diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index edffd2e..90b7784 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,13 @@
+2013-10-22  Sam Weinig  <sam@webkit.org>
+
+        CTTE: Modernize RenderBlock a bit
+        https://bugs.webkit.org/show_bug.cgi?id=123162
+
+        Reviewed by Andreas Kling.
+
+        Start threading references through RenderBlock. While we 
+        are here, do some selective modernization as well.
+
 2013-10-22  Andreas Kling  <akling@apple.com>
 
         Even more PassRef<RenderStyle>!
diff --git a/Source/WebCore/rendering/InlineIterator.h b/Source/WebCore/rendering/InlineIterator.h
index 4cc7e05..bc309ff 100644
--- a/Source/WebCore/rendering/InlineIterator.h
+++ b/Source/WebCore/rendering/InlineIterator.h
@@ -196,7 +196,7 @@
 // This function will iterate over inlines within a block, optionally notifying
 // a bidi resolver as it enters/exits inlines (so it can push/pop embedding levels).
 template <class Observer>
-static inline RenderObject* bidiNextShared(RenderElement* root, RenderObject* current, Observer* observer = 0, EmptyInlineBehavior emptyInlineBehavior = SkipEmptyInlines, bool* endOfInlinePtr = 0)
+static inline RenderObject* bidiNextShared(RenderElement& root, RenderObject* current, Observer* observer = 0, EmptyInlineBehavior emptyInlineBehavior = SkipEmptyInlines, bool* endOfInlinePtr = 0)
 {
     RenderObject* next = 0;
     // oldEndOfInline denotes if when we last stopped iterating if we were at the end of an inline.
@@ -219,7 +219,7 @@
                 break;
             }
 
-            while (current && current != root) {
+            while (current && current != &root) {
                 notifyObserverWillExitObject(observer, current);
 
                 next = current->nextSibling();
@@ -229,7 +229,7 @@
                 }
 
                 current = current->parent();
-                if (emptyInlineBehavior == IncludeEmptyInlines && current && current != root && current->isRenderInline()) {
+                if (emptyInlineBehavior == IncludeEmptyInlines && current && current != &root && current->isRenderInline()) {
                     next = current;
                     endOfInline = true;
                     break;
@@ -253,30 +253,30 @@
 }
 
 template <class Observer>
-static inline RenderObject* bidiNextSkippingEmptyInlines(RenderElement* root, RenderObject* current, Observer* observer)
+static inline RenderObject* bidiNextSkippingEmptyInlines(RenderElement& root, RenderObject* current, Observer* observer)
 {
     // The SkipEmptyInlines callers never care about endOfInlinePtr.
     return bidiNextShared(root, current, observer, SkipEmptyInlines);
 }
 
 // This makes callers cleaner as they don't have to specify a type for the observer when not providing one.
-static inline RenderObject* bidiNextSkippingEmptyInlines(RenderElement* root, RenderObject* current)
+static inline RenderObject* bidiNextSkippingEmptyInlines(RenderElement& root, RenderObject* current)
 {
     InlineBidiResolver* observer = 0;
     return bidiNextSkippingEmptyInlines(root, current, observer);
 }
 
-static inline RenderObject* bidiNextIncludingEmptyInlines(RenderElement* root, RenderObject* current, bool* endOfInlinePtr = 0)
+static inline RenderObject* bidiNextIncludingEmptyInlines(RenderElement& root, RenderObject* current, bool* endOfInlinePtr = 0)
 {
     InlineBidiResolver* observer = 0; // Callers who include empty inlines, never use an observer.
     return bidiNextShared(root, current, observer, IncludeEmptyInlines, endOfInlinePtr);
 }
 
-static inline RenderObject* bidiFirstSkippingEmptyInlines(RenderElement* root, InlineBidiResolver* resolver = 0)
+static inline RenderObject* bidiFirstSkippingEmptyInlines(RenderElement& root, InlineBidiResolver* resolver = 0)
 {
-    RenderObject* o = root->firstChild();
+    RenderObject* o = root.firstChild();
     if (!o)
-        return 0;
+        return nullptr;
 
     if (o->isRenderInline()) {
         notifyObserverEnteredObject(resolver, o);
@@ -300,9 +300,9 @@
 }
 
 // FIXME: This method needs to be renamed when bidiNext finds a good name.
-static inline RenderObject* bidiFirstIncludingEmptyInlines(RenderElement* root)
+static inline RenderObject* bidiFirstIncludingEmptyInlines(RenderElement& root)
 {
-    RenderObject* o = root->firstChild();
+    RenderObject* o = root.firstChild();
     // If either there are no children to walk, or the first one is correct
     // then just return it.
     if (!o || o->isRenderInline() || isIteratorTarget(o))
@@ -323,7 +323,7 @@
 // it shouldn't use functions called bidiFirst and bidiNext.
 class InlineWalker {
 public:
-    InlineWalker(RenderElement* root)
+    InlineWalker(RenderElement& root)
         : m_root(root)
         , m_current(0)
         , m_atEndOfInline(false)
@@ -332,7 +332,7 @@
         m_current = bidiFirstIncludingEmptyInlines(m_root);
     }
 
-    RenderElement* root() { return m_root; }
+    RenderElement& root() { return m_root; }
     RenderObject* current() { return m_current; }
 
     bool atEndOfInline() { return m_atEndOfInline; }
@@ -345,7 +345,7 @@
         return m_current;
     }
 private:
-    RenderElement* m_root;
+    RenderElement& m_root;
     RenderObject* m_current;
     bool m_atEndOfInline;
 };
@@ -360,7 +360,7 @@
             return;
     }
     // bidiNext can return 0, so use moveTo instead of moveToStartOf
-    moveTo(bidiNextSkippingEmptyInlines(m_root, m_obj, resolver), 0);
+    moveTo(bidiNextSkippingEmptyInlines(*m_root, m_obj, resolver), 0);
 }
 
 inline bool InlineIterator::atEnd() const
@@ -524,7 +524,7 @@
                 RenderBlockFlow::appendRunsForObject(m_runs, start, obj->length(), obj, *this);
             // FIXME: start/obj should be an InlineIterator instead of two separate variables.
             start = 0;
-            obj = bidiNextSkippingEmptyInlines(m_sor.root(), obj, &isolateTracker);
+            obj = bidiNextSkippingEmptyInlines(*m_sor.root(), obj, &isolateTracker);
         }
         if (obj) {
             unsigned pos = obj == m_eor.m_obj ? m_eor.m_pos : UINT_MAX;
diff --git a/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h b/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h
index b9a26cc..0225b24 100644
--- a/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h
+++ b/Source/WebCore/rendering/LogicalSelectionOffsetCaches.h
@@ -25,19 +25,19 @@
 
 namespace WebCore {
 
-static inline bool isContainingBlockCandidateForAbsolutelyPositionedObject(RenderElement* object)
+static inline bool isContainingBlockCandidateForAbsolutelyPositionedObject(RenderElement& object)
 {
-    return object->style()->position() != StaticPosition
-        || (object->hasTransform() && object->isRenderBlock())
+    return object.style()->position() != StaticPosition
+        || (object.hasTransform() && object.isRenderBlock())
 #if ENABLE(SVG)
-        || object->isSVGForeignObject()
+        || object.isSVGForeignObject()
 #endif
-        || object->isRenderView();
+        || object.isRenderView();
 }
 
-static inline bool isNonRenderBlockInline(RenderElement* object)
+static inline bool isNonRenderBlockInline(RenderElement& object)
 {
-    return (object->isInline() && !object->isReplaced()) || !object->isRenderBlock();
+    return (object.isInline() && !object.isReplaced()) || !object.isRenderBlock();
 }
 
 static inline RenderElement* containingBlockForFixedPosition(RenderElement* parent)
@@ -52,7 +52,7 @@
 static inline RenderElement* containingBlockForAbsolutePosition(RenderElement* parent)
 {
     RenderElement* object = parent;
-    while (object && !isContainingBlockCandidateForAbsolutelyPositionedObject(object))
+    while (object && !isContainingBlockCandidateForAbsolutelyPositionedObject(*object))
         object = object->parent();
 
     // For a relatively positioned inline, return its nearest non-anonymous containing block,
@@ -71,7 +71,7 @@
 static inline RenderElement* containingBlockForObjectInFlow(RenderElement* parent)
 {
     RenderElement* object = parent;
-    while (object && isNonRenderBlockInline(object))
+    while (object && isNonRenderBlockInline(*object))
         object = object->parent();
     return object;
 }
@@ -100,7 +100,7 @@
         RenderBlock* block() const { return m_block; }
         const LogicalSelectionOffsetCaches* cache() const { return m_cache; }
 
-        LayoutUnit logicalLeftSelectionOffset(RenderBlock* rootBlock, LayoutUnit position) const
+        LayoutUnit logicalLeftSelectionOffset(RenderBlock& rootBlock, LayoutUnit position) const
         {
             ASSERT(m_cache);
             if (m_hasFloatsOrFlowThreads || !m_cachedLogicalLeftSelectionOffset) {
@@ -111,7 +111,7 @@
             return m_logicalLeftSelectionOffset;
         }
 
-        LayoutUnit logicalRightSelectionOffset(RenderBlock* rootBlock, LayoutUnit position) const
+        LayoutUnit logicalRightSelectionOffset(RenderBlock& rootBlock, LayoutUnit position) const
         {
             ASSERT(m_cache);
             if (m_hasFloatsOrFlowThreads || !m_cachedLogicalRightSelectionOffset) {
@@ -133,10 +133,10 @@
         
     };
 
-    explicit LogicalSelectionOffsetCaches(RenderBlock* rootBlock)
+    explicit LogicalSelectionOffsetCaches(RenderBlock& rootBlock)
     {
-        ASSERT(rootBlock->isSelectionRoot());
-        auto parent = rootBlock->parent();
+        ASSERT(rootBlock.isSelectionRoot());
+        auto parent = rootBlock.parent();
 
         // LogicalSelectionOffsetCaches should not be used on an orphaned tree.
         m_containingBlockForFixedPosition.setBlock(toRenderBlock(containingBlockForFixedPosition(parent)), 0);
@@ -144,31 +144,31 @@
         m_containingBlockForInflowPosition.setBlock(toRenderBlock(containingBlockForObjectInFlow(parent)), 0);
     }
 
-    LogicalSelectionOffsetCaches(RenderBlock* block, const LogicalSelectionOffsetCaches& cache)
+    LogicalSelectionOffsetCaches(RenderBlock& block, const LogicalSelectionOffsetCaches& cache)
         : m_containingBlockForFixedPosition(cache.m_containingBlockForFixedPosition)
         , m_containingBlockForAbsolutePosition(cache.m_containingBlockForAbsolutePosition)
     {
-        if (block->canContainFixedPositionObjects())
-            m_containingBlockForFixedPosition.setBlock(block, &cache);
+        if (block.canContainFixedPositionObjects())
+            m_containingBlockForFixedPosition.setBlock(&block, &cache);
 
-        if (isContainingBlockCandidateForAbsolutelyPositionedObject(block) && !block->isRenderInline() && !block->isAnonymousBlock())
-            m_containingBlockForFixedPosition.setBlock(block, &cache);
+        if (isContainingBlockCandidateForAbsolutelyPositionedObject(block) && !block.isRenderInline() && !block.isAnonymousBlock())
+            m_containingBlockForFixedPosition.setBlock(&block, &cache);
 
-        m_containingBlockForInflowPosition.setBlock(block, &cache);
+        m_containingBlockForInflowPosition.setBlock(&block, &cache);
     }
 
-    const ContainingBlockInfo& containingBlockInfo(RenderBlock* block) const
+    const ContainingBlockInfo& containingBlockInfo(RenderBlock& block) const
     {
-        EPosition position = block->style()->position();
+        EPosition position = block.style()->position();
         if (position == FixedPosition) {
-            ASSERT(block->containingBlock() == m_containingBlockForFixedPosition.block());
+            ASSERT(block.containingBlock() == m_containingBlockForFixedPosition.block());
             return m_containingBlockForFixedPosition;
         }
         if (position == AbsolutePosition) {
-            ASSERT(block->containingBlock() == m_containingBlockForAbsolutePosition.block());
+            ASSERT(block.containingBlock() == m_containingBlockForAbsolutePosition.block());
             return m_containingBlockForAbsolutePosition;
         }
-        ASSERT(block->containingBlock() == m_containingBlockForInflowPosition.block());
+        ASSERT(block.containingBlock() == m_containingBlockForInflowPosition.block());
         return m_containingBlockForInflowPosition;
     }
 
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 96a456c..22072bb 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -209,7 +209,7 @@
 
     if (!documentBeingDestroyed()) {
         if (firstChild() && firstChild()->isRunIn())
-            moveRunInToOriginalPosition(firstChild());
+            moveRunInToOriginalPosition(*firstChild());
     }
 
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
@@ -752,7 +752,7 @@
     }
 
     // Nothing goes before the intruded run-in.
-    if (beforeChild && beforeChild->isRunIn() && runInIsPlacedIntoSiblingBlock(beforeChild))
+    if (beforeChild && beforeChild->isRunIn() && runInIsPlacedIntoSiblingBlock(*beforeChild))
         beforeChild = beforeChild->nextSibling();
 
     // Check for a spanning element in columns.
@@ -823,7 +823,7 @@
     RenderBox::addChild(newChild, beforeChild);
  
     // Handle placement of run-ins.
-    placeRunInIfNeeded(newChild);
+    placeRunInIfNeeded(*newChild);
 
     if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isRenderBlock())
         toRenderBlock(parent())->removeLeftoverAnonymousBlock(this);
@@ -892,7 +892,7 @@
         cache->recomputeIsIgnored(this);
 }
 
-void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
+void RenderBlock::makeChildrenNonInline(RenderObject* insertionPoint)
 {    
     // makeChildrenNonInline takes a block whose children are *all* inline and it
     // makes sure that inline children are coalesced under anonymous
@@ -906,7 +906,7 @@
 
     setChildrenInline(false);
 
-    RenderObject *child = firstChild();
+    RenderObject* child = firstChild();
     if (!child)
         return;
 
@@ -915,12 +915,13 @@
     // Since we are going to have block children, we have to move
     // back the run-in to its original place.
     if (child->isRunIn()) {
-        moveRunInToOriginalPosition(child);
+        moveRunInToOriginalPosition(*child);
         child = firstChild();
     }
 
     while (child) {
-        RenderObject *inlineRunStart, *inlineRunEnd;
+        RenderObject* inlineRunStart;
+        RenderObject* inlineRunEnd;
         getInlineRun(child, insertionPoint, inlineRunStart, inlineRunEnd);
 
         if (!inlineRunStart)
@@ -934,7 +935,7 @@
     }
 
 #ifndef NDEBUG
-    for (RenderObject *c = firstChild(); c; c = c->nextSibling())
+    for (RenderObject* c = firstChild(); c; c = c->nextSibling())
         ASSERT(!c->isInline());
 #endif
 
@@ -1590,7 +1591,7 @@
 
 void RenderBlock::addOverflowFromBlockChildren()
 {
-    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+    for (auto child = firstChildBox(); child; child = child->nextSiblingBox()) {
         if (!child->isFloatingOrOutOfFlowPositioned())
             addOverflowFromChild(child);
     }
@@ -1602,10 +1603,8 @@
     if (!positionedDescendants)
         return;
 
-    RenderBox* positionedObject;
-    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
-    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
-        positionedObject = *it;
+    for (auto it = positionedDescendants->begin(), end = positionedDescendants->end(); it != end; ++it) {
+        RenderBox* positionedObject = *it;
         
         // Fixed positioned elements don't contribute to layout overflow, since they don't scroll with the content.
         if (positionedObject->style()->position() != FixedPosition) {
@@ -1636,76 +1635,76 @@
            || hasColumns() || isTableCell() || isTableCaption() || isFieldset() || isWritingModeRoot() || isRoot();
 }
 
-static void destroyRunIn(RenderBoxModelObject* runIn)
+static void destroyRunIn(RenderBoxModelObject& runIn)
 {
-    ASSERT(runIn->isRunIn());
-    ASSERT(!runIn->firstChild());
+    ASSERT(runIn.isRunIn());
+    ASSERT(!runIn.firstChild());
 
     // Delete our line box tree. This is needed as our children got moved
     // and our line box tree is no longer valid.
-    if (runIn->isRenderBlock())
-        toRenderBlock(runIn)->deleteLines();
-    else if (runIn->isRenderInline())
-        toRenderInline(runIn)->deleteLines();
+    if (runIn.isRenderBlock())
+        toRenderBlock(runIn).deleteLines();
+    else if (runIn.isRenderInline())
+        toRenderInline(runIn).deleteLines();
     else
         ASSERT_NOT_REACHED();
 
