikeText()))
</span><span class="cx">         return false;
</span><span class="cx">     
</span><del>-    if (!box.behavesLikeText() &amp;&amp; box.isInlineFlowBox() &amp;&amp; !toInlineFlowBox(&amp;box)-&gt;hasTextChildren())
</del><ins>+    if (!box.behavesLikeText() &amp;&amp; is&lt;InlineFlowBox&gt;(box) &amp;&amp; !downcast&lt;InlineFlowBox&gt;(box).hasTextChildren())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     LineBoxContain lineBoxContain = renderer().style().lineBoxContain();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRootInlineBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RootInlineBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RootInlineBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/RootInlineBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -224,18 +224,18 @@
</span><span class="cx">     std::unique_ptr&lt;Vector&lt;RenderBox*&gt;&gt; m_floats;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(RootInlineBox, isRootInlineBox())
-
</del><span class="cx"> inline RootInlineBox* RootInlineBox::nextRootBox() const
</span><span class="cx"> {
</span><del>-    return toRootInlineBox(m_nextLineBox);
</del><ins>+    return downcast&lt;RootInlineBox&gt;(m_nextLineBox);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline RootInlineBox* RootInlineBox::prevRootBox() const
</span><span class="cx"> {
</span><del>-    return toRootInlineBox(m_prevLineBox);
</del><ins>+    return downcast&lt;RootInlineBox&gt;(m_prevLineBox);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(RootInlineBox, isRootInlineBox())
+
</ins><span class="cx"> #endif // RootInlineBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgRenderSVGInlineTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGInlineText.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -118,22 +118,22 @@
</span><span class="cx"> 
</span><span class="cx"> LayoutRect RenderSVGInlineText::localCaretRect(InlineBox* box, int caretOffset, LayoutUnit*)
</span><span class="cx"> {
</span><del>-    if (!box || !box-&gt;isInlineTextBox())
</del><ins>+    if (!is&lt;InlineTextBox&gt;(box))
</ins><span class="cx">         return LayoutRect();
</span><span class="cx"> 
</span><del>-    InlineTextBox* textBox = toInlineTextBox(box);
-    if (static_cast&lt;unsigned&gt;(caretOffset) &lt; textBox-&gt;start() || static_cast&lt;unsigned&gt;(caretOffset) &gt; textBox-&gt;start() + textBox-&gt;len())
</del><ins>+    auto&amp; textBox = downcast&lt;InlineTextBox&gt;(*box);
+    if (static_cast&lt;unsigned&gt;(caretOffset) &lt; textBox.start() || static_cast&lt;unsigned&gt;(caretOffset) &gt; textBox.start() + textBox.len())
</ins><span class="cx">         return LayoutRect();
</span><span class="cx"> 
</span><span class="cx">     // Use the edge of the selection rect to determine the caret rect.
</span><del>-    if (static_cast&lt;unsigned&gt;(caretOffset) &lt; textBox-&gt;start() + textBox-&gt;len()) {
-        LayoutRect rect = textBox-&gt;localSelectionRect(caretOffset, caretOffset + 1);
-        LayoutUnit x = box-&gt;isLeftToRightDirection() ? rect.x() : rect.maxX();
</del><ins>+    if (static_cast&lt;unsigned&gt;(caretOffset) &lt; textBox.start() + textBox.len()) {
+        LayoutRect rect = textBox.localSelectionRect(caretOffset, caretOffset + 1);
+        LayoutUnit x = textBox.isLeftToRightDirection() ? rect.x() : rect.maxX();
</ins><span class="cx">         return LayoutRect(x, rect.y(), caretWidth, rect.height());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    LayoutRect rect = textBox-&gt;localSelectionRect(caretOffset - 1, caretOffset);
-    LayoutUnit x = box-&gt;isLeftToRightDirection() ? rect.maxX() : rect.x();
</del><ins>+    LayoutRect rect = textBox.localSelectionRect(caretOffset - 1, caretOffset);
+    LayoutUnit x = textBox.isLeftToRightDirection() ? rect.maxX() : rect.x();
</ins><span class="cx">     return LayoutRect(x, rect.y(), caretWidth, rect.height());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -182,16 +182,16 @@
</span><span class="cx"> 
