Fix bad cast in PaintInvalidationState::updateForNormalChildren()

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 6a243e2102ad711ecf9aec289e73f7e83178aec0..9d380d2dcd495337a1986dfda0b18d4d71cab736 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -291,31 +291,30 @@ void PaintInvalidationState::updateForNormalChildren()
     if (!m_cachedOffsetsEnabled)
         return;
 
-    if (!m_currentObject.isBoxModelObject() && !m_currentObject.isSVG())
+    if (!m_currentObject.isBox())
         return;
+    const LayoutBox& box = toLayoutBox(m_currentObject);
 
-    if (m_currentObject.isLayoutView()) {
-        if (!m_currentObject.document().settings() || !m_currentObject.document().settings()->rootLayerScrolls()) {
-            if (m_currentObject != m_paintInvalidationContainer) {
-                m_paintOffset -= toLayoutView(m_currentObject).frameView()->scrollOffset();
-                addClipRectRelativeToPaintOffset(toLayoutView(m_currentObject).viewRect());
+    if (box.isLayoutView()) {
+        if (!box.document().settings() || !box.document().settings()->rootLayerScrolls()) {
+            if (box != m_paintInvalidationContainer) {
+                m_paintOffset -= toLayoutView(box).frameView()->scrollOffset();
+                addClipRectRelativeToPaintOffset(toLayoutView(box).viewRect());
             }
             return;
         }
-    } else if (m_currentObject.isSVGRoot()) {
-        const LayoutSVGRoot& svgRoot = toLayoutSVGRoot(m_currentObject);
+    } else if (box.isSVGRoot()) {
+        const LayoutSVGRoot& svgRoot = toLayoutSVGRoot(box);
         if (svgRoot.shouldApplyViewportClip())
             addClipRectRelativeToPaintOffset(LayoutRect(LayoutPoint(), LayoutSize(svgRoot.pixelSnappedSize())));
-    } else if (m_currentObject.isTableRow()) {
+    } else if (box.isTableRow()) {
         // Child table cell's locationOffset() includes its row's locationOffset().
-        m_paintOffset -= toLayoutBox(m_currentObject).locationOffset();
+        m_paintOffset -= box.locationOffset();
     }
 
-    if (!m_currentObject.hasClipRelatedProperty())
+    if (!box.hasClipRelatedProperty())
         return;
 
-    const LayoutBox& box = toLayoutBox(m_currentObject);
-
     // Do not clip or scroll for the paint invalidation container, if it scrolls overflow, because it will always use composited
     // scrolling in this case.
     if (box == m_paintInvalidationContainer && box.scrollsOverflow()) {