-    runIn->destroy();
+    runIn.destroy();
 }
 
-void RenderBlock::placeRunInIfNeeded(RenderObject* newChild)
+void RenderBlock::placeRunInIfNeeded(RenderObject& newChild)
 {
-    if (newChild->isRunIn())
+    if (newChild.isRunIn())
         moveRunInUnderSiblingBlockIfNeeded(newChild);
-    else if (RenderObject* prevSibling = newChild->previousSibling()) {
+    else if (RenderObject* prevSibling = newChild.previousSibling()) {
         if (prevSibling->isRunIn())
-            moveRunInUnderSiblingBlockIfNeeded(prevSibling);
+            moveRunInUnderSiblingBlockIfNeeded(*prevSibling);
     }
 }
 
-RenderBoxModelObject* RenderBlock::createReplacementRunIn(RenderBoxModelObject* runIn)
+RenderBoxModelObject& RenderBlock::createReplacementRunIn(RenderBoxModelObject& runIn)
 {
-    ASSERT(runIn->isRunIn());
-    ASSERT(runIn->element());
+    ASSERT(runIn.isRunIn());
+    ASSERT(runIn.element());
 
     RenderBoxModelObject* newRunIn = 0;
-    if (!runIn->isRenderBlockFlow())
-        newRunIn = new RenderBlockFlow(*runIn->element());
+    if (!runIn.isRenderBlockFlow())
+        newRunIn = new RenderBlockFlow(*runIn.element());
     else
-        newRunIn = new RenderInline(*runIn->element());
+        newRunIn = new RenderInline(*runIn.element());
 
-    runIn->element()->setRenderer(newRunIn);
-    newRunIn->setStyle(*runIn->style());
+    runIn.element()->setRenderer(newRunIn);
+    newRunIn->setStyle(*runIn.style());
 
-    runIn->moveAllChildrenTo(newRunIn, true);
+    runIn.moveAllChildrenTo(newRunIn, true);
 
-    return newRunIn;
+    return *newRunIn;
 }
 
-void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
+void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject& runIn)
 {
-    ASSERT(runIn->isRunIn());
+    ASSERT(runIn.isRunIn());
 
     // See if we have inline children. If the children aren't inline,
     // then just treat the run-in as a normal block.
-    if (!runIn->childrenInline())
+    if (!runIn.childrenInline())
         return;
 
     // FIXME: We don't handle non-block elements with run-in for now.
-    if (!runIn->isRenderBlockFlow())
+    if (!runIn.isRenderBlockFlow())
         return;
 
     // FIXME: We don't support run-ins with or as part of a continuation
     // as it makes the back-and-forth placing complex.
-    if (runIn->isElementContinuation() || runIn->virtualContinuation())
+    if (runIn.isElementContinuation() || runIn.virtualContinuation())
         return;
 
     // Check if this node is allowed to run-in. E.g. <select> expects its renderer to
     // be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
-    if (!runIn->canBeReplacedWithInlineRunIn())
+    if (!runIn.canBeReplacedWithInlineRunIn())
         return;
 
-    RenderObject* curr = runIn->nextSibling();
+    RenderObject* curr = runIn.nextSibling();
     if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
         return;
 
@@ -1721,37 +1720,37 @@
     if (nextSiblingBlock.isAnonymous() || nextSiblingBlock.isFloatingOrOutOfFlowPositioned())
         return;
 
-    RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
-    RenderBoxModelObject* newRunIn = createReplacementRunIn(oldRunIn);
+    RenderBoxModelObject& oldRunIn = toRenderBoxModelObject(runIn);
+    RenderBoxModelObject& newRunIn = createReplacementRunIn(oldRunIn);
     destroyRunIn(oldRunIn);
 
     // Now insert the new child under |curr| block. Use addChild instead of insertChildNode
     // since it handles correct placement of the children, especially where we cannot insert
     // anything before the first child. e.g. details tag. See https://bugs.webkit.org/show_bug.cgi?id=58228.
-    nextSiblingBlock.addChild(newRunIn, nextSiblingBlock.firstChild());
+    nextSiblingBlock.addChild(&newRunIn, nextSiblingBlock.firstChild());
 
     // Make sure that |this| get a layout since its run-in child moved.
     nextSiblingBlock.setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-bool RenderBlock::runInIsPlacedIntoSiblingBlock(RenderObject* runIn)
+bool RenderBlock::runInIsPlacedIntoSiblingBlock(RenderObject& runIn)
 {
-    ASSERT(runIn->isRunIn());
+    ASSERT(runIn.isRunIn());
 
     // If we don't have a parent, we can't be moved into our sibling block.
     if (!parent())
         return false;
 
     // An intruded run-in needs to be an inline.
-    if (!runIn->isRenderInline())
+    if (!runIn.isRenderInline())
         return false;
 
     return true;
 }
 
-void RenderBlock::moveRunInToOriginalPosition(RenderObject* runIn)
+void RenderBlock::moveRunInToOriginalPosition(RenderObject& runIn)
 {
-    ASSERT(runIn->isRunIn());
+    ASSERT(runIn.isRunIn());
 
     if (!runInIsPlacedIntoSiblingBlock(runIn))
         return;
@@ -1761,21 +1760,21 @@
     // original place since that requires writing integration logic with RenderInline::addChild
     // and all other places that might cause continuations to be created (without blowing away
     // |this|). Disabling this feature for now to prevent crashes.
-    if (runIn->isElementContinuation() || runIn->virtualContinuation())
+    if (runIn.isElementContinuation() || runIn.virtualContinuation())
         return;
 
-    RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
-    RenderBoxModelObject* newRunIn = createReplacementRunIn(oldRunIn);
+    RenderBoxModelObject& oldRunIn = toRenderBoxModelObject(runIn);
+    RenderBoxModelObject& newRunIn = createReplacementRunIn(oldRunIn);
     destroyRunIn(oldRunIn);
 
     // Add the run-in block as our previous sibling.
-    parent()->addChild(newRunIn, this);
+    parent()->addChild(&newRunIn, this);
 
     // Make sure that the parent holding the new run-in gets layout.
     parent()->setNeedsLayoutAndPrefWidthsRecalc();
 }
 
-LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const RenderBox* child, LayoutUnit childMarginStart, RenderRegion* region)
+LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const RenderBox& child, LayoutUnit childMarginStart, RenderRegion* region)
 {
     LayoutUnit startPosition = startOffsetForContent(region);
 
@@ -1789,7 +1788,7 @@
 
     LayoutUnit startOff = startOffsetForLine(blockOffset, false, region, logicalHeightForChild(child));
 
-    if (style()->textAlign() != WEBKIT_CENTER && !child->style()->marginStartUsing(style()).isAuto()) {
+    if (style()->textAlign() != WEBKIT_CENTER && !child.style()->marginStartUsing(style()).isAuto()) {
         if (childMarginStart < 0)
             startOff += childMarginStart;
         newPosition = max(newPosition, startOff); // Let the float sit in the child's margin if it can fit.
@@ -1799,7 +1798,7 @@
     return newPosition - oldPosition;
 }
 
-void RenderBlock::determineLogicalLeftPositionForChild(RenderBox* child, ApplyLayoutDeltaMode applyDelta)
+void RenderBlock::determineLogicalLeftPositionForChild(RenderBox& child, ApplyLayoutDeltaMode applyDelta)
 {
     LayoutUnit startPosition = borderStart() + paddingStart();
     if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
@@ -1812,48 +1811,48 @@
         
     // Some objects (e.g., tables, horizontal rules, overflow:auto blocks) avoid floats.  They need
     // to shift over as necessary to dodge any floats that might get in the way.
-    if (child->avoidsFloats() && containsFloats() && !flowThreadContainingBlock())
+    if (child.avoidsFloats() && containsFloats() && !flowThreadContainingBlock())
         newPosition += computeStartPositionDeltaForChildAvoidingFloats(child, marginStartForChild(child));
 
     setLogicalLeftForChild(child, style()->isLeftToRightDirection() ? newPosition : totalAvailableLogicalWidth - newPosition - logicalWidthForChild(child), applyDelta);
 }
 
-void RenderBlock::setLogicalLeftForChild(RenderBox* child, LayoutUnit logicalLeft, ApplyLayoutDeltaMode applyDelta)
+void RenderBlock::setLogicalLeftForChild(RenderBox& child, LayoutUnit logicalLeft, ApplyLayoutDeltaMode applyDelta)
 {
     if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
-            view().addLayoutDelta(LayoutSize(child->x() - logicalLeft, 0));
-        child->setX(logicalLeft);
+            view().addLayoutDelta(LayoutSize(child.x() - logicalLeft, 0));
+        child.setX(logicalLeft);
     } else {
         if (applyDelta == ApplyLayoutDelta)
-            view().addLayoutDelta(LayoutSize(0, child->y() - logicalLeft));
-        child->setY(logicalLeft);
+            view().addLayoutDelta(LayoutSize(0, child.y() - logicalLeft));
+        child.setY(logicalLeft);
     }
 }
 
-void RenderBlock::setLogicalTopForChild(RenderBox* child, LayoutUnit logicalTop, ApplyLayoutDeltaMode applyDelta)
+void RenderBlock::setLogicalTopForChild(RenderBox& child, LayoutUnit logicalTop, ApplyLayoutDeltaMode applyDelta)
 {
     if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
-            view().addLayoutDelta(LayoutSize(0, child->y() - logicalTop));
-        child->setY(logicalTop);
+            view().addLayoutDelta(LayoutSize(0, child.y() - logicalTop));
+        child.setY(logicalTop);
     } else {
         if (applyDelta == ApplyLayoutDelta)
-            view().addLayoutDelta(LayoutSize(child->x() - logicalTop, 0));
-        child->setX(logicalTop);
+            view().addLayoutDelta(LayoutSize(child.x() - logicalTop, 0));
+        child.setX(logicalTop);
     }
 }
 
-void RenderBlock::updateBlockChildDirtyBitsBeforeLayout(bool relayoutChildren, RenderBox* child)
+void RenderBlock::updateBlockChildDirtyBitsBeforeLayout(bool relayoutChildren, RenderBox& child)
 {
     // FIXME: Technically percentage height objects only need a relayout if their percentage isn't going to be turned into
     // an auto value. Add a method to determine this, so that we can avoid the relayout.
-    if (relayoutChildren || (child->hasRelativeLogicalHeight() && !isRenderView()) || child->hasViewportPercentageLogicalHeight())
-        child->setChildNeedsLayout(MarkOnlyThis);
+    if (relayoutChildren || (child.hasRelativeLogicalHeight() && !isRenderView()) || child.hasViewportPercentageLogicalHeight())
+        child.setChildNeedsLayout(MarkOnlyThis);
 
     // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
-    if (relayoutChildren && child->needsPreferredWidthsRecalculation())
-        child->setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
+    if (relayoutChildren && child.needsPreferredWidthsRecalculation())
+        child.setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
 }
 
 void RenderBlock::dirtyForLayoutFromPercentageHeightDescendants()
@@ -1864,9 +1863,8 @@
     TrackedRendererListHashSet* descendants = gPercentHeightDescendantsMap->get(this);
     if (!descendants)
         return;
-    
-    TrackedRendererListHashSet::iterator end = descendants->end();
-    for (TrackedRendererListHashSet::iterator it = descendants->begin(); it != end; ++it) {
+
+    for (auto it = descendants->begin(), end = descendants->end(); it != end; ++it) {
         RenderBox* box = *it;
         while (box != this) {
             if (box->normalChildNeedsLayout())
@@ -1891,7 +1889,7 @@
 {
     if (childrenInline()) {
         ListHashSet<RootInlineBox*> lineBoxes;
-        for (InlineWalker walker(this); !walker.atEnd(); walker.advance()) {
+        for (InlineWalker walker(*this); !walker.atEnd(); walker.advance()) {
             RenderObject* o = walker.current();
             if (!o->isOutOfFlowPositioned() && (o->isReplaced() || o->isFloating())) {
                 RenderBox& box = toRenderBox(*o);
@@ -1905,12 +1903,12 @@
         // FIXME: Glyph overflow will get lost in this case, but not really a big deal.
         // FIXME: Find a way to invalidate the knownToHaveNoOverflow flag on the InlineBoxes.
         GlyphOverflowAndFallbackFontsMap textBoxDataMap;                  
-        for (ListHashSet<RootInlineBox*>::const_iterator it = lineBoxes.begin(); it != lineBoxes.end(); ++it) {
+        for (auto it = lineBoxes.begin(), end = lineBoxes.end(); it != end; ++it) {
             RootInlineBox* box = *it;
             box->computeOverflow(box->lineTop(), box->lineBottom(), textBoxDataMap);
         }
     } else {
-        for (RenderBox* box = firstChildBox(); box; box = box->nextSiblingBox()) {
+        for (auto box = firstChildBox(); box; box = box->nextSiblingBox()) {
             if (!box->isOutOfFlowPositioned())
                 box->layoutIfNeeded();
         }
@@ -1965,34 +1963,34 @@
     return true;
 }
 
-void RenderBlock::markFixedPositionObjectForLayoutIfNeeded(RenderObject* child)
+void RenderBlock::markFixedPositionObjectForLayoutIfNeeded(RenderObject& child)
 {
-    if (child->style()->position() != FixedPosition)
+    if (child.style()->position() != FixedPosition)
         return;
 
-    bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontalWritingMode());
-    bool hasStaticInlinePosition = child->style()->hasStaticInlinePosition(isHorizontalWritingMode());
+    bool hasStaticBlockPosition = child.style()->hasStaticBlockPosition(isHorizontalWritingMode());
+    bool hasStaticInlinePosition = child.style()->hasStaticInlinePosition(isHorizontalWritingMode());
     if (!hasStaticBlockPosition && !hasStaticInlinePosition)
         return;
 
-    auto o = child->parent();
+    auto o = child.parent();
     while (o && !o->isRenderView() && o->style()->position() != AbsolutePosition)
         o = o->parent();
     if (o->style()->position() != AbsolutePosition)
         return;
 
-    RenderBox* box = toRenderBox(child);
+    RenderBox& box = toRenderBox(child);
     if (hasStaticInlinePosition) {
         LogicalExtentComputedValues computedValues;
-        box->computeLogicalWidthInRegion(computedValues);
+        box.computeLogicalWidthInRegion(computedValues);
         LayoutUnit newLeft = computedValues.m_position;
-        if (newLeft != box->logicalLeft())
-            box->setChildNeedsLayout(MarkOnlyThis);
+        if (newLeft != box.logicalLeft())
+            box.setChildNeedsLayout(MarkOnlyThis);
     } else if (hasStaticBlockPosition) {
-        LayoutUnit oldTop = box->logicalTop();
-        box->updateLogicalHeight();
-        if (box->logicalTop() != oldTop)
-            box->setChildNeedsLayout(MarkOnlyThis);
+        LayoutUnit oldTop = box.logicalTop();
+        box.updateLogicalHeight();
+        if (box.logicalTop() != oldTop)
+            box.setChildNeedsLayout(MarkOnlyThis);
     }
 }
 
@@ -2005,10 +2003,8 @@
     if (hasColumns())
         view().layoutState()->clearPaginationInformation(); // Positioned objects are not part of the column flow, so they don't paginate with the columns.
 
