Cherry-pick 272448.26@safari-7618-branch (6eed834). https://bugs.webk…

…it.org/show_bug.cgi?id=267270

    Out-of-flow line break box does not initiate render layer
    https://bugs.webkit.org/show_bug.cgi?id=267270
    rdar://120662818

    Reviewed by Antti Koivisto.

    1. Let's not assume that an out-of-flow box is a type of RenderBox (e.g. line break)
    2. Not all out-of-flow positioned boxes trigger layers.

    * LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break-expected.txt: Added.
    * LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break.html: Added.
    * Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
    (WebCore::LayoutIntegration::LineLayout::shiftLinesBy):

    Canonical link: https://commits.webkit.org/272448.26@safari-7618-branch

Canonical link: https://commits.webkit.org/274313.57@webkitglib/2.44

LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break-expected.txt

@@ -0,0 +1,2 @@
+
+PASS if no crash or assert

LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break.html

@@ -0,0 +1,13 @@
+<style>
+br {
+  position: fixed;
+}
+body {
+  -webkit-align-content: flex-end;
+}
+</style><br>
+<div>PASS if no crash or assert</div>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+</script>

Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp

@@ -1019,8 +1019,9 @@ void LineLayout::shiftLinesBy(LayoutUnit blockShift)
     for (auto& object : m_boxTree.renderers()) {
         Layout::Box& layoutBox = *object->layoutBox();
         if (layoutBox.isOutOfFlowPositioned() && layoutBox.style().hasStaticBlockPosition(isHorizontalWritingMode)) {
-            CheckedRef renderer = downcast<RenderBox>(m_boxTree.rendererForLayoutBox(layoutBox));
-            ASSERT(renderer->layer());
+            CheckedRef renderer = downcast<RenderLayerModelObject>(m_boxTree.rendererForLayoutBox(layoutBox));
+            if (!renderer->layer())
+                continue;
             CheckedRef layer = *renderer->layer();
             layer->setStaticBlockPosition(layer->staticBlockPosition() + blockShift);
             renderer->setChildNeedsLayout(MarkOnlyThis);