Index: Source/core/layout/line/RootInlineBox.cpp |
diff --git a/Source/core/layout/line/RootInlineBox.cpp b/Source/core/layout/line/RootInlineBox.cpp |
index 3de0b2e6f032f4e5cb9ace7da5d9853ecb5475fb..87f5c1930c3e2355065ea6c78273bfcf0704fd6d 100644 |
--- a/Source/core/layout/line/RootInlineBox.cpp |
+++ b/Source/core/layout/line/RootInlineBox.cpp |
@@ -527,7 +527,7 @@ void RootInlineBox::setLineBreakInfo(LayoutObject* obj, unsigned breakPos, const |
// This has security implications because if the LayoutObject does not |
// point to at least one line box, then that RenderInline can be deleted |
// later without resetting the lineBreakObj, leading to use-after-free. |
- ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj->isText() || !(obj->isRenderInline() && obj->isBox() && !toRenderBox(obj)->inlineBoxWrapper())); |
+ ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj->isText() || !(obj->isRenderInline() && obj->isBox() && !toLayoutBox(obj)->inlineBoxWrapper())); |
m_lineBreakObj = obj; |
m_lineBreakPos = breakPos; |