</span><span class="cx">     float closestDistance = std::numeric_limits&lt;float&gt;::max();
</span><span class="cx">     float closestDistancePosition = 0;
</span><del>-    const SVGTextFragment* closestDistanceFragment = 0;
-    SVGInlineTextBox* closestDistanceBox = 0;
</del><ins>+    const SVGTextFragment* closestDistanceFragment = nullptr;
+    SVGInlineTextBox* closestDistanceBox = nullptr;
</ins><span class="cx"> 
</span><span class="cx">     AffineTransform fragmentTransform;
</span><span class="cx">     for (InlineTextBox* box = firstTextBox(); box; box = box-&gt;nextTextBox()) {
</span><del>-        if (!box-&gt;isSVGInlineTextBox())
</del><ins>+        if (!is&lt;SVGInlineTextBox&gt;(*box))
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        SVGInlineTextBox* textBox = toSVGInlineTextBox(box);
-        Vector&lt;SVGTextFragment&gt;&amp; fragments = textBox-&gt;textFragments();
</del><ins>+        auto&amp; textBox = downcast&lt;SVGInlineTextBox&gt;(*box);
+        Vector&lt;SVGTextFragment&gt;&amp; fragments = textBox.textFragments();
</ins><span class="cx"> 
</span><span class="cx">         unsigned textFragmentsSize = fragments.size();
</span><span class="cx">         for (unsigned i = 0; i &lt; textFragmentsSize; ++i) {
</span><span class="lines">@@ -206,7 +206,7 @@
</span><span class="cx"> 
</span><span class="cx">             if (distance &lt; closestDistance) {
</span><span class="cx">                 closestDistance = distance;
</span><del>-                closestDistanceBox = textBox;
</del><ins>+                closestDistanceBox = &amp;textBox;
</ins><span class="cx">                 closestDistanceFragment = &amp;fragment;
</span><span class="cx">                 closestDistancePosition = fragmentRect.x();
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgRenderSVGTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -472,11 +472,10 @@
</span><span class="cx">     if (!rootBox)
</span><span class="cx">         return createVisiblePosition(0, DOWNSTREAM);
</span><span class="cx"> 
</span><del>-    ASSERT_WITH_SECURITY_IMPLICATION(rootBox-&gt;isSVGRootInlineBox());
</del><span class="cx">     ASSERT(!rootBox-&gt;nextRootBox());
</span><span class="cx">     ASSERT(childrenInline());
</span><span class="cx"> 
</span><del>-    InlineBox* closestBox = toSVGRootInlineBox(rootBox)-&gt;closestLeafChildForPosition(pointInContents);
</del><ins>+    InlineBox* closestBox = downcast&lt;SVGRootInlineBox&gt;(*rootBox).closestLeafChildForPosition(pointInContents);
</ins><span class="cx">     if (!closestBox)
</span><span class="cx">         return createVisiblePosition(0, DOWNSTREAM);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGInlineFlowBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -38,10 +38,10 @@
</span><span class="cx"> 
</span><span class="cx">     PaintInfo childPaintInfo(paintInfo);
</span><span class="cx">     for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-        if (child-&gt;isSVGInlineTextBox())
-            toSVGInlineTextBox(child)-&gt;paintSelectionBackground(childPaintInfo);
-        else if (child-&gt;isSVGInlineFlowBox())
-            toSVGInlineFlowBox(child)-&gt;paintSelectionBackground(childPaintInfo);
</del><ins>+        if (is&lt;SVGInlineTextBox&gt;(*child))
+            downcast&lt;SVGInlineTextBox&gt;(*child).paintSelectionBackground(childPaintInfo);
+        else if (is&lt;SVGInlineFlowBox&gt;(*child))
+            downcast&lt;SVGInlineFlowBox&gt;(*child).paintSelectionBackground(childPaintInfo);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -53,8 +53,8 @@
</span><span class="cx">     SVGRenderingContext renderingContext(renderer(), paintInfo, SVGRenderingContext::SaveGraphicsContext);
</span><span class="cx">     if (renderingContext.isRenderingPrepared()) {
</span><span class="cx">         for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-            if (child-&gt;isSVGInlineTextBox())
-                computeTextMatchMarkerRectForRenderer(&amp;(toSVGInlineTextBox(child)-&gt;renderer()));
</del><ins>+            if (is&lt;SVGInlineTextBox&gt;(*child))
