| Index: third_party/WebKit/Source/core/layout/line/RootInlineBox.cpp
|
| diff --git a/third_party/WebKit/Source/core/layout/line/RootInlineBox.cpp b/third_party/WebKit/Source/core/layout/line/RootInlineBox.cpp
|
| index 5a1625bd834369cafe32b5607a4076d726c8f8a7..cf52c32d61acb3c5cfbade7d8c9290da60a46619 100644
|
| --- a/third_party/WebKit/Source/core/layout/line/RootInlineBox.cpp
|
| +++ b/third_party/WebKit/Source/core/layout/line/RootInlineBox.cpp
|
| @@ -546,9 +546,9 @@ void RootInlineBox::setLineBreakInfo(LineLayoutItem obj,
|
| // This has security implications because if the LayoutObject does not point
|
| // to at least one line box, then that LayoutInline can be deleted later
|
| // without resetting the lineBreakObj, leading to use-after-free.
|
| - ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj.isText() ||
|
| - !(obj.isLayoutInline() && obj.isBox() &&
|
| - !LineLayoutBox(obj).inlineBoxWrapper()));
|
| + SECURITY_DCHECK(!obj || obj.isText() ||
|
| + !(obj.isLayoutInline() && obj.isBox() &&
|
| + !LineLayoutBox(obj).inlineBoxWrapper()));
|
|
|
| m_lineBreakObj = obj;
|
| m_lineBreakPos = breakPos;
|
|
|