Validate objects are a box when clipping layers for clip-path.

third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

Index: third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
index e14024d9ff0f58b6c2b25fa6c38a0eb535f3502b..593f586be5e0e62f806386fc44b172ede81ac74a 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
@@ -967,7 +967,7 @@ void CompositedLayerMapping::updateGraphicsLayerGeometry(
 
   // If we have a layer that clips children, position it.
   IntRect clippingBox;
-  if (m_childContainmentLayer)
+  if (m_childContainmentLayer && layoutObject()->isBox())
     clippingBox = clipBox(toLayoutBox(layoutObject()));
 
   updateChildTransformLayerGeometry();
@@ -1043,7 +1043,8 @@ void CompositedLayerMapping::computeGraphicsLayerParentLocation(
     const IntRect& ancestorCompositingBounds,
     IntPoint& graphicsLayerParentLocation) {
   if (compositingContainer &&
-      compositingContainer->compositedLayerMapping()->hasClippingLayer()) {
+      compositingContainer->compositedLayerMapping()->hasClippingLayer() &&
+      compositingContainer->layoutObject()->isBox()) {
     // If the compositing ancestor has a layer to clip children, we parent in
     // that, and therefore position relative to it.
     IntRect clippingBox =
@@ -1360,7 +1361,8 @@ void CompositedLayerMapping::updateScrollingLayerGeometry(
 }
 
 void CompositedLayerMapping::updateChildClippingMaskLayerGeometry() {
-  if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath())
+  if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath() ||
+      !layoutObject()->isBox())
     return;
   LayoutBox* layoutBox = toLayoutBox(layoutObject());
   IntRect clientBox = enclosingIntRect(layoutBox->clientBoxRect());