-    RenderBox* r;
-    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
-    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
-        r = *it;
+    for (auto it = positionedDescendants->begin(), end = positionedDescendants->end(); it != end; ++it) {
+        RenderBox& r = **it;
         
         estimateRegionRangeForBoxChild(r);
 
@@ -2017,7 +2013,7 @@
         // it has static position.
         markFixedPositionObjectForLayoutIfNeeded(r);
         if (fixedPositionObjectsOnly) {
-            r->layoutIfNeeded();
+            r.layoutIfNeeded();
             continue;
         }
 
@@ -2025,44 +2021,44 @@
         // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
         // objects that are positioned implicitly like this.  Such objects are rare, and so in typical DHTML menu usage (where everything is
         // positioned explicitly) this should not incur a performance penalty.
-        if (relayoutChildren || (r->style()->hasStaticBlockPosition(isHorizontalWritingMode()) && r->parent() != this))
-            r->setChildNeedsLayout(MarkOnlyThis);
+        if (relayoutChildren || (r.style()->hasStaticBlockPosition(isHorizontalWritingMode()) && r.parent() != this))
+            r.setChildNeedsLayout(MarkOnlyThis);
             
         // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
-        if (relayoutChildren && r->needsPreferredWidthsRecalculation())
-            r->setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
+        if (relayoutChildren && r.needsPreferredWidthsRecalculation())
+            r.setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
         
-        if (!r->needsLayout())
-            r->markForPaginationRelayoutIfNeeded();
+        if (!r.needsLayout())
+            r.markForPaginationRelayoutIfNeeded();
         
         // We don't have to do a full layout.  We just have to update our position. Try that first. If we have shrink-to-fit width
         // and we hit the available width constraint, the layoutIfNeeded() will catch it and do a full layout.
-        if (r->needsPositionedMovementLayoutOnly() && r->tryLayoutDoingPositionedMovementOnly())
-            r->clearNeedsLayout();
+        if (r.needsPositionedMovementLayoutOnly() && r.tryLayoutDoingPositionedMovementOnly())
+            r.clearNeedsLayout();
             
         // If we are paginated or in a line grid, go ahead and compute a vertical position for our object now.
         // If it's wrong we'll lay out again.
         LayoutUnit oldLogicalTop = 0;
-        bool needsBlockDirectionLocationSetBeforeLayout = r->needsLayout() && view().layoutState()->needsBlockDirectionLocationSetBeforeLayout();
+        bool needsBlockDirectionLocationSetBeforeLayout = r.needsLayout() && view().layoutState()->needsBlockDirectionLocationSetBeforeLayout();
         if (needsBlockDirectionLocationSetBeforeLayout) {
-            if (isHorizontalWritingMode() == r->isHorizontalWritingMode())
-                r->updateLogicalHeight();
+            if (isHorizontalWritingMode() == r.isHorizontalWritingMode())
+                r.updateLogicalHeight();
             else
-                r->updateLogicalWidth();
+                r.updateLogicalWidth();
             oldLogicalTop = logicalTopForChild(r);
         }
 
-        r->layoutIfNeeded();
+        r.layoutIfNeeded();
 
         // Lay out again if our estimate was wrong.
         if (needsBlockDirectionLocationSetBeforeLayout && logicalTopForChild(r) != oldLogicalTop) {
-            r->setChildNeedsLayout(MarkOnlyThis);
-            r->layoutIfNeeded();
+            r.setChildNeedsLayout(MarkOnlyThis);
+            r.layoutIfNeeded();
         }
 
         if (updateRegionRangeForBoxChild(r)) {
-            r->setNeedsLayout(MarkOnlyThis);
-            r->layoutIfNeeded();
+            r.setNeedsLayout(MarkOnlyThis);
+            r.layoutIfNeeded();
         }
     }
     
@@ -2073,13 +2069,12 @@
 void RenderBlock::markPositionedObjectsForLayout()
 {
     TrackedRendererListHashSet* positionedDescendants = positionedObjects();
-    if (positionedDescendants) {
-        RenderBox* r;
-        TrackedRendererListHashSet::iterator end = positionedDescendants->end();
-        for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
-            r = *it;
-            r->setChildNeedsLayout();
-        }
+    if (!positionedDescendants)
+        return;
+
+    for (auto it = positionedDescendants->begin(), end = positionedDescendants->end(); it != end; ++it) {
+        RenderBox* r = *it;
+        r->setChildNeedsLayout();
     }
 }
 
@@ -2318,17 +2313,17 @@
 
 void RenderBlock::paintChildren(PaintInfo& paintInfo, const LayoutPoint& paintOffset, PaintInfo& paintInfoForChild, bool usePrintRect)
 {
-    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-        if (!paintChild(child, paintInfo, paintOffset, paintInfoForChild, usePrintRect))
+    for (auto child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        if (!paintChild(*child, paintInfo, paintOffset, paintInfoForChild, usePrintRect))
             return;
     }
 }
 
-bool RenderBlock::paintChild(RenderBox* child, PaintInfo& paintInfo, const LayoutPoint& paintOffset, PaintInfo& paintInfoForChild, bool usePrintRect)
+bool RenderBlock::paintChild(RenderBox& child, PaintInfo& paintInfo, const LayoutPoint& paintOffset, PaintInfo& paintInfoForChild, bool usePrintRect)
 {
     // Check for page-break-before: always, and if it's set, break and bail.
-    bool checkBeforeAlways = !childrenInline() && (usePrintRect && child->style()->pageBreakBefore() == PBALWAYS);
-    LayoutUnit absoluteChildY = paintOffset.y() + child->y();
+    bool checkBeforeAlways = !childrenInline() && (usePrintRect && child.style()->pageBreakBefore() == PBALWAYS);
+    LayoutUnit absoluteChildY = paintOffset.y() + child.y();
     if (checkBeforeAlways
         && absoluteChildY > paintInfo.rect.y()
         && absoluteChildY < paintInfo.rect.maxY()) {
@@ -2336,29 +2331,30 @@
         return false;
     }
 
-    if (!child->isFloating() && child->isReplaced() && usePrintRect && child->height() <= view().printRect().height()) {
+    if (!child.isFloating() && child.isReplaced() && usePrintRect && child.height() <= view().printRect().height()) {
         // Paginate block-level replaced elements.
-        if (absoluteChildY + child->height() > view().printRect().maxY()) {
+        if (absoluteChildY + child.height() > view().printRect().maxY()) {
             if (absoluteChildY < view().truncatedAt())
-                view().setBestTruncatedAt(absoluteChildY, child);
+                view().setBestTruncatedAt(absoluteChildY, &child);
             // If we were able to truncate, don't paint.
             if (absoluteChildY >= view().truncatedAt())
                 return false;
         }
     }
 
-    LayoutPoint childPoint = flipForWritingModeForChild(child, paintOffset);
-    if (!child->hasSelfPaintingLayer() && !child->isFloating())
-        child->paint(paintInfoForChild, childPoint);
+    LayoutPoint childPoint = flipForWritingModeForChild(&child, paintOffset);
+    if (!child.hasSelfPaintingLayer() && !child.isFloating())
+        child.paint(paintInfoForChild, childPoint);
 
     // Check for page-break-after: always, and if it's set, break and bail.
-    bool checkAfterAlways = !childrenInline() && (usePrintRect && child->style()->pageBreakAfter() == PBALWAYS);
+    bool checkAfterAlways = !childrenInline() && (usePrintRect && child.style()->pageBreakAfter() == PBALWAYS);
     if (checkAfterAlways
-        && (absoluteChildY + child->height()) > paintInfo.rect.y()
-        && (absoluteChildY + child->height()) < paintInfo.rect.maxY()) {
-        view().setBestTruncatedAt(absoluteChildY + child->height() + max<LayoutUnit>(0, child->collapsedMarginAfter()), this, true);
+        && (absoluteChildY + child.height()) > paintInfo.rect.y()
+        && (absoluteChildY + child.height()) < paintInfo.rect.maxY()) {
+        view().setBestTruncatedAt(absoluteChildY + child.height() + max<LayoutUnit>(0, child.collapsedMarginAfter()), this, true);
         return false;
     }
+
     return true;
 }
 
@@ -2606,24 +2602,24 @@
     if (hasOverflowClip())
         offsetFromRepaintContainer -= scrolledContentOffset();
 
-    LogicalSelectionOffsetCaches cache(this);
+    LogicalSelectionOffsetCaches cache(*this);
     LayoutUnit lastTop = 0;
-    LayoutUnit lastLeft = logicalLeftSelectionOffset(this, lastTop, cache);
-    LayoutUnit lastRight = logicalRightSelectionOffset(this, lastTop, cache);
+    LayoutUnit lastLeft = logicalLeftSelectionOffset(*this, lastTop, cache);
+    LayoutUnit lastRight = logicalRightSelectionOffset(*this, lastTop, cache);
     
-    return selectionGaps(this, offsetFromRepaintContainer, IntSize(), lastTop, lastLeft, lastRight, cache);
+    return selectionGaps(*this, offsetFromRepaintContainer, IntSize(), lastTop, lastLeft, lastRight, cache);
 }
 
 void RenderBlock::paintSelection(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
     if (shouldPaintSelectionGaps() && paintInfo.phase == PaintPhaseForeground) {
-        LogicalSelectionOffsetCaches cache(this);
+        LogicalSelectionOffsetCaches cache(*this);
         LayoutUnit lastTop = 0;
-        LayoutUnit lastLeft = logicalLeftSelectionOffset(this, lastTop, cache);
-        LayoutUnit lastRight = logicalRightSelectionOffset(this, lastTop, cache);
+        LayoutUnit lastLeft = logicalLeftSelectionOffset(*this, lastTop, cache);
+        LayoutUnit lastRight = logicalRightSelectionOffset(*this, lastTop, cache);
         GraphicsContextStateSaver stateSaver(*paintInfo.context);
 
-        LayoutRect gapRectsBounds = selectionGaps(this, paintOffset, LayoutSize(), lastTop, lastLeft, lastRight, cache, &paintInfo);
+        LayoutRect gapRectsBounds = selectionGaps(*this, paintOffset, LayoutSize(), lastTop, lastLeft, lastRight, cache, &paintInfo);
         if (!gapRectsBounds.isEmpty()) {
             if (RenderLayer* layer = enclosingLayer()) {
                 gapRectsBounds.moveBy(-paintOffset);
@@ -2652,14 +2648,14 @@
     }
 }
 
-LayoutUnit blockDirectionOffset(RenderBlock* rootBlock, const LayoutSize& offsetFromRootBlock)
+LayoutUnit blockDirectionOffset(RenderBlock& rootBlock, const LayoutSize& offsetFromRootBlock)
 {
-    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
+    return rootBlock.isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
 }
 
-LayoutUnit inlineDirectionOffset(RenderBlock* rootBlock, const LayoutSize& offsetFromRootBlock)
+LayoutUnit inlineDirectionOffset(RenderBlock& rootBlock, const LayoutSize& offsetFromRootBlock)
 {
-    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
+    return rootBlock.isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
 }
 
 LayoutRect RenderBlock::logicalRectToPhysicalRect(const LayoutPoint& rootBlockPhysicalPosition, const LayoutRect& logicalRect)
@@ -2674,7 +2670,7 @@
     return result;
 }
 
-GapRects RenderBlock::selectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+GapRects RenderBlock::selectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     // IMPORTANT: Callers of this method that intend for painting to happen need to do a save/restore.
@@ -2682,7 +2678,7 @@
     if (paintInfo) {
         // Note that we don't clip out overflow for positioned objects.  We just stick to the border box.
         LayoutRect flippedBlockRect(offsetFromRootBlock.width(), offsetFromRootBlock.height(), width(), height());
-        rootBlock->flipForWritingMode(flippedBlockRect);
+        rootBlock.flipForWritingMode(flippedBlockRect);
         flippedBlockRect.moveBy(rootBlockPhysicalPosition);
         clipOutPositionedObjects(paintInfo, flippedBlockRect.location(), positionedObjects());
         if (isBody() || isRoot()) // The <body> must make sure to examine its containingBlock's positioned objects.
@@ -2711,7 +2707,7 @@
         result = blockSelectionGaps(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock, lastLogicalTop, lastLogicalLeft, lastLogicalRight, cache, paintInfo);
 
     // Go ahead and fill the vertical gap all the way to the bottom of our block if the selection extends past our block.
-    if (rootBlock == this && (selectionState() != SelectionBoth && selectionState() != SelectionEnd)) {
+    if (&rootBlock == this && (selectionState() != SelectionBoth && selectionState() != SelectionEnd)) {
         result.uniteCenter(blockSelectionGap(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock,
             lastLogicalTop, lastLogicalLeft, lastLogicalRight, logicalHeight(), cache, paintInfo));
     }
@@ -2719,13 +2715,13 @@
     return result;
 }
 
-GapRects RenderBlock::inlineSelectionGaps(RenderBlock*, const LayoutPoint&, const LayoutSize&, LayoutUnit&, LayoutUnit&, LayoutUnit&, const LogicalSelectionOffsetCaches&, const PaintInfo*)
+GapRects RenderBlock::inlineSelectionGaps(RenderBlock&, const LayoutPoint&, const LayoutSize&, LayoutUnit&, LayoutUnit&, LayoutUnit&, const LogicalSelectionOffsetCaches&, const PaintInfo*)
 {
     ASSERT_NOT_REACHED();
     return GapRects();
 }
 
-GapRects RenderBlock::blockSelectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+GapRects RenderBlock::blockSelectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     GapRects result;
@@ -2737,7 +2733,7 @@
     if (!curr)
         return result;
 
-    LogicalSelectionOffsetCaches childCache(this, cache);
+    LogicalSelectionOffsetCaches childCache(*this, cache);
 
     for (bool sawSelectionEnd = false; curr && !sawSelectionEnd; curr = curr->nextSiblingBox()) {
         SelectionState childState = curr->selectionState();
@@ -2794,7 +2790,7 @@
     return result;
 }
 
-LayoutRect RenderBlock::blockSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+LayoutRect RenderBlock::blockSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     LayoutUnit lastLogicalTop, LayoutUnit lastLogicalLeft, LayoutUnit lastLogicalRight, LayoutUnit logicalBottom, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     LayoutUnit logicalTop = lastLogicalTop;
@@ -2809,13 +2805,13 @@
     if (logicalWidth <= 0)
         return LayoutRect();
 
-    LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(logicalLeft, logicalTop, logicalWidth, logicalHeight));
+    LayoutRect gapRect = rootBlock.logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(logicalLeft, logicalTop, logicalWidth, logicalHeight));
     if (paintInfo)
         paintInfo->context->fillRect(pixelSnappedIntRect(gapRect), selectionBackgroundColor(), style()->colorSpace());
     return gapRect;
 }
 
-LayoutRect RenderBlock::logicalLeftSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+LayoutRect RenderBlock::logicalLeftSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     RenderObject* selObj, LayoutUnit logicalLeft, LayoutUnit logicalTop, LayoutUnit logicalHeight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     LayoutUnit rootBlockLogicalTop = blockDirectionOffset(rootBlock, offsetFromRootBlock) + logicalTop;
@@ -2826,13 +2822,13 @@
     if (rootBlockLogicalWidth <= 0)
         return LayoutRect();
 
-    LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
+    LayoutRect gapRect = rootBlock.logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
     if (paintInfo)
         paintInfo->context->fillRect(pixelSnappedIntRect(gapRect), selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
 }
 
-LayoutRect RenderBlock::logicalRightSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+LayoutRect RenderBlock::logicalRightSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     RenderObject* selObj, LayoutUnit logicalRight, LayoutUnit logicalTop, LayoutUnit logicalHeight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     LayoutUnit rootBlockLogicalTop = blockDirectionOffset(rootBlock, offsetFromRootBlock) + logicalTop;
@@ -2843,7 +2839,7 @@
     if (rootBlockLogicalWidth <= 0)
         return LayoutRect();
 
-    LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
+    LayoutRect gapRect = rootBlock.logicalRectToPhysicalRect(rootBlockPhysicalPosition, LayoutRect(rootBlockLogicalLeft, rootBlockLogicalTop, rootBlockLogicalWidth, logicalHeight));
     if (paintInfo)
         paintInfo->context->fillRect(pixelSnappedIntRect(gapRect), selObj->selectionBackgroundColor(), selObj->style()->colorSpace());
     return gapRect;
@@ -2860,46 +2856,46 @@
                (state == RenderObject::SelectionEnd && !ltr);
 }
 
-LayoutUnit RenderBlock::logicalLeftSelectionOffset(RenderBlock* rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches& cache)
+LayoutUnit RenderBlock::logicalLeftSelectionOffset(RenderBlock& rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches& cache)
 {
     LayoutUnit logicalLeft = logicalLeftOffsetForLine(position, false);
     if (logicalLeft == logicalLeftOffsetForContent()) {
-        if (rootBlock != this) // The border can potentially be further extended by our containingBlock().
-            return cache.containingBlockInfo(this).logicalLeftSelectionOffset(rootBlock, position + logicalTop());
+        if (&rootBlock != this) // The border can potentially be further extended by our containingBlock().
+            return cache.containingBlockInfo(*this).logicalLeftSelectionOffset(rootBlock, position + logicalTop());
         return logicalLeft;
-    } else {
-        RenderBlock* cb = this;
-        const LogicalSelectionOffsetCaches* currentCache = &cache;
-        while (cb != rootBlock) {
-            logicalLeft += cb->logicalLeft();
+    }
 
-            ASSERT(currentCache);
-            const LogicalSelectionOffsetCaches::ContainingBlockInfo& info = currentCache->containingBlockInfo(cb);
-            cb = info.block();
-            currentCache = info.cache();
-        }
+    RenderBlock* cb = this;
+    const LogicalSelectionOffsetCaches* currentCache = &cache;
+    while (cb != &rootBlock) {
+        logicalLeft += cb->logicalLeft();
+
+        ASSERT(currentCache);
+        auto info = currentCache->containingBlockInfo(*cb);
+        cb = info.block();
+        currentCache = info.cache();
     }
     return logicalLeft;
 }
 
