| Index: Source/core/layout/line/RootInlineBox.cpp
|
| diff --git a/Source/core/layout/line/RootInlineBox.cpp b/Source/core/layout/line/RootInlineBox.cpp
|
| index 3de0b2e6f032f4e5cb9ace7da5d9853ecb5475fb..87f5c1930c3e2355065ea6c78273bfcf0704fd6d 100644
|
| --- a/Source/core/layout/line/RootInlineBox.cpp
|
| +++ b/Source/core/layout/line/RootInlineBox.cpp
|
| @@ -527,7 +527,7 @@ void RootInlineBox::setLineBreakInfo(LayoutObject* obj, unsigned breakPos, const
|
| // This has security implications because if the LayoutObject does not
|
| // point to at least one line box, then that RenderInline can be deleted
|
| // later without resetting the lineBreakObj, leading to use-after-free.
|
| - ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj->isText() || !(obj->isRenderInline() && obj->isBox() && !toRenderBox(obj)->inlineBoxWrapper()));
|
| + ASSERT_WITH_SECURITY_IMPLICATION(!obj || obj->isText() || !(obj->isRenderInline() && obj->isBox() && !toLayoutBox(obj)->inlineBoxWrapper()));
|
|
|
| m_lineBreakObj = obj;
|
| m_lineBreakPos = breakPos;
|
|
|