+                computeTextMatchMarkerRectForRenderer(&amp;downcast&lt;SVGInlineTextBox&gt;(*child).renderer());
</ins><span class="cx"> 
</span><span class="cx">             child-&gt;paint(paintInfo, paintOffset, 0, 0);
</span><span class="cx">         }
</span><span class="lines">@@ -95,13 +95,13 @@
</span><span class="cx"> 
</span><span class="cx">         FloatRect markerRect;
</span><span class="cx">         for (InlineTextBox* box = textRenderer-&gt;firstTextBox(); box; box = box-&gt;nextTextBox()) {
</span><del>-            if (!box-&gt;isSVGInlineTextBox())
</del><ins>+            if (!is&lt;SVGInlineTextBox&gt;(*box))
</ins><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            SVGInlineTextBox* textBox = toSVGInlineTextBox(box);
</del><ins>+            auto&amp; textBox = downcast&lt;SVGInlineTextBox&gt;(*box);
</ins><span class="cx"> 
</span><del>-            int markerStartPosition = std::max&lt;int&gt;(marker-&gt;startOffset() - textBox-&gt;start(), 0);
-            int markerEndPosition = std::min&lt;int&gt;(marker-&gt;endOffset() - textBox-&gt;start(), textBox-&gt;len());
</del><ins>+            int markerStartPosition = std::max&lt;int&gt;(marker-&gt;startOffset() - textBox.start(), 0);
+            int markerEndPosition = std::min&lt;int&gt;(marker-&gt;endOffset() - textBox.start(), textBox.len());
</ins><span class="cx"> 
</span><span class="cx">             if (markerStartPosition &gt;= markerEndPosition)
</span><span class="cx">                 continue;
</span><span class="lines">@@ -109,17 +109,17 @@
</span><span class="cx">             int fragmentStartPosition = 0;
</span><span class="cx">             int fragmentEndPosition = 0;
</span><span class="cx"> 
</span><del>-            const Vector&lt;SVGTextFragment&gt;&amp; fragments = textBox-&gt;textFragments();
</del><ins>+            const Vector&lt;SVGTextFragment&gt;&amp; fragments = textBox.textFragments();
</ins><span class="cx">             unsigned textFragmentsSize = fragments.size();
</span><span class="cx">             for (unsigned i = 0; i &lt; textFragmentsSize; ++i) {
</span><span class="cx">                 const SVGTextFragment&amp; fragment = fragments.at(i);
</span><span class="cx"> 
</span><span class="cx">                 fragmentStartPosition = markerStartPosition;
</span><span class="cx">                 fragmentEndPosition = markerEndPosition;
</span><del>-                if (!textBox-&gt;mapStartEndPositionsIntoFragmentCoordinates(fragment, fragmentStartPosition, fragmentEndPosition))
</del><ins>+                if (!textBox.mapStartEndPositionsIntoFragmentCoordinates(fragment, fragmentStartPosition, fragmentEndPosition))
</ins><span class="cx">                     continue;
</span><span class="cx"> 
</span><del>-                FloatRect fragmentRect = textBox-&gt;selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, &amp;style);
</del><ins>+                FloatRect fragmentRect = textBox.selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, &amp;style);
</ins><span class="cx">                 fragment.buildFragmentTransform(fragmentTransform);
</span><span class="cx">                 if (!fragmentTransform.isIdentity())
</span><span class="cx">                     fragmentRect = fragmentTransform.mapRect(fragmentRect);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGInlineFlowBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGInlineFlowBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -52,8 +52,8 @@
</span><span class="cx">     float m_logicalHeight;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(SVGInlineFlowBox, isSVGInlineFlowBox())
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(SVGInlineFlowBox, isSVGInlineFlowBox())
+
</ins><span class="cx"> #endif // SVGInlineFlowBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGInlineTextBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGInlineTextBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -92,8 +92,8 @@
</span><span class="cx">     Vector&lt;SVGTextFragment&gt; m_textFragments;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(SVGInlineTextBox, isSVGInlineTextBox())
