REGRESSION: ASSERTION FAILED: obj->isRenderInline() || obj == this, Bad cast in WebCo...

[WebKit-https.git] / Source / WebCore / rendering / RenderInline.cpp

diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 2c5426c2e1aade18698dd01002bbd2e7931a9bec..3204dd18ad177cdd5b2472068f5482ce662b1ee1 100644 (file)
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -32,6 +32,7 @@
 #include "RenderArena.h"
 #include "RenderBlock.h"
 #include "RenderFlowThread.h"
+#include "RenderFullScreen.h"
 #include "RenderGeometryMap.h"
 #include "RenderLayer.h"
 #include "RenderTheme.h"
@@ -347,6 +348,15 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
     RenderInline* cloneInline = clone();
     cloneInline->setContinuation(oldCont);
 
+    // If we're splitting the inline containing the fullscreened element,
+    // |beforeChild| may be the renderer for the fullscreened element. However,
+    // that renderer is wrapped in a RenderFullScreen, so |this| is not its
+    // parent. Since the splitting logic expects |this| to be the parent, set
+    // |beforeChild| to be the RenderFullScreen.
+    const Element* fullScreenElement = document()->webkitCurrentFullScreenElement();
+    if (fullScreenElement && beforeChild && beforeChild->node() == fullScreenElement)
+        beforeChild = document()->fullScreenRenderer();
+
     // Now take all of the children from beforeChild to the end and remove
     // them from |this| and place them in the clone.
     RenderObject* o = beforeChild;