-LayoutUnit RenderBlock::logicalRightSelectionOffset(RenderBlock* rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches& cache)
+LayoutUnit RenderBlock::logicalRightSelectionOffset(RenderBlock& rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches& cache)
 {
     LayoutUnit logicalRight = logicalRightOffsetForLine(position, false);
     if (logicalRight == logicalRightOffsetForContent()) {
-        if (rootBlock != this) // The border can potentially be further extended by our containingBlock().
-            return cache.containingBlockInfo(this).logicalRightSelectionOffset(rootBlock, position + logicalTop());
+        if (&rootBlock != this) // The border can potentially be further extended by our containingBlock().
+            return cache.containingBlockInfo(*this).logicalRightSelectionOffset(rootBlock, position + logicalTop());
         return logicalRight;
-    } else {
-        RenderBlock* cb = this;
-        const LogicalSelectionOffsetCaches* currentCache = &cache;
-        while (cb != rootBlock) {
-            logicalRight += cb->logicalLeft();
+    }
 
-            ASSERT(currentCache);
-            const LogicalSelectionOffsetCaches::ContainingBlockInfo& info = currentCache->containingBlockInfo(cb);
-            cb = info.block();
-            currentCache = info.cache();
-        }
+    RenderBlock* cb = this;
+    const LogicalSelectionOffsetCaches* currentCache = &cache;
+    while (cb != &rootBlock) {
+        logicalRight += cb->logicalLeft();
+
+        ASSERT(currentCache);
+        auto info = currentCache->containingBlockInfo(*cb);
+        cb = info.block();
+        currentCache = info.cache();
     }
     return logicalRight;
 }
@@ -2936,7 +2932,7 @@
     return beforeBlock;
 }
 
-void RenderBlock::insertIntoTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
+void RenderBlock::insertIntoTrackedRendererMaps(RenderBox& descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
 {
     if (!descendantsMap) {
         descendantsMap = new TrackedDescendantsMap;
@@ -2948,33 +2944,32 @@
         descendantSet = new TrackedRendererListHashSet;
         descendantsMap->set(this, adoptPtr(descendantSet));
     }
-    bool added = descendantSet->add(descendant).isNewEntry;
+    bool added = descendantSet->add(&descendant).isNewEntry;
     if (!added) {
-        ASSERT(containerMap->get(descendant));
-        ASSERT(containerMap->get(descendant)->contains(this));
+        ASSERT(containerMap->get(&descendant));
+        ASSERT(containerMap->get(&descendant)->contains(this));
         return;
     }
     
-    HashSet<RenderBlock*>* containerSet = containerMap->get(descendant);
+    HashSet<RenderBlock*>* containerSet = containerMap->get(&descendant);
     if (!containerSet) {
         containerSet = new HashSet<RenderBlock*>;
-        containerMap->set(descendant, adoptPtr(containerSet));
+        containerMap->set(&descendant, adoptPtr(containerSet));
     }
     ASSERT(!containerSet->contains(this));
     containerSet->add(this);
 }
 
-void RenderBlock::removeFromTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
+void RenderBlock::removeFromTrackedRendererMaps(RenderBox& descendant, TrackedDescendantsMap*& descendantsMap, TrackedContainerMap*& containerMap)
 {
     if (!descendantsMap)
         return;
     
-    OwnPtr<HashSet<RenderBlock*>> containerSet = containerMap->take(descendant);
+    OwnPtr<HashSet<RenderBlock*>> containerSet = containerMap->take(&descendant);
     if (!containerSet)
         return;
     
-    HashSet<RenderBlock*>::iterator end = containerSet->end();
-    for (HashSet<RenderBlock*>::iterator it = containerSet->begin(); it != end; ++it) {
+    for (auto it = containerSet->begin(), end = containerSet->end(); it != end; ++it) {
         RenderBlock* container = *it;
 
         // FIXME: Disabling this assert temporarily until we fix the layout
@@ -2987,8 +2982,8 @@
         if (descendantsMapIterator == descendantsMap->end())
             continue;
         TrackedRendererListHashSet* descendantSet = descendantsMapIterator->value.get();
-        ASSERT(descendantSet->contains(descendant));
-        descendantSet->remove(descendant);
+        ASSERT(descendantSet->contains(&descendant));
+        descendantSet->remove(&descendant);
         if (descendantSet->isEmpty())
             descendantsMap->remove(descendantsMapIterator);
     }
@@ -3001,17 +2996,17 @@
     return 0;
 }
 
-void RenderBlock::insertPositionedObject(RenderBox* o)
+void RenderBlock::insertPositionedObject(RenderBox& o)
 {
     ASSERT(!isAnonymousBlock());
 
-    if (o->isRenderFlowThread())
+    if (o.isRenderFlowThread())
         return;
     
     insertIntoTrackedRendererMaps(o, gPositionedDescendantsMap, gPositionedContainerMap);
 }
 
-void RenderBlock::removePositionedObject(RenderBox* o)
+void RenderBlock::removePositionedObject(RenderBox& o)
 {
     removeFromTrackedRendererMaps(o, gPositionedDescendantsMap, gPositionedContainerMap);
 }
@@ -3022,14 +3017,10 @@
     if (!positionedDescendants)
         return;
     
-    RenderBox* r;
-    
-    TrackedRendererListHashSet::iterator end = positionedDescendants->end();
-    
     Vector<RenderBox*, 16> deadObjects;
 
-    for (TrackedRendererListHashSet::iterator it = positionedDescendants->begin(); it != end; ++it) {
-        r = *it;
+    for (auto it = positionedDescendants->begin(), end = positionedDescendants->end(); it != end; ++it) {
+        RenderBox* r = *it;
         if (!o || r->isDescendantOf(o)) {
             if (containingBlockState == NewContainingBlock)
                 r->setChildNeedsLayout(MarkOnlyThis);
@@ -3047,15 +3038,15 @@
     }
     
     for (unsigned i = 0; i < deadObjects.size(); i++)
-        removePositionedObject(deadObjects.at(i));
+        removePositionedObject(*deadObjects.at(i));
 }
 
-void RenderBlock::addPercentHeightDescendant(RenderBox* descendant)
+void RenderBlock::addPercentHeightDescendant(RenderBox& descendant)
 {
     insertIntoTrackedRendererMaps(descendant, gPercentHeightDescendantsMap, gPercentHeightContainerMap);
 }
 
-void RenderBlock::removePercentHeightDescendant(RenderBox* descendant)
+void RenderBlock::removePercentHeightDescendant(RenderBox& descendant)
 {
     removeFromTrackedRendererMaps(descendant, gPercentHeightDescendantsMap, gPercentHeightContainerMap);
 }
@@ -3070,16 +3061,16 @@
     return gPercentHeightContainerMap;
 }
 
-bool RenderBlock::hasPercentHeightDescendant(RenderBox* descendant)
+bool RenderBlock::hasPercentHeightDescendant(RenderBox& descendant)
 {
     // We don't null check gPercentHeightContainerMap since the caller
     // already ensures this and we need to call this function on every
     // descendant in clearPercentHeightDescendantsFrom().
     ASSERT(gPercentHeightContainerMap);
-    return gPercentHeightContainerMap->contains(descendant);
+    return gPercentHeightContainerMap->contains(&descendant);
 }
 
-void RenderBlock::removePercentHeightDescendantIfNeeded(RenderBox* descendant)
+void RenderBlock::removePercentHeightDescendantIfNeeded(RenderBox& descendant)
 {
     // We query the map directly, rather than looking at style's
     // logicalHeight()/logicalMinHeight()/logicalMaxHeight() since those
@@ -3093,14 +3084,14 @@
     removePercentHeightDescendant(descendant);
 }
 
-void RenderBlock::clearPercentHeightDescendantsFrom(RenderBox* parent)
+void RenderBlock::clearPercentHeightDescendantsFrom(RenderBox& parent)
 {
     ASSERT(gPercentHeightContainerMap);
-    for (RenderObject* curr = parent->firstChild(); curr; curr = curr->nextInPreOrder(parent)) {
+    for (RenderObject* curr = parent.firstChild(); curr; curr = curr->nextInPreOrder(&parent)) {
         if (!curr->isBox())
             continue;
  
-        RenderBox* box = toRenderBox(curr);
+        RenderBox& box = toRenderBox(*curr);
         if (!hasPercentHeightDescendant(box))
             continue;
 
@@ -3400,62 +3391,60 @@
 
 bool RenderBlock::hitTestContents(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
-    if (childrenInline() && !isTable()) {
-        if (hitTestInlineChildren(request, result, locationInContainer, accumulatedOffset, hitTestAction))
+    if (childrenInline() && !isTable())
+        return hitTestInlineChildren(request, result, locationInContainer, accumulatedOffset, hitTestAction);
+
+    // Hit test our children.
+    HitTestAction childHitTest = hitTestAction;
+    if (hitTestAction == HitTestChildBlockBackgrounds)
+        childHitTest = HitTestChildBlockBackground;
+    for (auto child = lastChildBox(); child; child = child->previousSiblingBox()) {
+        LayoutPoint childPoint = flipForWritingModeForChild(child, accumulatedOffset);
+        if (!child->hasSelfPaintingLayer() && !child->isFloating() && child->nodeAtPoint(request, result, locationInContainer, childPoint, childHitTest))
             return true;
-    } else {
-        // Hit test our children.
-        HitTestAction childHitTest = hitTestAction;
-        if (hitTestAction == HitTestChildBlockBackgrounds)
-            childHitTest = HitTestChildBlockBackground;
-        for (RenderBox* child = lastChildBox(); child; child = child->previousSiblingBox()) {
-            LayoutPoint childPoint = flipForWritingModeForChild(child, accumulatedOffset);
-            if (!child->hasSelfPaintingLayer() && !child->isFloating() && child->nodeAtPoint(request, result, locationInContainer, childPoint, childHitTest))
-                return true;
-        }
     }
 
     return false;
 }
 
-static inline bool isEditingBoundary(RenderElement* ancestor, RenderObject* child)
+static inline bool isEditingBoundary(RenderElement* ancestor, RenderObject& child)
 {
     ASSERT(!ancestor || ancestor->nonPseudoElement());
-    ASSERT(child && child->nonPseudoNode());
+    ASSERT(child.nonPseudoNode());
     return !ancestor || !ancestor->parent() || (ancestor->hasLayer() && ancestor->parent()->isRenderView())
-        || ancestor->nonPseudoElement()->rendererIsEditable() == child->nonPseudoNode()->rendererIsEditable();
+        || ancestor->nonPseudoElement()->rendererIsEditable() == child.nonPseudoNode()->rendererIsEditable();
 }
 
 // FIXME: This function should go on RenderObject as an instance method. Then
 // all cases in which positionForPoint recurs could call this instead to
 // prevent crossing editable boundaries. This would require many tests.
-VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock* parent, RenderBox* child, const LayoutPoint& pointInParentCoordinates)
+VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock& parent, RenderBox& child, const LayoutPoint& pointInParentCoordinates)
 {
-    LayoutPoint childLocation = child->location();
-    if (child->isInFlowPositioned())
-        childLocation += child->offsetForInFlowPosition();
+    LayoutPoint childLocation = child.location();
+    if (child.isInFlowPositioned())
+        childLocation += child.offsetForInFlowPosition();
 
     // FIXME: This is wrong if the child's writing-mode is different from the parent's.
     LayoutPoint pointInChildCoordinates(toLayoutPoint(pointInParentCoordinates - childLocation));
 
     // If this is an anonymous renderer, we just recur normally
-    Element* childElement= child->nonPseudoElement();
+    Element* childElement= child.nonPseudoElement();
     if (!childElement)
-        return child->positionForPoint(pointInChildCoordinates);
+        return child.positionForPoint(pointInChildCoordinates);
 
     // Otherwise, first make sure that the editability of the parent and child agree.
     // If they don't agree, then we return a visible position just before or after the child
-    RenderElement* ancestor = parent;
+    RenderElement* ancestor = &parent;
     while (ancestor && !ancestor->nonPseudoElement())
         ancestor = ancestor->parent();
 
     // If we can't find an ancestor to check editability on, or editability is unchanged, we recur like normal
     if (isEditingBoundary(ancestor, child))
-        return child->positionForPoint(pointInChildCoordinates);
+        return child.positionForPoint(pointInChildCoordinates);
 
     // Otherwise return before or after the child, depending on if the click was to the logical left or logical right of the child
-    LayoutUnit childMiddle = parent->logicalWidthForChild(child) / 2;
-    LayoutUnit logicalLeft = parent->isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
+    LayoutUnit childMiddle = parent.logicalWidthForChild(child) / 2;
+    LayoutUnit logicalLeft = parent.isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
     if (logicalLeft < childMiddle)
         return ancestor->createVisiblePosition(childElement->nodeIndex(), DOWNSTREAM);
     return ancestor->createVisiblePosition(childElement->nodeIndex() + 1, UPSTREAM);
@@ -3467,9 +3456,9 @@
     return VisiblePosition();
 }
 
-static inline bool isChildHitTestCandidate(RenderBox* box)
+static inline bool isChildHitTestCandidate(RenderBox& box)
 {
-    return box->height() && box->style()->visibility() == VISIBLE && !box->isFloatingOrOutOfFlowPositioned();
+    return box.height() && box.style()->visibility() == VISIBLE && !box.isFloatingOrOutOfFlowPositioned();
 }
 
 VisiblePosition RenderBlock::positionForPoint(const LayoutPoint& point)
@@ -3498,23 +3487,23 @@
         return positionForPointWithInlineChildren(pointInLogicalContents);
 
     RenderBox* lastCandidateBox = lastChildBox();
-    while (lastCandidateBox && !isChildHitTestCandidate(lastCandidateBox))
+    while (lastCandidateBox && !isChildHitTestCandidate(*lastCandidateBox))
         lastCandidateBox = lastCandidateBox->previousSiblingBox();
 
     bool blocksAreFlipped = style()->isFlippedBlocksWritingMode();
     if (lastCandidateBox) {
-        if (pointInLogicalContents.y() > logicalTopForChild(lastCandidateBox)
-            || (!blocksAreFlipped && pointInLogicalContents.y() == logicalTopForChild(lastCandidateBox)))
-            return positionForPointRespectingEditingBoundaries(this, lastCandidateBox, pointInContents);
+        if (pointInLogicalContents.y() > logicalTopForChild(*lastCandidateBox)
+            || (!blocksAreFlipped && pointInLogicalContents.y() == logicalTopForChild(*lastCandidateBox)))
+            return positionForPointRespectingEditingBoundaries(*this, *lastCandidateBox, pointInContents);
 
-        for (RenderBox* childBox = firstChildBox(); childBox; childBox = childBox->nextSiblingBox()) {
-            if (!isChildHitTestCandidate(childBox))
+        for (auto childBox = firstChildBox(); childBox; childBox = childBox->nextSiblingBox()) {
+            if (!isChildHitTestCandidate(*childBox))
                 continue;
-            LayoutUnit childLogicalBottom = logicalTopForChild(childBox) + logicalHeightForChild(childBox);
+            LayoutUnit childLogicalBottom = logicalTopForChild(*childBox) + logicalHeightForChild(*childBox);
             // We hit child if our click is above the bottom of its padding box (like IE6/7 and FF3).
-            if (isChildHitTestCandidate(childBox) && (pointInLogicalContents.y() < childLogicalBottom
+            if (isChildHitTestCandidate(*childBox) && (pointInLogicalContents.y() < childLogicalBottom
                 || (blocksAreFlipped && pointInLogicalContents.y() == childLogicalBottom)))
-                return positionForPointRespectingEditingBoundaries(this, childBox, pointInContents);
+                return positionForPointRespectingEditingBoundaries(*this, *childBox, pointInContents);
         }
     }
 
@@ -5168,15 +5157,15 @@
     return flowThread->pageRemainingLogicalHeightForOffset(offset, pageBoundaryRule);
 }
 
-LayoutUnit RenderBlock::adjustForUnsplittableChild(RenderBox* child, LayoutUnit logicalOffset, bool includeMargins)
+LayoutUnit RenderBlock::adjustForUnsplittableChild(RenderBox& child, LayoutUnit logicalOffset, bool includeMargins)
 {
     bool checkColumnBreaks = view().layoutState()->isPaginatingColumns();
     bool checkPageBreaks = !checkColumnBreaks && view().layoutState()->m_pageLogicalHeight;
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     bool checkRegionBreaks = flowThread && flowThread->isRenderNamedFlowThread();
-    bool isUnsplittable = child->isUnsplittableForPagination() || (checkColumnBreaks && child->style()->columnBreakInside() == PBAVOID)
-        || (checkPageBreaks && child->style()->pageBreakInside() == PBAVOID)
-        || (checkRegionBreaks && child->style()->regionBreakInside() == PBAVOID);
+    bool isUnsplittable = child.isUnsplittableForPagination() || (checkColumnBreaks && child.style()->columnBreakInside() == PBAVOID)
+        || (checkPageBreaks && child.style()->pageBreakInside() == PBAVOID)
+        || (checkRegionBreaks && child.style()->regionBreakInside() == PBAVOID);
     if (!isUnsplittable)
         return logicalOffset;
     LayoutUnit childLogicalHeight = logicalHeightForChild(child) + (includeMargins ? marginBeforeForChild(child) + marginAfterForChild(child) : LayoutUnit());
@@ -5266,24 +5255,7 @@
     return flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstPage() + blockOffset, true);
 }
 