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(SVGInlineTextBox, isSVGInlineTextBox())
+
</ins><span class="cx"> #endif // SVGInlineTextBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGRenderTreeAsTextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -364,7 +364,7 @@
</span><span class="cx"> 
</span><span class="cx"> static void writeRenderSVGTextBox(TextStream&amp; ts, const RenderSVGText&amp; text)
</span><span class="cx"> {
</span><del>-    SVGRootInlineBox* box = toSVGRootInlineBox(text.firstRootBox());
</del><ins>+    auto* box = downcast&lt;SVGRootInlineBox&gt;(text.firstRootBox());
</ins><span class="cx">     if (!box)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -434,10 +434,10 @@
</span><span class="cx"> static inline void writeSVGInlineTextBoxes(TextStream&amp; ts, const RenderText&amp; text, int indent)
</span><span class="cx"> {
</span><span class="cx">     for (InlineTextBox* box = text.firstTextBox(); box; box = box-&gt;nextTextBox()) {
</span><del>-        if (!box-&gt;isSVGInlineTextBox())
</del><ins>+        if (!is&lt;SVGInlineTextBox&gt;(*box))
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        writeSVGInlineTextBox(ts, toSVGInlineTextBox(box), indent);
</del><ins>+        writeSVGInlineTextBox(ts, downcast&lt;SVGInlineTextBox&gt;(box), indent);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGRootInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -56,18 +56,18 @@
</span><span class="cx">     PaintInfo childPaintInfo(paintInfo);
</span><span class="cx">     if (hasSelection) {
</span><span class="cx">         for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-            if (child-&gt;isSVGInlineTextBox())
-                toSVGInlineTextBox(child)-&gt;paintSelectionBackground(childPaintInfo);
-            else if (child-&gt;isSVGInlineFlowBox())
-                toSVGInlineFlowBox(child)-&gt;paintSelectionBackground(childPaintInfo);
</del><ins>+            if (is&lt;SVGInlineTextBox&gt;(*child))
+                downcast&lt;SVGInlineTextBox&gt;(*child).paintSelectionBackground(childPaintInfo);
+            else if (is&lt;SVGInlineFlowBox&gt;(*child))
+                downcast&lt;SVGInlineFlowBox&gt;(*child).paintSelectionBackground(childPaintInfo);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     SVGRenderingContext renderingContext(renderSVGText(), paintInfo, SVGRenderingContext::SaveGraphicsContext);
</span><span class="cx">     if (renderingContext.isRenderingPrepared()) {
</span><span class="cx">         for (InlineBox* child = firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-            if (child-&gt;isSVGInlineTextBox())
-                SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(&amp;toSVGInlineTextBox(child)-&gt;renderer());
</del><ins>+            if (is&lt;SVGInlineTextBox&gt;(*child))
+                SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(&amp;downcast&lt;SVGInlineTextBox&gt;(*child).renderer());
</ins><span class="cx"> 
</span><span class="cx">             child-&gt;paint(paintInfo, paintOffset, 0, 0);
</span><span class="cx">         }
</span><span class="lines">@@ -103,31 +103,27 @@
</span><span class="cx"> void SVGRootInlineBox::layoutCharactersInTextBoxes(InlineFlowBox* start, SVGTextLayoutEngine&amp; characterLayout)
</span><span class="cx"> {
</span><span class="cx">     for (InlineBox* child = start-&gt;firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-        if (child-&gt;isSVGInlineTextBox()) {
-            ASSERT(child-&gt;renderer().isSVGInlineText());
-
-            SVGInlineTextBox* textBox = toSVGInlineTextBox(child);
-            characterLayout.layoutInlineTextBox(textBox);
</del><ins>+        if (is&lt;SVGInlineTextBox&gt;(*child)) {
+            ASSERT(is&lt;RenderSVGInlineText&gt;(child-&gt;renderer()));
+            characterLayout.layoutInlineTextBox(downcast&lt;SVGInlineTextBox&gt;(child));
</ins><span class="cx">         } else {
</span><span class="cx">             // Skip generated content.
