Crash under TextBoxPainter<WebCore::InlineIterator::BoxModernPath>::c…

…ollectDecoratingBoxesForTextBox

https://bugs.webkit.org/show_bug.cgi?id=264728
rdar://117897402

Reviewed by Alan Baradlay.

* Source/WebCore/rendering/TextBoxPainter.cpp:
(WebCore::TextBoxPainter<TextBoxPath>::collectDecoratingBoxesForTextBox):

There appears to be some case where parentInlineBox is not found. Add null checking.

Canonical link: https://commits.webkit.org/270634@main

Source/WebCore/rendering/TextBoxPainter.cpp

@@ -557,6 +557,11 @@ template<typename TextBoxPath>
 void TextBoxPainter<TextBoxPath>::collectDecoratingBoxesForTextBox(DecoratingBoxList& decoratingBoxList, const InlineIterator::TextBoxIterator& textBox, FloatPoint textBoxLocation, const TextDecorationPainter::Styles& overrideDecorationStyle)
 {
     auto ancestorInlineBox = textBox->parentInlineBox();
+    if (!ancestorInlineBox) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
     // FIXME: Vertical writing mode needs some coordinate space transformation for parent inline boxes as we rotate the content with m_paintRect (see ::paint)
     if (ancestorInlineBox->isRootInlineBox() || !textBox->isHorizontal()) {
         decoratingBoxList.append({
@@ -594,6 +599,10 @@ void TextBoxPainter<TextBoxPath>::collectDecoratingBoxesForTextBox(DecoratingBox
     appendIfIsDecoratingBoxForBackground(ancestorInlineBox, UseOverriderDecorationStyle::Yes);
     while (!ancestorInlineBox->isRootInlineBox()) {
         ancestorInlineBox = ancestorInlineBox->parentInlineBox();
+        if (!ancestorInlineBox) {
+            ASSERT_NOT_REACHED();
+            break;
+        }
         appendIfIsDecoratingBoxForBackground(ancestorInlineBox, UseOverriderDecorationStyle::No);
     }
 }