-void RenderBlock::updateStaticInlinePositionForChild(RenderBox* child, LayoutUnit logicalTop)
-{
-    if (child->style()->isOriginalDisplayInlineType())
-        setStaticInlinePositionForChild(child, logicalTop, startAlignedOffsetForLine(logicalTop, false));
-    else
-        setStaticInlinePositionForChild(child, logicalTop, startOffsetForContent(logicalTop));
-}
-
-void RenderBlock::setStaticInlinePositionForChild(RenderBox* child, LayoutUnit blockOffset, LayoutUnit inlinePosition)
-{
-    if (flowThreadContainingBlock()) {
-        // Shift the inline position to exclude the region offset.
-        inlinePosition += startOffsetForContent() - startOffsetForContent(blockOffset);
-    }
-    child->layer()->setStaticInlinePosition(inlinePosition);
-}
-
-void RenderBlock::computeRegionRangeForBoxChild(const RenderBox* box) const
+void RenderBlock::computeRegionRangeForBoxChild(const RenderBox& box) const
 {
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     if (!flowThread || !flowThread->hasRegions())
@@ -5291,39 +5263,39 @@
 
     RenderRegion* startRegion;
     RenderRegion* endRegion;
-    LayoutUnit offsetFromLogicalTopOfFirstRegion = box->offsetFromLogicalTopOfFirstPage();
-    if (box->isUnsplittableForPagination())
+    LayoutUnit offsetFromLogicalTopOfFirstRegion = box.offsetFromLogicalTopOfFirstPage();
+    if (box.isUnsplittableForPagination())
         startRegion = endRegion = flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion, true);
     else {
         startRegion = flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion, true);
         endRegion = flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion + logicalHeightForChild(box), true);
     }
 
-    flowThread->setRegionRangeForBox(box, startRegion, endRegion);
+    flowThread->setRegionRangeForBox(&box, startRegion, endRegion);
 }
 
-void RenderBlock::estimateRegionRangeForBoxChild(const RenderBox* box) const
+void RenderBlock::estimateRegionRangeForBoxChild(const RenderBox& box) const
 {
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     if (!flowThread || !flowThread->hasRegions())
         return;
 
-    if (box->isUnsplittableForPagination()) {
+    if (box.isUnsplittableForPagination()) {
         computeRegionRangeForBoxChild(box);
         return;
     }
 
     LogicalExtentComputedValues estimatedValues;
-    box->computeLogicalHeight(RenderFlowThread::maxLogicalHeight(), logicalTopForChild(box), estimatedValues);
+    box.computeLogicalHeight(RenderFlowThread::maxLogicalHeight(), logicalTopForChild(box), estimatedValues);
 
-    LayoutUnit offsetFromLogicalTopOfFirstRegion = box->offsetFromLogicalTopOfFirstPage();
+    LayoutUnit offsetFromLogicalTopOfFirstRegion = box.offsetFromLogicalTopOfFirstPage();
     RenderRegion* startRegion = flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion, true);
     RenderRegion* endRegion = flowThread->regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion + estimatedValues.m_extent, true);
 
-    flowThread->setRegionRangeForBox(box, startRegion, endRegion);
+    flowThread->setRegionRangeForBox(&box, startRegion, endRegion);
 }
 
-bool RenderBlock::updateRegionRangeForBoxChild(const RenderBox* box) const
+bool RenderBlock::updateRegionRangeForBoxChild(const RenderBox& box) const
 {
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     if (!flowThread || !flowThread->hasRegions())
@@ -5331,13 +5303,13 @@
 
     RenderRegion* startRegion = 0;
     RenderRegion* endRegion = 0;
-    flowThread->getRegionRangeForBox(box, startRegion, endRegion);
+    flowThread->getRegionRangeForBox(&box, startRegion, endRegion);
 
     computeRegionRangeForBoxChild(box);
 
     RenderRegion* newStartRegion = 0;
     RenderRegion* newEndRegion = 0;
-    flowThread->getRegionRangeForBox(box, newStartRegion, newEndRegion);
+    flowThread->getRegionRangeForBox(&box, newStartRegion, newEndRegion);
 
     // The region range of the box has changed. Some boxes (e.g floats) may have been positioned assuming
     // a different range.
@@ -5348,68 +5320,68 @@
     return false;
 }
 
-LayoutUnit RenderBlock::collapsedMarginBeforeForChild(const RenderBox* child) const
+LayoutUnit RenderBlock::collapsedMarginBeforeForChild(const RenderBox& child) const
 {
     // If the child has the same directionality as we do, then we can just return its
     // collapsed margin.
-    if (!child->isWritingModeRoot())
-        return child->collapsedMarginBefore();
+    if (!child.isWritingModeRoot())
+        return child.collapsedMarginBefore();
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->collapsedMarginAfter();
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.collapsedMarginAfter();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
     // "logical left/right" sides of the child box.  We can just return the raw margin in this case.  
     return marginBeforeForChild(child);
 }
 
-LayoutUnit RenderBlock::collapsedMarginAfterForChild(const  RenderBox* child) const
+LayoutUnit RenderBlock::collapsedMarginAfterForChild(const RenderBox& child) const
 {
     // If the child has the same directionality as we do, then we can just return its
     // collapsed margin.
-    if (!child->isWritingModeRoot())
-        return child->collapsedMarginAfter();
+    if (!child.isWritingModeRoot())
+        return child.collapsedMarginAfter();
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->collapsedMarginBefore();
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.collapsedMarginBefore();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
     // "logical left/right" side of the child box.  We can just return the raw margin in this case.  
     return marginAfterForChild(child);
 }
 
-bool RenderBlock::hasMarginBeforeQuirk(const RenderBox* child) const
+bool RenderBlock::hasMarginBeforeQuirk(const RenderBox& child) const
 {
     // If the child has the same directionality as we do, then we can just return its
     // margin quirk.
-    if (!child->isWritingModeRoot())
-        return child->isRenderBlock() ? toRenderBlock(child)->hasMarginBeforeQuirk() : child->style()->hasMarginBeforeQuirk();
+    if (!child.isWritingModeRoot())
+        return child.isRenderBlock() ? toRenderBlock(child).hasMarginBeforeQuirk() : child.style()->hasMarginBeforeQuirk();
     
     // The child has a different directionality. If the child is parallel, then it's just
     // flipped relative to us. We can use the opposite edge.
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->isRenderBlock() ? toRenderBlock(child)->hasMarginAfterQuirk() : child->style()->hasMarginAfterQuirk();
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.isRenderBlock() ? toRenderBlock(child).hasMarginAfterQuirk() : child.style()->hasMarginAfterQuirk();
     
     // The child is perpendicular to us and box sides are never quirky in html.css, and we don't really care about
     // whether or not authors specified quirky ems, since they're an implementation detail.
     return false;
 }
 
-bool RenderBlock::hasMarginAfterQuirk(const RenderBox* child) const
+bool RenderBlock::hasMarginAfterQuirk(const RenderBox& child) const
 {
     // If the child has the same directionality as we do, then we can just return its
     // margin quirk.
-    if (!child->isWritingModeRoot())
-        return child->isRenderBlock() ? toRenderBlock(child)->hasMarginAfterQuirk() : child->style()->hasMarginAfterQuirk();
+    if (!child.isWritingModeRoot())
+        return child.isRenderBlock() ? toRenderBlock(child).hasMarginAfterQuirk() : child.style()->hasMarginAfterQuirk();
     
     // The child has a different directionality. If the child is parallel, then it's just
     // flipped relative to us. We can use the opposite edge.
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->isRenderBlock() ? toRenderBlock(child)->hasMarginBeforeQuirk() : child->style()->hasMarginBeforeQuirk();
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.isRenderBlock() ? toRenderBlock(child).hasMarginBeforeQuirk() : child.style()->hasMarginBeforeQuirk();
     
     // The child is perpendicular to us and box sides are never quirky in html.css, and we don't really care about
     // whether or not authors specified quirky ems, since they're an implementation detail.
@@ -5569,12 +5541,13 @@
     if (!gPositionedDescendantsMap)
         return;
 
-    if (TrackedRendererListHashSet* positionedDescendantSet = positionedObjects()) {
-        TrackedRendererListHashSet::const_iterator end = positionedDescendantSet->end();
-        for (TrackedRendererListHashSet::const_iterator it = positionedDescendantSet->begin(); it != end; ++it) {
-            RenderBox* currBox = *it;
-            ASSERT(!currBox->needsLayout());
-        }
+    TrackedRendererListHashSet* positionedDescendantSet = positionedObjects();
+    if (!positionedDescendantSet)
+        return;
+
+    for (auto it = positionedDescendantSet->begin(), end = positionedDescendantSet->end(); it != end; ++it) {
+        RenderBox* currBox = *it;
+        ASSERT(!currBox->needsLayout());
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index dd17106..b447d82 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -117,8 +117,8 @@
 
     virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0);
 
-    void insertPositionedObject(RenderBox*);
-    static void removePositionedObject(RenderBox*);
+    void insertPositionedObject(RenderBox&);
+    static void removePositionedObject(RenderBox&);
     void removePositionedObjects(RenderBlock*, ContainingBlockState = SameContainingBlock);
 
     TrackedRendererListHashSet* positionedObjects() const;
@@ -128,13 +128,13 @@
         return objects && !objects->isEmpty();
     }
 
-    void addPercentHeightDescendant(RenderBox*);
-    static void removePercentHeightDescendant(RenderBox*);
+    void addPercentHeightDescendant(RenderBox&);
+    static void removePercentHeightDescendant(RenderBox&);
     TrackedRendererListHashSet* percentHeightDescendants() const;
     static bool hasPercentHeightContainerMap();
-    static bool hasPercentHeightDescendant(RenderBox*);
-    static void clearPercentHeightDescendantsFrom(RenderBox*);
-    static void removePercentHeightDescendantIfNeeded(RenderBox*);
+    static bool hasPercentHeightDescendant(RenderBox&);
+    static void clearPercentHeightDescendantsFrom(RenderBox&);
+    static void removePercentHeightDescendantIfNeeded(RenderBox&);
 
     void setHasMarginBeforeQuirk(bool b) { m_hasMarginBeforeQuirk = b; }
     void setHasMarginAfterQuirk(bool b) { m_hasMarginAfterQuirk = b; }
@@ -142,8 +142,8 @@
     bool hasMarginBeforeQuirk() const { return m_hasMarginBeforeQuirk; }
     bool hasMarginAfterQuirk() const { return m_hasMarginAfterQuirk; }
 
-    bool hasMarginBeforeQuirk(const RenderBox* child) const;
-    bool hasMarginAfterQuirk(const RenderBox* child) const;
+    bool hasMarginBeforeQuirk(const RenderBox& child) const;
+    bool hasMarginAfterQuirk(const RenderBox& child) const;
 
     bool generatesLineBoxesForInlineChild(RenderObject*);
 
@@ -226,9 +226,9 @@
     void adjustStartEdgeForWritingModeIncludingColumns(LayoutRect&) const;
 
     GapRects selectionGapRectsForRepaint(const RenderLayerModelObject* repaintContainer);
-    LayoutRect logicalLeftSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    LayoutRect logicalLeftSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         RenderObject* selObj, LayoutUnit logicalLeft, LayoutUnit logicalTop, LayoutUnit logicalHeight, const LogicalSelectionOffsetCaches&, const PaintInfo*);
-    LayoutRect logicalRightSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    LayoutRect logicalRightSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         RenderObject* selObj, LayoutUnit logicalRight, LayoutUnit logicalTop, LayoutUnit logicalHeight, const LogicalSelectionOffsetCaches&, const PaintInfo*);
     void getSelectionGapInfo(SelectionState, bool& leftGap, bool& rightGap);
     RenderBlock* blockBeforeWithinSelectionRoot(LayoutSize& offset) const;
@@ -307,21 +307,21 @@
 
     // Accessors for logical width/height and margins in the containing block's block-flow direction.
     enum ApplyLayoutDeltaMode { ApplyLayoutDelta, DoNotApplyLayoutDelta };
-    LayoutUnit logicalWidthForChild(const RenderBox* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
-    LayoutUnit logicalHeightForChild(const RenderBox* child) const { return isHorizontalWritingMode() ? child->height() : child->width(); }
-    LayoutUnit logicalTopForChild(const RenderBox* child) const { return isHorizontalWritingMode() ? child->y() : child->x(); }
-    void setLogicalLeftForChild(RenderBox* child, LayoutUnit logicalLeft, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
-    void setLogicalTopForChild(RenderBox* child, LayoutUnit logicalTop, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
-    LayoutUnit marginBeforeForChild(const RenderBoxModelObject* child) const { return child->marginBefore(style()); }
-    LayoutUnit marginAfterForChild(const RenderBoxModelObject* child) const { return child->marginAfter(style()); }
-    LayoutUnit marginStartForChild(const RenderBoxModelObject* child) const { return child->marginStart(style()); }
-    LayoutUnit marginEndForChild(const RenderBoxModelObject* child) const { return child->marginEnd(style()); }
-    void setMarginStartForChild(RenderBox* child, LayoutUnit value) const { child->setMarginStart(value, style()); }
-    void setMarginEndForChild(RenderBox* child, LayoutUnit value) const { child->setMarginEnd(value, style()); }
-    void setMarginBeforeForChild(RenderBox* child, LayoutUnit value) const { child->setMarginBefore(value, style()); }
-    void setMarginAfterForChild(RenderBox* child, LayoutUnit value) const { child->setMarginAfter(value, style()); }
-    LayoutUnit collapsedMarginBeforeForChild(const RenderBox* child) const;
-    LayoutUnit collapsedMarginAfterForChild(const RenderBox* child) const;
+    LayoutUnit logicalWidthForChild(const RenderBox& child) const { return isHorizontalWritingMode() ? child.width() : child.height(); }
+    LayoutUnit logicalHeightForChild(const RenderBox& child) const { return isHorizontalWritingMode() ? child.height() : child.width(); }
+    LayoutUnit logicalTopForChild(const RenderBox& child) const { return isHorizontalWritingMode() ? child.y() : child.x(); }
+    void setLogicalLeftForChild(RenderBox& child, LayoutUnit logicalLeft, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
+    void setLogicalTopForChild(RenderBox& child, LayoutUnit logicalTop, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
+    LayoutUnit marginBeforeForChild(const RenderBoxModelObject& child) const { return child.marginBefore(style()); }
+    LayoutUnit marginAfterForChild(const RenderBoxModelObject& child) const { return child.marginAfter(style()); }
+    LayoutUnit marginStartForChild(const RenderBoxModelObject& child) const { return child.marginStart(style()); }
+    LayoutUnit marginEndForChild(const RenderBoxModelObject& child) const { return child.marginEnd(style()); }
+    void setMarginStartForChild(RenderBox& child, LayoutUnit value) const { child.setMarginStart(value, style()); }
+    void setMarginEndForChild(RenderBox& child, LayoutUnit value) const { child.setMarginEnd(value, style()); }
+    void setMarginBeforeForChild(RenderBox& child, LayoutUnit value) const { child.setMarginBefore(value, style()); }
+    void setMarginAfterForChild(RenderBox& child, LayoutUnit value) const { child.setMarginAfter(value, style()); }
+    LayoutUnit collapsedMarginBeforeForChild(const RenderBox& child) const;
+    LayoutUnit collapsedMarginAfterForChild(const RenderBox& child) const;
 
     void updateLogicalWidthForAlignment(const ETextAlign&, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float& availableLogicalWidth, int expansionOpportunityCount);
 
@@ -366,14 +366,11 @@
     LayoutUnit logicalRightOffsetForContent() const { return logicalLeftOffsetForContent() + availableLogicalWidth(); }
     LayoutUnit startOffsetForContent() const { return style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
     LayoutUnit endOffsetForContent() const { return !style()->isLeftToRightDirection() ? logicalLeftOffsetForContent() : logicalWidth() - logicalRightOffsetForContent(); }
-    
-    void setStaticInlinePositionForChild(RenderBox*, LayoutUnit blockOffset, LayoutUnit inlinePosition);
-    void updateStaticInlinePositionForChild(RenderBox*, LayoutUnit logicalTop);
 
