Some more assorted downcast<> cleanup in WebCore

https://bugs.webkit.org/show_bug.cgi?id=270782

Reviewed by Charlie Wolfe.

For security & performance.

* Source/WebCore/history/CachedFrame.cpp:
(WebCore::CachedFrame::CachedFrame):
* Source/WebCore/rendering/RenderFragmentedFlow.h:
* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::canMergeContiguousAnonymousBlocks):

Canonical link: https://commits.webkit.org/275961@main

Source/WebCore/history/CachedFrame.cpp

@@ -184,7 +184,8 @@ CachedFrame::CachedFrame(Frame& frame)
         document->suspend(ReasonForSuspension::BackForwardCache);
     }
 
-    m_cachedFrameScriptData = is<LocalFrame>(frame) ? makeUnique<ScriptCachedFrameData>(downcast<LocalFrame>(frame)) : nullptr;
+    RefPtr localFrame = dynamicDowncast<LocalFrame>(frame);
+    m_cachedFrameScriptData = localFrame ? makeUnique<ScriptCachedFrameData>(*localFrame) : nullptr;
 
     if (document)
         document->protectedWindow()->suspendForBackForwardCache();
@@ -195,7 +196,6 @@ CachedFrame::CachedFrame(Frame& frame)
         localFrameView->resetLayoutMilestones();
 
     // The main frame is reused for the navigation and the opener link to its should thus persist.
-    RefPtr localFrame = dynamicDowncast<LocalFrame>(frame);
     if (localFrame) {
         CheckedRef frameLoader = localFrame->loader();
         if (!frame.isMainFrame())

Source/WebCore/rendering/RenderFragmentedFlow.h

@@ -60,7 +60,11 @@ class RenderFragmentedFlow: public RenderBlockFlow {
 
     virtual void removeFlowChildInfo(RenderElement&);
 #ifndef NDEBUG
-    bool hasChildInfo(RenderObject* child) const { return is<RenderBox>(child) && m_fragmentRangeMap.contains(downcast<RenderBox>(child)); }
+    bool hasChildInfo(RenderObject* child) const
+    {
+        auto* renderBox = dynamicDowncast<RenderBox>(child);
+        return renderBox && m_fragmentRangeMap.contains(*renderBox);
+    }
 #endif
 
 #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED

Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp

@@ -55,7 +55,7 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject& oldChild, RenderObje
     if (oldChild.isInline())
         return false;
 
-    if (is<RenderBoxModelObject>(oldChild) && downcast<RenderBoxModelObject>(oldChild).continuation())
+    if (auto* boxModelObject = dynamicDowncast<RenderBoxModelObject>(oldChild); boxModelObject && boxModelObject->continuation())
         return false;
 
     if (previous) {