</span><span class="cx">             Node* node = child-&gt;renderer().node();
</span><span class="cx">             if (!node)
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            ASSERT_WITH_SECURITY_IMPLICATION(child-&gt;isInlineFlowBox());
-
-            SVGInlineFlowBox* flowBox = toSVGInlineFlowBox(child);
</del><ins>+            auto&amp; flowBox = downcast&lt;SVGInlineFlowBox&gt;(*child);
</ins><span class="cx">             bool isTextPath = node-&gt;hasTagName(SVGNames::textPathTag);
</span><span class="cx">             if (isTextPath) {
</span><span class="cx">                 // Build text chunks for all &lt;textPath&gt; children, using the line layout algorithm.
</span><span class="cx">                 // This is needeed as text-anchor is just an additional startOffset for text paths.
</span><span class="cx">                 SVGTextLayoutEngine lineLayout(characterLayout.layoutAttributes());
</span><del>-                layoutCharactersInTextBoxes(flowBox, lineLayout);
</del><ins>+                layoutCharactersInTextBoxes(&amp;flowBox, lineLayout);
</ins><span class="cx"> 
</span><span class="cx">                 characterLayout.beginTextPathLayout(&amp;child-&gt;renderer(), lineLayout);
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            layoutCharactersInTextBoxes(flowBox, characterLayout);
</del><ins>+            layoutCharactersInTextBoxes(&amp;flowBox, characterLayout);
</ins><span class="cx"> 
</span><span class="cx">             if (isTextPath)
</span><span class="cx">                 characterLayout.endTextPathLayout();
</span><span class="lines">@@ -139,30 +135,28 @@
</span><span class="cx"> {
</span><span class="cx">     for (InlineBox* child = start-&gt;firstChild(); child; child = child-&gt;nextOnLine()) {
</span><span class="cx">         FloatRect boxRect;
</span><del>-        if (child-&gt;isSVGInlineTextBox()) {
-            ASSERT(child-&gt;renderer().isSVGInlineText());
</del><ins>+        if (is&lt;SVGInlineTextBox&gt;(*child)) {
+            ASSERT(is&lt;RenderSVGInlineText&gt;(child-&gt;renderer()));
</ins><span class="cx"> 
</span><del>-            SVGInlineTextBox* textBox = toSVGInlineTextBox(child);
-            boxRect = textBox-&gt;calculateBoundaries();
-            textBox-&gt;setX(boxRect.x());
-            textBox-&gt;setY(boxRect.y());
-            textBox-&gt;setLogicalWidth(boxRect.width());
-            textBox-&gt;setLogicalHeight(boxRect.height());
</del><ins>+            auto&amp; textBox = downcast&lt;SVGInlineTextBox&gt;(*child);
+            boxRect = textBox.calculateBoundaries();
+            textBox.setX(boxRect.x());
+            textBox.setY(boxRect.y());
+            textBox.setLogicalWidth(boxRect.width());
+            textBox.setLogicalHeight(boxRect.height());
</ins><span class="cx">         } else {
</span><span class="cx">             // Skip generated content.
</span><span class="cx">             if (!child-&gt;renderer().node())
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            ASSERT_WITH_SECURITY_IMPLICATION(child-&gt;isInlineFlowBox());
</del><ins>+            auto&amp; flowBox = downcast&lt;SVGInlineFlowBox&gt;(*child);
+            layoutChildBoxes(&amp;flowBox);
</ins><span class="cx"> 
</span><del>-            SVGInlineFlowBox* flowBox = toSVGInlineFlowBox(child);
-            layoutChildBoxes(flowBox);
-
-            boxRect = flowBox-&gt;calculateBoundaries();
-            flowBox-&gt;setX(boxRect.x());
-            flowBox-&gt;setY(boxRect.y());
-            flowBox-&gt;setLogicalWidth(boxRect.width());
-            flowBox-&gt;setLogicalHeight(boxRect.height());
</del><ins>+            boxRect = flowBox.calculateBoundaries();
+            flowBox.setX(boxRect.x());
+            flowBox.setY(boxRect.y());
+            flowBox.setLogicalWidth(boxRect.width());
+            flowBox.setLogicalHeight(boxRect.height());
</ins><span class="cx">         }
</span><span class="cx">         if (childRect)
</span><span class="cx">             childRect-&gt;unite(boxRect);
</span><span class="lines">@@ -273,7 +267,7 @@
</span><span class="cx">         if (first == last || first == --last)
</span><span class="cx">             return;
</span><span class="cx"> 
</span><del>-        if (!(*last)-&gt;isSVGInlineTextBox() || !(*first)-&gt;isSVGInlineTextBox()) {
</del><ins>+        if (!is&lt;SVGInlineTextBox&gt;(**last) || !is&lt;SVGInlineTextBox&gt;(**first)) {
</ins><span class="cx">             InlineBox* temp = *first;
</span><span class="cx">             *first = *last;
</span><span class="cx">             *last = temp;
</span><span class="lines">@@ -281,18 +275,18 @@
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        SVGInlineTextBox* firstTextBox = toSVGInlineTextBox(*first);
-        SVGInlineTextBox* lastTextBox = toSVGInlineTextBox(*last);
</del><ins>+        auto&amp; firstTextBox = downcast&lt;SVGInlineTextBox&gt;(**first);
+        auto&amp; lastTextBox = downcast&lt;SVGInlineTextBox&gt;(**last);
</ins><span class="cx"> 
</span><span class="cx">         // Reordering is only necessary for BiDi text that is _absolutely_ positioned.