-    LayoutUnit computeStartPositionDeltaForChildAvoidingFloats(const RenderBox* child, LayoutUnit childMarginStart, RenderRegion* = 0);
+    LayoutUnit computeStartPositionDeltaForChildAvoidingFloats(const RenderBox& child, LayoutUnit childMarginStart, RenderRegion* = 0);
 
-    void placeRunInIfNeeded(RenderObject* newChild);
-    bool runInIsPlacedIntoSiblingBlock(RenderObject* runIn);
+    void placeRunInIfNeeded(RenderObject& newChild);
+    bool runInIsPlacedIntoSiblingBlock(RenderObject& runIn);
 
 #ifndef NDEBUG
     void checkPositionedObjectsNeedLayout();
@@ -425,12 +422,12 @@
     virtual void layout() OVERRIDE;
 
     void layoutPositionedObjects(bool relayoutChildren, bool fixedPositionObjectsOnly = false);
-    void markFixedPositionObjectForLayoutIfNeeded(RenderObject* child);
+    void markFixedPositionObjectForLayoutIfNeeded(RenderObject& child);
 
     virtual void paint(PaintInfo&, const LayoutPoint&) OVERRIDE;
     virtual void paintObject(PaintInfo&, const LayoutPoint&) OVERRIDE;
     virtual void paintChildren(PaintInfo& forSelf, const LayoutPoint&, PaintInfo& forChild, bool usePrintRect);
-    bool paintChild(RenderBox*, PaintInfo& forSelf, const LayoutPoint&, PaintInfo& forChild, bool usePrintRect);
+    bool paintChild(RenderBox&, PaintInfo& forSelf, const LayoutPoint&, PaintInfo& forChild, bool usePrintRect);
    
     LayoutUnit logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* heightRemaining = 0, LayoutUnit logicalHeight = 0) const
     {
@@ -498,12 +495,12 @@
 
     bool updateShapesBeforeBlockLayout();
     void updateShapesAfterBlockLayout(bool heightChanged = false);
-    void computeRegionRangeForBoxChild(const RenderBox*) const;
+    void computeRegionRangeForBoxChild(const RenderBox&) const;
 
-    void estimateRegionRangeForBoxChild(const RenderBox*) const;
-    bool updateRegionRangeForBoxChild(const RenderBox*) const;
+    void estimateRegionRangeForBoxChild(const RenderBox&) const;
+    bool updateRegionRangeForBoxChild(const RenderBox&) const;
 
-    void updateBlockChildDirtyBitsBeforeLayout(bool relayoutChildren, RenderBox*);
+    void updateBlockChildDirtyBitsBeforeLayout(bool relayoutChildren, RenderBox&);
 
     virtual void checkForPaginationLogicalHeightChange(LayoutUnit& pageLogicalHeight, bool& pageLogicalHeightChanged, bool& hasSpecifiedPageLogicalHeight);
     void prepareShapesAndPaginationBeforeBlockLayout(bool&);
@@ -527,7 +524,7 @@
     virtual bool isInlineBlockOrInlineTable() const OVERRIDE FINAL { return isInline() && isReplaced(); }
     virtual bool canHaveChildren() const OVERRIDE { return true; }
 
-    void makeChildrenNonInline(RenderObject* insertionPoint = 0);
+    void makeChildrenNonInline(RenderObject* insertionPoint = nullptr);
     virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
 
     // FIXME-BLOCKFLOW: Remove virtualizaion when all callers have moved to RenderBlockFlow
@@ -543,8 +540,8 @@
     // FIXME-BLOCKFLOW: Remove virtualizaion when all callers have moved to RenderBlockFlow
     virtual bool hasLines() const { return false; }
 
-    void insertIntoTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
-    static void removeFromTrackedRendererMaps(RenderBox* descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
+    void insertIntoTrackedRendererMaps(RenderBox& descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
+    static void removeFromTrackedRendererMaps(RenderBox& descendant, TrackedDescendantsMap*&, TrackedContainerMap*&);
 
     // Called to lay out the legend for a fieldset or the ruby text of a ruby run.
     virtual RenderObject* layoutSpecialExcludedChild(bool /*relayoutChildren*/) { return 0; }
@@ -555,14 +552,14 @@
     Node* nodeForHitTest() const;
 
     struct FloatWithRect {
-        FloatWithRect(RenderBox* f)
+        FloatWithRect(RenderBox& f)
             : object(f)
-            , rect(LayoutRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginWidth(), f->height() + f->marginHeight()))
-            , everHadLayout(f->everHadLayout())
+            , rect(LayoutRect(f.x() - f.marginLeft(), f.y() - f.marginTop(), f.width() + f.marginWidth(), f.height() + f.marginHeight()))
+            , everHadLayout(f.everHadLayout())
         {
         }
 
-        RenderBox* object;
+        RenderBox& object;
         LayoutRect rect;
         bool everHadLayout;
     };
@@ -574,13 +571,13 @@
         if (isHorizontalWritingMode())
             return child->x() + child->renderer().marginLeft();
         else
-            return child->x() + marginBeforeForChild(&child->renderer());
+            return child->x() + marginBeforeForChild(child->renderer());
     }
         
     LayoutUnit yPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
         if (isHorizontalWritingMode())
-            return child->y() + marginBeforeForChild(&child->renderer());
+            return child->y() + marginBeforeForChild(child->renderer());
         else
             return child->y() + child->renderer().marginTop();
     }
@@ -625,20 +622,20 @@
     }
     virtual bool shouldPaintSelectionGaps() const OVERRIDE FINAL;
     bool isSelectionRoot() const;
-    GapRects selectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    GapRects selectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches&, const PaintInfo* = 0);
     // FIXME-BLOCKFLOW: Remove virtualizaion when all callers have moved to RenderBlockFlow
-    virtual GapRects inlineSelectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    virtual GapRects inlineSelectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches&, const PaintInfo*);
-    GapRects blockSelectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    GapRects blockSelectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches&, const PaintInfo*);
-    LayoutRect blockSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    LayoutRect blockSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit lastLogicalTop, LayoutUnit lastLogicalLeft, LayoutUnit lastLogicalRight, LayoutUnit logicalBottom, const LogicalSelectionOffsetCaches&, const PaintInfo*);
-    LayoutUnit logicalLeftSelectionOffset(RenderBlock* rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches&);
-    LayoutUnit logicalRightSelectionOffset(RenderBlock* rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches&);
+    LayoutUnit logicalLeftSelectionOffset(RenderBlock& rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches&);
+    LayoutUnit logicalRightSelectionOffset(RenderBlock& rootBlock, LayoutUnit position, const LogicalSelectionOffsetCaches&);
     
     // FIXME-BLOCKFLOW: Remove virtualizaion when all callers have moved to RenderBlockFlow
-    virtual void clipOutFloatingObjects(RenderBlock*, const PaintInfo*, const LayoutPoint&, const LayoutSize&) { };
+    virtual void clipOutFloatingObjects(RenderBlock&, const PaintInfo*, const LayoutPoint&, const LayoutSize&) { };
     friend class LogicalSelectionOffsetCaches;
 
     virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const OVERRIDE;
@@ -670,14 +667,14 @@
     RenderBlock* containingColumnsBlock(bool allowAnonymousColumnBlock = true);
     RenderBlock* columnsBlockForSpanningElement(RenderObject* newChild);
 
-    RenderBoxModelObject* createReplacementRunIn(RenderBoxModelObject* runIn);
-    void moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn);
-    void moveRunInToOriginalPosition(RenderObject* runIn);
+    RenderBoxModelObject& createReplacementRunIn(RenderBoxModelObject& runIn);
+    void moveRunInUnderSiblingBlockIfNeeded(RenderObject& runIn);
+    void moveRunInToOriginalPosition(RenderObject& runIn);
 
 protected:
     void dirtyForLayoutFromPercentageHeightDescendants();
     
-    void determineLogicalLeftPositionForChild(RenderBox* child, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
+    void determineLogicalLeftPositionForChild(RenderBox& child, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
     
     // Returns the logicalOffset at the top of the next page. If the offset passed in is already at the top of the current page,
     // then nextPageLogicalTop with ExcludePageBoundary will still move to the top of the next page. nextPageLogicalTop with
@@ -706,7 +703,7 @@
     // column balancer to help set a good minimum column height.
     void updateMinimumPageHeight(LayoutUnit offset, LayoutUnit minHeight);
 
-    LayoutUnit adjustForUnsplittableChild(RenderBox* child, LayoutUnit logicalOffset, bool includeMargins = false); // If the child is unsplittable and can't fit on the current page, return the top of the next page/column.
+    LayoutUnit adjustForUnsplittableChild(RenderBox& child, LayoutUnit logicalOffset, bool includeMargins = false); // If the child is unsplittable and can't fit on the current page, return the top of the next page/column.
 
     // Adjust from painting offsets to the local coords of this renderer
     void offsetForContents(LayoutPoint&) const;
@@ -803,9 +800,9 @@
 void toRenderBlock(const RenderBlock*);
 void toRenderBlock(const RenderBlock&);
 
-LayoutUnit blockDirectionOffset(RenderBlock* rootBlock, const LayoutSize& offsetFromRootBlock);
-LayoutUnit inlineDirectionOffset(RenderBlock* rootBlock, const LayoutSize& offsetFromRootBlock);
-VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock*, RenderBox*, const LayoutPoint&);
+LayoutUnit blockDirectionOffset(RenderBlock& rootBlock, const LayoutSize& offsetFromRootBlock);
+LayoutUnit inlineDirectionOffset(RenderBlock& rootBlock, const LayoutSize& offsetFromRootBlock);
+VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock&, RenderBox&, const LayoutPoint&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/rendering/RenderBlockFlow.cpp b/Source/WebCore/rendering/RenderBlockFlow.cpp
index c8ef7cf..39014e9 100644
--- a/Source/WebCore/rendering/RenderBlockFlow.cpp
+++ b/Source/WebCore/rendering/RenderBlockFlow.cpp
@@ -52,7 +52,7 @@
 COMPILE_ASSERT(sizeof(RenderBlockFlow::MarginInfo) == sizeof(SameSizeAsMarginInfo), MarginInfo_should_stay_small);
 
 // Our MarginInfo state used when laying out block children.
-RenderBlockFlow::MarginInfo::MarginInfo(RenderBlockFlow* block, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding)
+RenderBlockFlow::MarginInfo::MarginInfo(RenderBlockFlow& block, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding)
     : m_atBeforeSideOfBlock(true)
     , m_atAfterSideOfBlock(false)
     , m_hasMarginBeforeQuirk(false)
@@ -60,11 +60,11 @@
     , m_determinedMarginBeforeQuirk(false)
     , m_discardMargin(false)
 {
-    RenderStyle* blockStyle = block->style();
-    ASSERT(block->isRenderView() || block->parent());
-    m_canCollapseWithChildren = !block->isRenderView() && !block->isRoot() && !block->isOutOfFlowPositioned()
-        && !block->isFloating() && !block->isTableCell() && !block->hasOverflowClip() && !block->isInlineBlockOrInlineTable()
-        && !block->isRenderFlowThread() && !block->isWritingModeRoot() && !block->parent()->isFlexibleBox()
+    RenderStyle* blockStyle = block.style();
+    ASSERT(block.isRenderView() || block.parent());
+    m_canCollapseWithChildren = !block.isRenderView() && !block.isRoot() && !block.isOutOfFlowPositioned()
+        && !block.isFloating() && !block.isTableCell() && !block.hasOverflowClip() && !block.isInlineBlockOrInlineTable()
+        && !block.isRenderFlowThread() && !block.isWritingModeRoot() && !block.parent()->isFlexibleBox()
         && blockStyle->hasAutoColumnCount() && blockStyle->hasAutoColumnWidth() && !blockStyle->columnSpan();
 
     m_canCollapseMarginBeforeWithChildren = m_canCollapseWithChildren && !beforeBorderPadding && blockStyle->marginBeforeCollapse() != MSEPARATE;
@@ -76,12 +76,12 @@
     m_canCollapseMarginAfterWithChildren = m_canCollapseWithChildren && !afterBorderPadding
         && (blockStyle->logicalHeight().isAuto() && !blockStyle->logicalHeight().value()) && blockStyle->marginAfterCollapse() != MSEPARATE;
     
-    m_quirkContainer = block->isTableCell() || block->isBody();
+    m_quirkContainer = block.isTableCell() || block.isBody();
 
-    m_discardMargin = m_canCollapseMarginBeforeWithChildren && block->mustDiscardMarginBefore();
+    m_discardMargin = m_canCollapseMarginBeforeWithChildren && block.mustDiscardMarginBefore();
 
-    m_positiveMargin = (m_canCollapseMarginBeforeWithChildren && !block->mustDiscardMarginBefore()) ? block->maxPositiveMarginBefore() : LayoutUnit();
-    m_negativeMargin = (m_canCollapseMarginBeforeWithChildren && !block->mustDiscardMarginBefore()) ? block->maxNegativeMarginBefore() : LayoutUnit();
+    m_positiveMargin = (m_canCollapseMarginBeforeWithChildren && !block.mustDiscardMarginBefore()) ? block.maxPositiveMarginBefore() : LayoutUnit();
+    m_negativeMargin = (m_canCollapseMarginBeforeWithChildren && !block.mustDiscardMarginBefore()) ? block.maxNegativeMarginBefore() : LayoutUnit();
 }
 
 RenderBlockFlow::RenderBlockFlow(Element& element)
@@ -119,7 +119,7 @@
 
     if (!documentBeingDestroyed()) {
         if (firstChild() && firstChild()->isRunIn())
-            moveRunInToOriginalPosition(firstChild());
+            moveRunInToOriginalPosition(*firstChild());
     }
 
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
@@ -385,8 +385,8 @@
             // One of our children's floats may have become an overhanging float for us. We need to look for it.
             for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
                 if (child->isRenderBlockFlow() && !child->isFloatingOrOutOfFlowPositioned()) {
-                    RenderBlockFlow* block = toRenderBlockFlow(child);
-                    if (block->lowestFloatLogicalBottom() + block->logicalTop() > newHeight)
+                    RenderBlockFlow& block = toRenderBlockFlow(*child);
+                    if (block.lowestFloatLogicalBottom() + block.logicalTop() > newHeight)
                         addOverhangingFloats(block, false);
                 }
             }
@@ -477,7 +477,7 @@
         layoutLineGridBox();
 
     // The margin struct caches all our current margin collapsing state.
-    MarginInfo marginInfo(this, beforeEdge, afterEdge);
+    MarginInfo marginInfo(*this, beforeEdge, afterEdge);
 
     // Fieldsets need to find their legend and position it inside the border of the object.
     // The legend then gets skipped during normal layout. The same is true for ruby text.
@@ -490,20 +490,20 @@
     RenderBox* next = firstChildBox();
 
     while (next) {
-        RenderBox* child = next;
-        next = child->nextSiblingBox();
+        RenderBox& child = *next;
+        next = child.nextSiblingBox();
 
-        if (childToExclude == child)
+        if (childToExclude == &child)
             continue; // Skip this child, since it will be positioned by the specialized subclass (fieldsets and ruby runs).
 
         updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, child);
 
-        if (child->isOutOfFlowPositioned()) {
-            child->containingBlock()->insertPositionedObject(child);
+        if (child.isOutOfFlowPositioned()) {
+            child.containingBlock()->insertPositionedObject(child);
             adjustPositionedBlock(child, marginInfo);
             continue;
         }
-        if (child->isFloating()) {
+        if (child.isFloating()) {
             insertFloatingObject(child);
             adjustFloatingBlock(marginInfo);
             continue;
@@ -518,13 +518,13 @@
     handleAfterSideOfBlock(beforeEdge, afterEdge, marginInfo);
 }
 
-void RenderBlockFlow::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, LayoutUnit& previousFloatLogicalBottom, LayoutUnit& maxFloatLogicalBottom)
+void RenderBlockFlow::layoutBlockChild(RenderBox& child, MarginInfo& marginInfo, LayoutUnit& previousFloatLogicalBottom, LayoutUnit& maxFloatLogicalBottom)
 {
     LayoutUnit oldPosMarginBefore = maxPositiveMarginBefore();
     LayoutUnit oldNegMarginBefore = maxNegativeMarginBefore();
 
     // The child is a normal flow object. Compute the margins we will use for collapsing now.
-    child->computeAndSetBlockDirectionMargins(this);
+    child.computeAndSetBlockDirectionMargins(this);
 
     // Try to guess our correct logical top position. In most cases this guess will
     // be correct. Only if we're wrong (when we compute the real logical top position)
@@ -533,7 +533,7 @@
     LayoutUnit logicalTopEstimate = estimateLogicalTopPosition(child, marginInfo, estimateWithoutPagination);
 
     // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
-    LayoutRect oldRect = child->frameRect();
+    LayoutRect oldRect = child.frameRect();
     LayoutUnit oldLogicalTop = logicalTopForChild(child);
 
