Fix a bad cast in PaintLayerClipper

third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 55 matching lines @@
     }
 }
 
 static void applyClipRects(const ClipRectsContext& context, const LayoutObject& layoutObject, LayoutPoint offset, ClipRects& clipRects)
 {
     ASSERT(layoutObject.hasOverflowClip() || layoutObject.hasClip() || layoutObject.style()->containsPaint());
     LayoutView* view = layoutObject.view();
     ASSERT(view);
     if (clipRects.fixed() && context.rootLayer->layoutObject() == view)
         offset -= toIntSize(view->frameView()->scrollPosition());
-    if (layoutObject.hasOverflowClip() || layoutObject.style()->containsPaint()) {
+    if (layoutObject.hasOverflowClip() || (layoutObject.style()->containsPaint() && layoutObject.isBox())) {
         ClipRect newOverflowClip = toLayoutBox(layoutObject).overflowClipRect(offset, context.scrollbarRelevancy);
         newOverflowClip.setHasRadius(layoutObject.style()->hasBorderRadius());
         clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
         if (layoutObject.isPositioned())
             clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
         if (layoutObject.isLayoutView())
             clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
         if (layoutObject.style()->containsPaint()) {
             clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
             clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
@@ skipping 122 matching lines @@
     foregroundRect = backgroundRect;
 
     LayoutPoint offset;
     if (offsetFromRoot)
         offset = *offsetFromRoot;
     else
         m_layoutObject.layer()->convertToLayerCoords(context.rootLayer, offset);
     layerBounds = LayoutRect(offset, LayoutSize(m_layoutObject.layer()->size()));
 
     // Update the clip rects that will be passed to child layers.
-    if ((m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context)) || m_layoutObject.style()->containsPaint()) {
+    if ((m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context))
+        || (m_layoutObject.style()->containsPaint() && m_layoutObject.isBox())) {
         foregroundRect.intersect(toLayoutBox(m_layoutObject).overflowClipRect(offset, context.scrollbarRelevancy));
         if (m_layoutObject.style()->hasBorderRadius())
             foregroundRect.setHasRadius(true);
 
         // FIXME: Does not do the right thing with columns yet, since we don't yet factor in the
         // individual column boxes as overflow.
 
         // The LayoutView is special since its overflow clipping rect may be larger than its box rect (crbug.com/492871).
         LayoutRect layerBoundsWithVisualOverflow = m_layoutObject.isLayoutView() ? toLayoutView(m_layoutObject).viewRect() : toLayoutBox(m_layoutObject).visualOverflowRect();
         toLayoutBox(m_layoutObject).flipForWritingMode(layerBoundsWithVisualOverflow); // PaintLayer are in physical coordinates, so the overflow has to be flipped.
@@ skipping 104 matching lines @@
 
 ClipRects* PaintLayerClipper::paintingClipRects(const PaintLayer* rootLayer, ShouldRespectOverflowClip respectOverflowClip, const LayoutSize& subpixelAccumulation) const
 {
     ClipRectsContext context(rootLayer, PaintingClipRects, IgnoreOverlayScrollbarSize, subpixelAccumulation);
     if (respectOverflowClip == IgnoreOverflowClip)
         context.setIgnoreOverflowClip();
     return getClipRects(context);
 }
 
 } // namespace blink