</span><del>-        if (firstTextBox-&gt;len() == 1 &amp;&amp; firstTextBox-&gt;len() == lastTextBox-&gt;len()) {
-            RenderSVGInlineText&amp; firstContext = firstTextBox-&gt;renderer();
-            RenderSVGInlineText&amp; lastContext = lastTextBox-&gt;renderer();
</del><ins>+        if (firstTextBox.len() == 1 &amp;&amp; firstTextBox.len() == lastTextBox.len()) {
+            RenderSVGInlineText&amp; firstContext = firstTextBox.renderer();
+            RenderSVGInlineText&amp; lastContext = lastTextBox.renderer();
</ins><span class="cx"> 
</span><del>-            SVGTextLayoutAttributes* firstAttributes = 0;
-            SVGTextLayoutAttributes* lastAttributes = 0;
</del><ins>+            SVGTextLayoutAttributes* firstAttributes = nullptr;
+            SVGTextLayoutAttributes* lastAttributes = nullptr;
</ins><span class="cx">             findFirstAndLastAttributesInVector(attributes, &amp;firstContext, &amp;lastContext, firstAttributes, lastAttributes);
</span><del>-            swapItemsInLayoutAttributes(firstAttributes, lastAttributes, firstTextBox-&gt;start(), lastTextBox-&gt;start());
</del><ins>+            swapItemsInLayoutAttributes(firstAttributes, lastAttributes, firstTextBox.start(), lastTextBox.start());
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         InlineBox* temp = *first;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGRootInlineBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.h (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.h        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGRootInlineBox.h        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -57,8 +57,8 @@
</span><span class="cx">     float m_logicalHeight;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-INLINE_BOX_OBJECT_TYPE_CASTS(SVGRootInlineBox, isSVGRootInlineBox())
-
</del><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><ins>+SPECIALIZE_TYPE_TRAITS_INLINE_BOX(SVGRootInlineBox, isSVGRootInlineBox())
+
</ins><span class="cx"> #endif // SVGRootInlineBox_h
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingsvgSVGTextQuerycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp (174745 => 174746)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp        2014-10-15 22:36:08 UTC (rev 174745)
+++ trunk/Source/WebCore/rendering/svg/SVGTextQuery.cpp        2014-10-16 00:05:37 UTC (rev 174746)
</span><span class="lines">@@ -89,17 +89,17 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     for (InlineBox* child = flowBox-&gt;firstChild(); child; child = child-&gt;nextOnLine()) {
</span><del>-        if (child-&gt;isInlineFlowBox()) {
</del><ins>+        if (is&lt;InlineFlowBox&gt;(*child)) {
</ins><span class="cx">             // Skip generated content.
</span><span class="cx">             if (!child-&gt;renderer().node())
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            collectTextBoxesInFlowBox(toInlineFlowBox(child));
</del><ins>+            collectTextBoxesInFlowBox(downcast&lt;InlineFlowBox&gt;(child));
</ins><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (child-&gt;isSVGInlineTextBox())
-            m_textBoxes.append(toSVGInlineTextBox(child));
</del><ins>+        if (is&lt;SVGInlineTextBox&gt;(*child))
+            m_textBoxes.append(downcast&lt;SVGInlineTextBox&gt;(child));
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>