 #if !ASSERT_DISABLED
@@ -543,9 +543,9 @@
     setLogicalTopForChild(child, logicalTopEstimate, ApplyLayoutDelta);
     estimateRegionRangeForBoxChild(child);
 
-    RenderBlockFlow* childBlockFlow = child->isRenderBlockFlow() ? toRenderBlockFlow(child) : 0;
+    RenderBlockFlow* childBlockFlow = child.isRenderBlockFlow() ? toRenderBlockFlow(&child) : nullptr;
     bool markDescendantsWithFloats = false;
-    if (logicalTopEstimate != oldLogicalTop && !child->avoidsFloats() && childBlockFlow && childBlockFlow->containsFloats())
+    if (logicalTopEstimate != oldLogicalTop && !child.avoidsFloats() && childBlockFlow && childBlockFlow->containsFloats())
         markDescendantsWithFloats = true;
 #if ENABLE(SUBPIXEL_LAYOUT)
     else if (UNLIKELY(logicalTopEstimate.mightBeSaturated()))
@@ -555,7 +555,7 @@
         // might yield incorrect results. If this is the case always mark for layout.
         markDescendantsWithFloats = true;
 #endif
-    else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
+    else if (!child.avoidsFloats() || child.shrinkToAvoidFloats()) {
         // If an element might be affected by the presence of floats, then always mark it for
         // layout.
         LayoutUnit fb = max(previousFloatLogicalBottom, lowestFloatLogicalBottom());
@@ -566,17 +566,17 @@
     if (childBlockFlow) {
         if (markDescendantsWithFloats)
             childBlockFlow->markAllDescendantsWithFloatsForLayout();
-        if (!child->isWritingModeRoot())
+        if (!child.isWritingModeRoot())
             previousFloatLogicalBottom = max(previousFloatLogicalBottom, oldLogicalTop + childBlockFlow->lowestFloatLogicalBottom());
     }
 
-    if (!child->needsLayout())
-        child->markForPaginationRelayoutIfNeeded();
+    if (!child.needsLayout())
+        child.markForPaginationRelayoutIfNeeded();
 
-    bool childHadLayout = child->everHadLayout();
-    bool childNeededLayout = child->needsLayout();
+    bool childHadLayout = child.everHadLayout();
+    bool childNeededLayout = child.needsLayout();
     if (childNeededLayout)
-        child->layout();
+        child.layout();
 
     // Cache if we are at the top of the block right now.
     bool atBeforeSideOfBlock = marginInfo.atBeforeSideOfBlock();
@@ -590,50 +590,49 @@
     
     bool paginated = view().layoutState()->isPaginated();
     if (paginated)
-        logicalTopAfterClear = adjustBlockChildForPagination(logicalTopAfterClear, estimateWithoutPagination, child,
-            atBeforeSideOfBlock && logicalTopBeforeClear == logicalTopAfterClear);
+        logicalTopAfterClear = adjustBlockChildForPagination(logicalTopAfterClear, estimateWithoutPagination, child, atBeforeSideOfBlock && logicalTopBeforeClear == logicalTopAfterClear);
 
     setLogicalTopForChild(child, logicalTopAfterClear, ApplyLayoutDelta);
 
     // Now we have a final top position. See if it really does end up being different from our estimate.
     // clearFloatsIfNeeded can also mark the child as needing a layout even though we didn't move. This happens
     // when collapseMargins dynamically adds overhanging floats because of a child with negative margins.
-    if (logicalTopAfterClear != logicalTopEstimate || child->needsLayout() || (paginated && childBlockFlow && childBlockFlow->shouldBreakAtLineToAvoidWidow())) {
-        if (child->shrinkToAvoidFloats()) {
+    if (logicalTopAfterClear != logicalTopEstimate || child.needsLayout() || (paginated && childBlockFlow && childBlockFlow->shouldBreakAtLineToAvoidWidow())) {
+        if (child.shrinkToAvoidFloats()) {
             // The child's width depends on the line width.
             // When the child shifts to clear an item, its width can
             // change (because it has more available line width).
             // So go ahead and mark the item as dirty.
-            child->setChildNeedsLayout(MarkOnlyThis);
+            child.setChildNeedsLayout(MarkOnlyThis);
         }
         
         if (childBlockFlow) {
-            if (!child->avoidsFloats() && childBlockFlow->containsFloats())
+            if (!child.avoidsFloats() && childBlockFlow->containsFloats())
                 childBlockFlow->markAllDescendantsWithFloatsForLayout();
-            if (!child->needsLayout())
-                child->markForPaginationRelayoutIfNeeded();
+            if (!child.needsLayout())
+                child.markForPaginationRelayoutIfNeeded();
         }
 
         // Our guess was wrong. Make the child lay itself out again.
-        child->layoutIfNeeded();
+        child.layoutIfNeeded();
     }
 
     if (updateRegionRangeForBoxChild(child)) {
-        child->setNeedsLayout(MarkOnlyThis);
-        child->layoutIfNeeded();
+        child.setNeedsLayout(MarkOnlyThis);
+        child.layoutIfNeeded();
     }
 
     // We are no longer at the top of the block if we encounter a non-empty child.  
     // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
-    if (marginInfo.atBeforeSideOfBlock() && !child->isSelfCollapsingBlock())
+    if (marginInfo.atBeforeSideOfBlock() && !child.isSelfCollapsingBlock())
         marginInfo.setAtBeforeSideOfBlock(false);
 
     // Now place the child in the correct left position
     determineLogicalLeftPositionForChild(child, ApplyLayoutDelta);
 
-    LayoutSize childOffset = child->location() - oldRect.location();
+    LayoutSize childOffset = child.location() - oldRect.location();
 #if ENABLE(CSS_SHAPES)
-    relayoutShapeDescendantIfMoved(child->isRenderBlock() ? toRenderBlock(child) : 0, childOffset);
+    relayoutShapeDescendantIfMoved(child.isRenderBlock() ? toRenderBlock(&child) : nullptr, childOffset);
 #endif
 
     // Update our height now that the child has been placed in the correct position.
@@ -645,7 +644,7 @@
     // If the child has overhanging floats that intrude into following siblings (or possibly out
     // of this block), then the parent gets notified of the floats now.
     if (childBlockFlow && childBlockFlow->containsFloats())
-        maxFloatLogicalBottom = max(maxFloatLogicalBottom, addOverhangingFloats(toRenderBlockFlow(child), !childNeededLayout));
+        maxFloatLogicalBottom = max(maxFloatLogicalBottom, addOverhangingFloats(*childBlockFlow, !childNeededLayout));
 
     if (childOffset.width() || childOffset.height()) {
         view().addLayoutDelta(childOffset);
@@ -653,13 +652,13 @@
         // If the child moved, we have to repaint it as well as any floating/positioned
         // descendants. An exception is if we need a layout. In this case, we know we're going to
         // repaint ourselves (and the child) anyway.
-        if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
-            child->repaintDuringLayoutIfMoved(oldRect);
+        if (childHadLayout && !selfNeedsLayout() && child.checkForRepaintDuringLayout())
+            child.repaintDuringLayoutIfMoved(oldRect);
     }
 
-    if (!childHadLayout && child->checkForRepaintDuringLayout()) {
-        child->repaint();
-        child->repaintOverhangingFloats(true);
+    if (!childHadLayout && child.checkForRepaintDuringLayout()) {
+        child.repaint();
+        child.repaintOverhangingFloats(true);
     }
 
     if (paginated) {
@@ -672,10 +671,10 @@
     ASSERT(view().layoutDeltaMatches(oldLayoutDelta));
 }
 
-void RenderBlockFlow::adjustPositionedBlock(RenderBox* child, const MarginInfo& marginInfo)
+void RenderBlockFlow::adjustPositionedBlock(RenderBox& child, const MarginInfo& marginInfo)
 {
     bool isHorizontal = isHorizontalWritingMode();
-    bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontal);
+    bool hasStaticBlockPosition = child.style()->hasStaticBlockPosition(isHorizontal);
     
     LayoutUnit logicalTop = logicalHeight();
     updateStaticInlinePositionForChild(child, logicalTop);
@@ -688,11 +687,11 @@
         logicalTop += collapsedBeforePos - collapsedBeforeNeg;
     }
     
-    RenderLayer* childLayer = child->layer();
+    RenderLayer* childLayer = child.layer();
     if (childLayer->staticBlockPosition() != logicalTop) {
         childLayer->setStaticBlockPosition(logicalTop);
         if (hasStaticBlockPosition)
-            child->setChildNeedsLayout(MarkOnlyThis);
+            child.setChildNeedsLayout(MarkOnlyThis);
     }
 }
 
@@ -717,7 +716,24 @@
     setLogicalHeight(logicalHeight() - marginOffset);
 }
 
-RenderBlockFlow::MarginValues RenderBlockFlow::marginValuesForChild(RenderBox* child) const
+void RenderBlockFlow::updateStaticInlinePositionForChild(RenderBox& child, LayoutUnit logicalTop)
+{
+    if (child.style()->isOriginalDisplayInlineType())
+        setStaticInlinePositionForChild(child, logicalTop, startAlignedOffsetForLine(logicalTop, false));
+    else
+        setStaticInlinePositionForChild(child, logicalTop, startOffsetForContent(logicalTop));
+}
+
+void RenderBlockFlow::setStaticInlinePositionForChild(RenderBox& child, LayoutUnit blockOffset, LayoutUnit inlinePosition)
+{
+    if (flowThreadContainingBlock()) {
+        // Shift the inline position to exclude the region offset.
+        inlinePosition += startOffsetForContent() - startOffsetForContent(blockOffset);
+    }
+    child.layer()->setStaticInlinePosition(inlinePosition);
+}
+
+RenderBlockFlow::MarginValues RenderBlockFlow::marginValuesForChild(RenderBox& child) const
 {
     LayoutUnit childBeforePositive = 0;
     LayoutUnit childBeforeNegative = 0;
@@ -727,21 +743,21 @@
     LayoutUnit beforeMargin = 0;
     LayoutUnit afterMargin = 0;
 
-    RenderBlockFlow* childRenderBlock = child->isRenderBlockFlow() ? toRenderBlockFlow(child) : 0;
+    RenderBlockFlow* childRenderBlock = child.isRenderBlockFlow() ? toRenderBlockFlow(&child) : nullptr;
     
     // If the child has the same directionality as we do, then we can just return its
     // margins in the same direction.
-    if (!child->isWritingModeRoot()) {
+    if (!child.isWritingModeRoot()) {
         if (childRenderBlock) {
             childBeforePositive = childRenderBlock->maxPositiveMarginBefore();
             childBeforeNegative = childRenderBlock->maxNegativeMarginBefore();
             childAfterPositive = childRenderBlock->maxPositiveMarginAfter();
             childAfterNegative = childRenderBlock->maxNegativeMarginAfter();
         } else {
-            beforeMargin = child->marginBefore();
-            afterMargin = child->marginAfter();
+            beforeMargin = child.marginBefore();
+            afterMargin = child.marginAfter();
         }
-    } else if (child->isHorizontalWritingMode() == isHorizontalWritingMode()) {
+    } else if (child.isHorizontalWritingMode() == isHorizontalWritingMode()) {
         // The child has a different directionality. If the child is parallel, then it's just
         // flipped relative to us. We can use the margins for the opposite edges.
         if (childRenderBlock) {
@@ -750,8 +766,8 @@
             childAfterPositive = childRenderBlock->maxPositiveMarginBefore();
             childAfterNegative = childRenderBlock->maxNegativeMarginBefore();
         } else {
-            beforeMargin = child->marginAfter();
-            afterMargin = child->marginBefore();
+            beforeMargin = child.marginAfter();
+            afterMargin = child.marginBefore();
         }
     } else {
         // The child is perpendicular to us, which means its margins don't collapse but are on the
@@ -777,11 +793,11 @@
     return MarginValues(childBeforePositive, childBeforeNegative, childAfterPositive, childAfterNegative);
 }
 
-LayoutUnit RenderBlockFlow::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
+LayoutUnit RenderBlockFlow::collapseMargins(RenderBox& child, MarginInfo& marginInfo)
 {
     bool childDiscardMarginBefore = mustDiscardMarginBeforeForChild(child);
     bool childDiscardMarginAfter = mustDiscardMarginAfterForChild(child);
-    bool childIsSelfCollapsing = child->isSelfCollapsingBlock();
+    bool childIsSelfCollapsing = child.isSelfCollapsingBlock();
 
     // The child discards the before margin when the the after margin has discard in the case of a self collapsing block.
     childDiscardMarginBefore = childDiscardMarginBefore || (childDiscardMarginAfter && childIsSelfCollapsing);
@@ -912,10 +928,10 @@
     // or clear it anyway, so don't worry about any floating children it may contain.
     LayoutUnit oldLogicalHeight = logicalHeight();
     setLogicalHeight(logicalTop);
-    RenderObject* prev = child->previousSibling();
+    RenderObject* prev = child.previousSibling();
     if (prev && prev->isRenderBlockFlow() && !prev->isFloatingOrOutOfFlowPositioned()) {
-        RenderBlockFlow* block = toRenderBlockFlow(prev);
-        if (block->containsFloats() && !block->avoidsFloats() && (block->logicalTop() + block->lowestFloatLogicalBottom()) > logicalTop) 
+        RenderBlockFlow& block = toRenderBlockFlow(*prev);
+        if (block.containsFloats() && !block.avoidsFloats() && (block.logicalTop() + block.lowestFloatLogicalBottom()) > logicalTop)
             addOverhangingFloats(block, false);
     }
     setLogicalHeight(oldLogicalHeight);
@@ -923,13 +939,13 @@
     return logicalTop;
 }
 
-LayoutUnit RenderBlockFlow::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos)
+LayoutUnit RenderBlockFlow::clearFloatsIfNeeded(RenderBox& child, MarginInfo& marginInfo, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos)
 {
     LayoutUnit heightIncrease = getClearDelta(child, yPos);
     if (!heightIncrease)
         return yPos;
 
-    if (child->isSelfCollapsingBlock()) {
+    if (child.isSelfCollapsingBlock()) {
         bool childDiscardMargin = mustDiscardMarginBeforeForChild(child) || mustDiscardMarginAfterForChild(child);
 
         // For self-collapsing blocks that clear, they can still collapse their
@@ -950,7 +966,7 @@
         // So the parent's bottom margin cannot collapse through this block or any subsequent self-collapsing blocks. Check subsequent siblings
         // for a block with height - if none is found then don't allow the margins to collapse with the parent.
         bool wouldCollapseMarginsWithParent = marginInfo.canCollapseMarginAfterWithChildren();
-        for (RenderBox* curr = child->nextSiblingBox(); curr && wouldCollapseMarginsWithParent; curr = curr->nextSiblingBox()) {
+        for (RenderBox* curr = child.nextSiblingBox(); curr && wouldCollapseMarginsWithParent; curr = curr->nextSiblingBox()) {
             if (!curr->isFloatingOrOutOfFlowPositioned() && !curr->isSelfCollapsingBlock())
                 wouldCollapseMarginsWithParent = false;
         }
@@ -960,7 +976,7 @@
         // CSS2.1: "the amount of clearance is set so that clearance + margin-top = [height of float], i.e., clearance = [height of float] - margin-top"
         // Move the top of the child box to the bottom of the float ignoring the child's top margin.
         LayoutUnit collapsedMargin = collapsedMarginBeforeForChild(child);
-        setLogicalHeight(child->logicalTop() - collapsedMargin);
+        setLogicalHeight(child.logicalTop() - collapsedMargin);
         // A negative collapsed margin-top value cancels itself out as it has already been factored into |yPos| above.
         heightIncrease -= max(LayoutUnit(), collapsedMargin);
     } else
@@ -983,23 +999,23 @@
     LayoutUnit logicalTop = yPos + heightIncrease;
     // After margin collapsing, one of our floats may now intrude into the child. If the child doesn't contain floats of its own it
     // won't get picked up for relayout even though the logical top estimate was wrong - so add the newly intruding float now.
-    if (containsFloats() && child->isRenderBlockFlow() && !toRenderBlockFlow(child)->containsFloats() && !child->avoidsFloats() && lowestFloatLogicalBottom() > logicalTop)
-        toRenderBlockFlow(child)->addIntrudingFloats(this, logicalLeftOffsetForContent(), logicalTop);
+    if (containsFloats() && child.isRenderBlockFlow() && !toRenderBlockFlow(child).containsFloats() && !child.avoidsFloats() && lowestFloatLogicalBottom() > logicalTop)
+        toRenderBlockFlow(child).addIntrudingFloats(this, logicalLeftOffsetForContent(), logicalTop);
 
     return logicalTop;
 }
 
-void RenderBlockFlow::marginBeforeEstimateForChild(RenderBox* child, LayoutUnit& positiveMarginBefore, LayoutUnit& negativeMarginBefore, bool& discardMarginBefore) const
+void RenderBlockFlow::marginBeforeEstimateForChild(RenderBox& child, LayoutUnit& positiveMarginBefore, LayoutUnit& negativeMarginBefore, bool& discardMarginBefore) const
 {
     // Give up if in quirks mode and we're a body/table cell and the top margin of the child box is quirky.
     // Give up if the child specified -webkit-margin-collapse: separate that prevents collapsing.
     // FIXME: Use writing mode independent accessor for marginBeforeCollapse.
-    if ((document().inQuirksMode() && hasMarginAfterQuirk(child) && (isTableCell() || isBody())) || child->style()->marginBeforeCollapse() == MSEPARATE)
+    if ((document().inQuirksMode() && hasMarginAfterQuirk(child) && (isTableCell() || isBody())) || child.style()->marginBeforeCollapse() == MSEPARATE)
         return;
 
