1 files changed, 45 insertions, 36 deletions

diff --git a/Source/WebCore/rendering/InlineElementBox.cpp b/Source/WebCore/rendering/InlineElementBox.cpp
index 179f27d0a..680cb6b09 100644
--- a/Source/WebCore/rendering/InlineElementBox.cpp
+++ b/Source/WebCore/rendering/InlineElementBox.cpp
@@ -37,10 +37,10 @@ namespace WebCore {
 void InlineElementBox::deleteLine()
 {
     if (!extracted()) {
-        if (renderer().isBox())
-            toRenderBox(renderer()).setInlineBoxWrapper(nullptr);
-        else if (renderer().isLineBreak())
-            toRenderLineBreak(renderer()).setInlineBoxWrapper(nullptr);
+        if (is<RenderBox>(renderer()))
+            downcast<RenderBox>(renderer()).setInlineBoxWrapper(nullptr);
+        else if (is<RenderLineBreak>(renderer()))
+            downcast<RenderLineBreak>(renderer()).setInlineBoxWrapper(nullptr);
     }
     delete this;
 }
@@ -48,57 +48,66 @@ void InlineElementBox::deleteLine()
 void InlineElementBox::extractLine()
 {
     setExtracted(true);
-    if (renderer().isBox())
-        toRenderBox(renderer()).setInlineBoxWrapper(nullptr);
-    else if (renderer().isLineBreak())
-        toRenderLineBreak(renderer()).setInlineBoxWrapper(nullptr);
+    if (is<RenderBox>(renderer()))
+        downcast<RenderBox>(renderer()).setInlineBoxWrapper(nullptr);
+    else if (is<RenderLineBreak>(renderer()))
+        downcast<RenderLineBreak>(renderer()).setInlineBoxWrapper(nullptr);
 }
 
 void InlineElementBox::attachLine()
 {
     setExtracted(false);
-    if (renderer().isBox())
-        toRenderBox(renderer()).setInlineBoxWrapper(this);
-    else if (renderer().isLineBreak())
-        toRenderLineBreak(renderer()).setInlineBoxWrapper(this);
+    if (is<RenderBox>(renderer()))
+        downcast<RenderBox>(renderer()).setInlineBoxWrapper(this);
+    else if (is<RenderLineBreak>(renderer()))
+        downcast<RenderLineBreak>(renderer()).setInlineBoxWrapper(this);
 }
 
 void InlineElementBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
 {
-    if (!paintInfo.shouldPaintWithinRoot(renderer()) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
+    if (!paintInfo.shouldPaintWithinRoot(renderer()))
+        return;
+
+    if (renderer().isAnonymousInlineBlock()) {
+        // Treat painting of a special inline-block line like the painting of a normal block and go through all phases.
+        PaintPhase newPhase = (paintInfo.phase == PaintPhaseChildOutlines) ? PaintPhaseOutline : paintInfo.phase;
+        newPhase = (newPhase == PaintPhaseChildBlockBackgrounds) ? PaintPhaseChildBlockBackground : newPhase;
+        
+        PaintInfo info(paintInfo);
+        info.phase = newPhase;
+        info.updateSubtreePaintRootForChildren(&renderer());
+        ASSERT(!renderer().hasSelfPaintingLayer());
+        renderer().paint(info, paintOffset);
+        return;
+    }
+
+    if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection)
         return;
 
     LayoutPoint childPoint = paintOffset;
-    if (renderer().isBox() && parent()->renderer().style().isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
-        childPoint = renderer().containingBlock()->flipForWritingModeForChild(&toRenderBox(renderer()), childPoint);
+    if (is<RenderBox>(renderer()) && parent()->renderer().style().isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
+        childPoint = renderer().containingBlock()->flipForWritingModeForChild(&downcast<RenderBox>(renderer()), childPoint);
 
-    // Paint all phases of replaced elements atomically, as though the replaced element established its
-    // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
-    // specification.)
-    bool preservePhase = paintInfo.phase == PaintPhaseSelection || paintInfo.phase == PaintPhaseTextClip;
-    PaintInfo info(paintInfo);
-    info.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
-    renderer().paint(info, childPoint);
-    if (!preservePhase) {
-        info.phase = PaintPhaseChildBlockBackgrounds;
-        renderer().paint(info, childPoint);
-        info.phase = PaintPhaseFloat;
-        renderer().paint(info, childPoint);
-        info.phase = PaintPhaseForeground;
-        renderer().paint(info, childPoint);
-        info.phase = PaintPhaseOutline;
-        renderer().paint(info, childPoint);
-    }
+    renderer().paintAsInlineBlock(paintInfo, childPoint);
 }
 
-bool InlineElementBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/)
+bool InlineElementBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit /* lineTop */, LayoutUnit /*lineBottom*/,
+    HitTestAction hitTestAction)
 {
-    // Hit test all phases of replaced elements atomically, as though the replaced element established its
+    // If we are an anonymous inline block, honor hit test phases.
+    if (renderer().isAnonymousInlineBlock()) {
+        HitTestAction childHitTest = hitTestAction;
+        if (hitTestAction == HitTestChildBlockBackgrounds)
+            childHitTest = HitTestChildBlockBackground;
+        return renderer().nodeAtPoint(request, result, locationInContainer, accumulatedOffset, childHitTest);
+    }
+
+    // Otherwise hit test all phases of replaced elements atomically, as though the replaced element established its
     // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
     // specification.)
     LayoutPoint childPoint = accumulatedOffset;
-    if (renderer().isBox() && parent()->renderer().style().isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
-        childPoint = renderer().containingBlock()->flipForWritingModeForChild(&toRenderBox(renderer()), childPoint);
+    if (is<RenderBox>(renderer()) && parent()->renderer().style().isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
+        childPoint = renderer().containingBlock()->flipForWritingModeForChild(&downcast<RenderBox>(renderer()), childPoint);
 
     return renderer().hitTest(request, result, locationInContainer, childPoint);
 }