Validate objects are a box when clipping layers for clip-path.

third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

 /*
  * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 949 matching lines @@
                                           graphicsLayerParentLocation);
   updateContentsOffsetInCompositingLayer(snappedOffsetFromCompositedAncestor,
                                          graphicsLayerParentLocation);
   updateSquashingLayerGeometry(
       graphicsLayerParentLocation, compositingContainer, m_squashedLayers,
       m_squashingLayer.get(), &m_squashingLayerOffsetFromTransformedAncestor,
       layersNeedingPaintInvalidation);
 
   // If we have a layer that clips children, position it.
   IntRect clippingBox;
-  if (m_childContainmentLayer)
+  if (m_childContainmentLayer && layoutObject()->isBox())
     clippingBox = clipBox(toLayoutBox(layoutObject()));
 
   updateChildTransformLayerGeometry();
   updateChildContainmentLayerGeometry(clippingBox, localCompositingBounds);
 
   updateMaskLayerGeometry();
   updateTransformGeometry(snappedOffsetFromCompositedAncestor,
                           relativeCompositingBounds);
   updateForegroundLayerGeometry(contentsSize, clippingBox);
   updateBackgroundLayerGeometry(contentsSize);
@@ skipping 55 matching lines @@
   m_graphicsLayer->setBackfaceVisibility(
       layoutObject()->style()->backfaceVisibility() ==
       BackfaceVisibilityVisible);
 }
 
 void CompositedLayerMapping::computeGraphicsLayerParentLocation(
     const PaintLayer* compositingContainer,
     const IntRect& ancestorCompositingBounds,
     IntPoint& graphicsLayerParentLocation) {
   if (compositingContainer &&
-      compositingContainer->compositedLayerMapping()->hasClippingLayer()) {
+      compositingContainer->compositedLayerMapping()->hasClippingLayer() &&
+      compositingContainer->layoutObject()->isBox()) {
     // If the compositing ancestor has a layer to clip children, we parent in
     // that, and therefore position relative to it.
     IntRect clippingBox =
         clipBox(toLayoutBox(compositingContainer->layoutObject()));
     graphicsLayerParentLocation =
         clippingBox.location() +
         roundedIntSize(compositingContainer->subpixelAccumulation());
   } else if (compositingContainer &&
              compositingContainer->compositedLayerMapping()
                  ->childTransformLayer()) {
@@ skipping 296 matching lines @@
   if (m_foregroundLayer) {
     if (m_foregroundLayer->size() != m_scrollingContentsLayer->size())
       m_foregroundLayer->setSize(m_scrollingContentsLayer->size());
     m_foregroundLayer->setNeedsDisplay();
     m_foregroundLayer->setOffsetFromLayoutObject(
         m_scrollingContentsLayer->offsetFromLayoutObject());
   }
 }
 
 void CompositedLayerMapping::updateChildClippingMaskLayerGeometry() {
-  if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath())
+  if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath() ||
+      !layoutObject()->isBox())
     return;
   LayoutBox* layoutBox = toLayoutBox(layoutObject());
   IntRect clientBox = enclosingIntRect(layoutBox->clientBoxRect());
 
   m_childClippingMaskLayer->setPosition(m_graphicsLayer->position());
   m_childClippingMaskLayer->setSize(m_graphicsLayer->size());
   m_childClippingMaskLayer->setOffsetFromLayoutObject(
       toIntSize(clientBox.location()));
 
   // NOTE: also some stuff happening in updateChildContainmentLayerGeometry().
@@ skipping 2006 matching lines @@
   } else if (graphicsLayer == m_decorationOutlineLayer.get()) {
     name = "Decoration Layer";
   } else {
     ASSERT_NOT_REACHED();
   }
 
   return name;
 }
 
 }  // namespace blink