Out-of-flow line break box does not initiate render layer

https://bugs.webkit.org/show_bug.cgi?id=267270
rdar://120662818

Reviewed by Antti Koivisto.

1. Let's not assume that an out-of-flow box is a type of RenderBox (e.g. line break)
2. Not all out-of-flow positioned boxes trigger layers.

* LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break-expected.txt: Added.
* LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break.html: Added.
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::shiftLinesBy):

Originally-landed-as: 272448.26@safari-7618-branch (6eed834). rdar://124557101
Canonical link: https://commits.webkit.org/276181@main

LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break-expected.txt

@@ -0,0 +1,2 @@
+
+PASS if no crash or assert

LayoutTests/fast/text/align-line-shift-crash-with-positioned-line-break.html

@@ -0,0 +1,13 @@
+<style>
+br {
+  position: fixed;
+}
+body {
+  -webkit-align-content: flex-end;
+}
+</style><br>
+<div>PASS if no crash or assert</div>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+</script>

Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp

@@ -1037,8 +1037,9 @@ void LineLayout::shiftLinesBy(LayoutUnit blockShift)
     for (auto& object : m_boxTree.renderers()) {
         Layout::Box& layoutBox = *object->layoutBox();
         if (layoutBox.isOutOfFlowPositioned() && layoutBox.style().hasStaticBlockPosition(isHorizontalWritingMode)) {
-            CheckedRef renderer = downcast<RenderBox>(m_boxTree.rendererForLayoutBox(layoutBox));
-            ASSERT(renderer->layer());
+            CheckedRef renderer = downcast<RenderLayerModelObject>(m_boxTree.rendererForLayoutBox(layoutBox));
+            if (!renderer->layer())
+                continue;
             CheckedRef layer = *renderer->layer();
             layer->setStaticBlockPosition(layer->staticBlockPosition() + blockShift);
             renderer->setChildNeedsLayout(MarkOnlyThis);