     // The margins are discarded by a child that specified -webkit-margin-collapse: discard.
     // FIXME: Use writing mode independent accessor for marginBeforeCollapse.
-    if (child->style()->marginBeforeCollapse() == MDISCARD) {
+    if (child.style()->marginBeforeCollapse() == MDISCARD) {
         positiveMarginBefore = 0;
         negativeMarginBefore = 0;
         discardMarginBefore = true;
@@ -1010,19 +1026,19 @@
     positiveMarginBefore = max(positiveMarginBefore, beforeChildMargin);
     negativeMarginBefore = max(negativeMarginBefore, -beforeChildMargin);
 
-    if (!child->isRenderBlockFlow())
+    if (!child.isRenderBlockFlow())
         return;
     
-    RenderBlockFlow* childBlock = toRenderBlockFlow(child);
-    if (childBlock->childrenInline() || childBlock->isWritingModeRoot())
+    RenderBlockFlow& childBlock = toRenderBlockFlow(child);
+    if (childBlock.childrenInline() || childBlock.isWritingModeRoot())
         return;
 
-    MarginInfo childMarginInfo(childBlock, childBlock->borderAndPaddingBefore(), childBlock->borderAndPaddingAfter());
+    MarginInfo childMarginInfo(childBlock, childBlock.borderAndPaddingBefore(), childBlock.borderAndPaddingAfter());
     if (!childMarginInfo.canCollapseMarginBeforeWithChildren())
         return;
 
-    RenderBox* grandchildBox = childBlock->firstChildBox();
-    for ( ; grandchildBox; grandchildBox = grandchildBox->nextSiblingBox()) {
+    RenderBox* grandchildBox = childBlock.firstChildBox();
+    for (; grandchildBox; grandchildBox = grandchildBox->nextSiblingBox()) {
         if (!grandchildBox->isFloatingOrOutOfFlowPositioned())
             break;
     }
@@ -1042,10 +1058,10 @@
     }
 
     // Collapse the margin of the grandchild box with our own to produce an estimate.
-    childBlock->marginBeforeEstimateForChild(grandchildBox, positiveMarginBefore, negativeMarginBefore, discardMarginBefore);
+    childBlock.marginBeforeEstimateForChild(*grandchildBox, positiveMarginBefore, negativeMarginBefore, discardMarginBefore);
 }
 
-LayoutUnit RenderBlockFlow::estimateLogicalTopPosition(RenderBox* child, const MarginInfo& marginInfo, LayoutUnit& estimateWithoutPagination)
+LayoutUnit RenderBlockFlow::estimateLogicalTopPosition(RenderBox& child, const MarginInfo& marginInfo, LayoutUnit& estimateWithoutPagination)
 {
     // FIXME: We need to eliminate the estimation of vertical position, because when it's wrong we sometimes trigger a pathological
     // relayout if there are intruding floats.
@@ -1054,7 +1070,7 @@
         LayoutUnit positiveMarginBefore = 0;
         LayoutUnit negativeMarginBefore = 0;
         bool discardMarginBefore = false;
-        if (child->selfNeedsLayout()) {
+        if (child.selfNeedsLayout()) {
             // Try to do a basic estimation of how the collapse is going to go.
             marginBeforeEstimateForChild(child, positiveMarginBefore, negativeMarginBefore, discardMarginBefore);
         } else {
@@ -1089,8 +1105,8 @@
         // For replaced elements and scrolled elements, we want to shift them to the next page if they don't fit on the current one.
         logicalTopEstimate = adjustForUnsplittableChild(child, logicalTopEstimate);
         
-        if (!child->selfNeedsLayout() && child->isRenderBlock())
-            logicalTopEstimate += toRenderBlock(child)->paginationStrut();
+        if (!child.selfNeedsLayout() && child.isRenderBlock())
+            logicalTopEstimate += toRenderBlock(child).paginationStrut();
     }
 
     return logicalTopEstimate;
@@ -1144,9 +1160,9 @@
 void RenderBlockFlow::setMaxMarginBeforeValues(LayoutUnit pos, LayoutUnit neg)
 {
     if (!m_rareData) {
-        if (pos == RenderBlockFlowRareData::positiveMarginBeforeDefault(this) && neg == RenderBlockFlowRareData::negativeMarginBeforeDefault(this))
+        if (pos == RenderBlockFlowRareData::positiveMarginBeforeDefault(*this) && neg == RenderBlockFlowRareData::negativeMarginBeforeDefault(*this))
             return;
-        m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+        m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
     }
     m_rareData->m_margins.setPositiveMarginBefore(pos);
     m_rareData->m_margins.setNegativeMarginBefore(neg);
@@ -1155,9 +1171,9 @@
 void RenderBlockFlow::setMaxMarginAfterValues(LayoutUnit pos, LayoutUnit neg)
 {
     if (!m_rareData) {
-        if (pos == RenderBlockFlowRareData::positiveMarginAfterDefault(this) && neg == RenderBlockFlowRareData::negativeMarginAfterDefault(this))
+        if (pos == RenderBlockFlowRareData::positiveMarginAfterDefault(*this) && neg == RenderBlockFlowRareData::negativeMarginAfterDefault(*this))
             return;
-        m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+        m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
     }
     m_rareData->m_margins.setPositiveMarginAfter(pos);
     m_rareData->m_margins.setNegativeMarginAfter(neg);
@@ -1174,7 +1190,7 @@
         return;
 
     if (!m_rareData)
-        m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+        m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
 
     m_rareData->m_discardMarginBefore = value;
 }
@@ -1190,7 +1206,7 @@
         return;
 
     if (!m_rareData)
-        m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+        m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
 
     m_rareData->m_discardMarginAfter = value;
 }
@@ -1205,61 +1221,61 @@
     return style()->marginAfterCollapse() == MDISCARD || (m_rareData && m_rareData->m_discardMarginAfter);
 }
 
-bool RenderBlockFlow::mustDiscardMarginBeforeForChild(const RenderBox* child) const
+bool RenderBlockFlow::mustDiscardMarginBeforeForChild(const RenderBox& child) const
 {
-    ASSERT(!child->selfNeedsLayout());
-    if (!child->isWritingModeRoot())
-        return child->isRenderBlockFlow() ? toRenderBlockFlow(child)->mustDiscardMarginBefore() : (child->style()->marginBeforeCollapse() == MDISCARD);
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->isRenderBlockFlow() ? toRenderBlockFlow(child)->mustDiscardMarginAfter() : (child->style()->marginAfterCollapse() == MDISCARD);
+    ASSERT(!child.selfNeedsLayout());
+    if (!child.isWritingModeRoot())
+        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginBefore() : (child.style()->marginBeforeCollapse() == MDISCARD);
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginAfter() : (child.style()->marginAfterCollapse() == MDISCARD);
 
     // FIXME: We return false here because the implementation is not geometrically complete. We have values only for before/after, not start/end.
     // In case the boxes are perpendicular we assume the property is not specified.
     return false;
 }
 
-bool RenderBlockFlow::mustDiscardMarginAfterForChild(const RenderBox* child) const
+bool RenderBlockFlow::mustDiscardMarginAfterForChild(const RenderBox& child) const
 {
-    ASSERT(!child->selfNeedsLayout());
-    if (!child->isWritingModeRoot())
-        return child->isRenderBlockFlow() ? toRenderBlockFlow(child)->mustDiscardMarginAfter() : (child->style()->marginAfterCollapse() == MDISCARD);
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
-        return child->isRenderBlockFlow() ? toRenderBlockFlow(child)->mustDiscardMarginBefore() : (child->style()->marginBeforeCollapse() == MDISCARD);
+    ASSERT(!child.selfNeedsLayout());
+    if (!child.isWritingModeRoot())
+        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginAfter() : (child.style()->marginAfterCollapse() == MDISCARD);
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
+        return child.isRenderBlockFlow() ? toRenderBlockFlow(child).mustDiscardMarginBefore() : (child.style()->marginBeforeCollapse() == MDISCARD);
 
     // FIXME: See |mustDiscardMarginBeforeForChild| above.
     return false;
 }
 
-bool RenderBlockFlow::mustSeparateMarginBeforeForChild(const RenderBox* child) const
+bool RenderBlockFlow::mustSeparateMarginBeforeForChild(const RenderBox& child) const
 {
-    ASSERT(!child->selfNeedsLayout());
-    const RenderStyle* childStyle = child->style();
-    if (!child->isWritingModeRoot())
+    ASSERT(!child.selfNeedsLayout());
+    const RenderStyle* childStyle = child.style();
+    if (!child.isWritingModeRoot())
         return childStyle->marginBeforeCollapse() == MSEPARATE;
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
         return childStyle->marginAfterCollapse() == MSEPARATE;
 
     // FIXME: See |mustDiscardMarginBeforeForChild| above.
     return false;
 }
 
-bool RenderBlockFlow::mustSeparateMarginAfterForChild(const RenderBox* child) const
+bool RenderBlockFlow::mustSeparateMarginAfterForChild(const RenderBox& child) const
 {
-    ASSERT(!child->selfNeedsLayout());
-    const RenderStyle* childStyle = child->style();
-    if (!child->isWritingModeRoot())
+    ASSERT(!child.selfNeedsLayout());
+    const RenderStyle* childStyle = child.style();
+    if (!child.isWritingModeRoot())
         return childStyle->marginAfterCollapse() == MSEPARATE;
-    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
+    if (child.isHorizontalWritingMode() == isHorizontalWritingMode())
         return childStyle->marginBeforeCollapse() == MSEPARATE;
 
     // FIXME: See |mustDiscardMarginBeforeForChild| above.
     return false;
 }
 
-static bool inNormalFlow(RenderBox* child)
+static bool inNormalFlow(RenderBox& child)
 {
-    RenderBlock* curr = child->containingBlock();
-    while (curr && curr != &child->view()) {
+    RenderBlock* curr = child.containingBlock();
+    while (curr && curr != &child.view()) {
         if (curr->hasColumns() || curr->isRenderFlowThread())
             return true;
         if (curr->isFloatingOrOutOfFlowPositioned())
@@ -1269,21 +1285,21 @@
     return true;
 }
 
-LayoutUnit RenderBlockFlow::applyBeforeBreak(RenderBox* child, LayoutUnit logicalOffset)
+LayoutUnit RenderBlockFlow::applyBeforeBreak(RenderBox& child, LayoutUnit logicalOffset)
 {
     // FIXME: Add page break checking here when we support printing.
     bool checkColumnBreaks = view().layoutState()->isPaginatingColumns();
     bool checkPageBreaks = !checkColumnBreaks && view().layoutState()->m_pageLogicalHeight; // FIXME: Once columns can print we have to check this.
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     bool checkRegionBreaks = flowThread && flowThread->isRenderNamedFlowThread();
-    bool checkBeforeAlways = (checkColumnBreaks && child->style()->columnBreakBefore() == PBALWAYS) || (checkPageBreaks && child->style()->pageBreakBefore() == PBALWAYS)
-        || (checkRegionBreaks && child->style()->regionBreakBefore() == PBALWAYS);
+    bool checkBeforeAlways = (checkColumnBreaks && child.style()->columnBreakBefore() == PBALWAYS) || (checkPageBreaks && child.style()->pageBreakBefore() == PBALWAYS)
+        || (checkRegionBreaks && child.style()->regionBreakBefore() == PBALWAYS);
     if (checkBeforeAlways && inNormalFlow(child) && hasNextPage(logicalOffset, IncludePageBoundary)) {
         if (checkColumnBreaks)
-            view().layoutState()->addForcedColumnBreak(child, logicalOffset);
+            view().layoutState()->addForcedColumnBreak(&child, logicalOffset);
         if (checkRegionBreaks) {
             LayoutUnit offsetBreakAdjustment = 0;
-            if (flowThread->addForcedRegionBreak(this, offsetFromLogicalTopOfFirstPage() + logicalOffset, child, true, &offsetBreakAdjustment))
+            if (flowThread->addForcedRegionBreak(this, offsetFromLogicalTopOfFirstPage() + logicalOffset, &child, true, &offsetBreakAdjustment))
                 return logicalOffset + offsetBreakAdjustment;
         }
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
@@ -1291,15 +1307,15 @@
     return logicalOffset;
 }
 
-LayoutUnit RenderBlockFlow::applyAfterBreak(RenderBox* child, LayoutUnit logicalOffset, MarginInfo& marginInfo)
+LayoutUnit RenderBlockFlow::applyAfterBreak(RenderBox& child, LayoutUnit logicalOffset, MarginInfo& marginInfo)
 {
     // FIXME: Add page break checking here when we support printing.
     bool checkColumnBreaks = view().layoutState()->isPaginatingColumns();
     bool checkPageBreaks = !checkColumnBreaks && view().layoutState()->m_pageLogicalHeight; // FIXME: Once columns can print we have to check this.
     RenderFlowThread* flowThread = flowThreadContainingBlock();
     bool checkRegionBreaks = flowThread && flowThread->isRenderNamedFlowThread();
-    bool checkAfterAlways = (checkColumnBreaks && child->style()->columnBreakAfter() == PBALWAYS) || (checkPageBreaks && child->style()->pageBreakAfter() == PBALWAYS)
-        || (checkRegionBreaks && child->style()->regionBreakAfter() == PBALWAYS);
+    bool checkAfterAlways = (checkColumnBreaks && child.style()->columnBreakAfter() == PBALWAYS) || (checkPageBreaks && child.style()->pageBreakAfter() == PBALWAYS)
+        || (checkRegionBreaks && child.style()->regionBreakAfter() == PBALWAYS);
     if (checkAfterAlways && inNormalFlow(child) && hasNextPage(logicalOffset, IncludePageBoundary)) {
         LayoutUnit marginOffset = marginInfo.canCollapseWithMarginBefore() ? LayoutUnit() : marginInfo.margin();
 
@@ -1307,10 +1323,10 @@
         marginInfo.clearMargin();
 
         if (checkColumnBreaks)
-            view().layoutState()->addForcedColumnBreak(child, logicalOffset);
+            view().layoutState()->addForcedColumnBreak(&child, logicalOffset);
         if (checkRegionBreaks) {
             LayoutUnit offsetBreakAdjustment = 0;
-            if (flowThread->addForcedRegionBreak(this, offsetFromLogicalTopOfFirstPage() + logicalOffset + marginOffset, child, false, &offsetBreakAdjustment))
+            if (flowThread->addForcedRegionBreak(this, offsetFromLogicalTopOfFirstPage() + logicalOffset + marginOffset, &child, false, &offsetBreakAdjustment))
                 return logicalOffset + marginOffset + offsetBreakAdjustment;
         }
         return nextPageLogicalTop(logicalOffset, IncludePageBoundary);
@@ -1318,9 +1334,9 @@
     return logicalOffset;
 }
 
-LayoutUnit RenderBlockFlow::adjustBlockChildForPagination(LayoutUnit logicalTopAfterClear, LayoutUnit estimateWithoutPagination, RenderBox* child, bool atBeforeSideOfBlock)
+LayoutUnit RenderBlockFlow::adjustBlockChildForPagination(LayoutUnit logicalTopAfterClear, LayoutUnit estimateWithoutPagination, RenderBox& child, bool atBeforeSideOfBlock)
 {
-    RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
+    RenderBlock* childRenderBlock = child.isRenderBlock() ? toRenderBlock(&child) : nullptr;
 
     if (estimateWithoutPagination != logicalTopAfterClear) {
         // Our guess prior to pagination movement was wrong. Before we attempt to paginate, let's try again at the new
@@ -1328,23 +1344,23 @@
         setLogicalHeight(logicalTopAfterClear);
         setLogicalTopForChild(child, logicalTopAfterClear, ApplyLayoutDelta);
 
-        if (child->shrinkToAvoidFloats()) {
+        if (child.shrinkToAvoidFloats()) {
             // The child's width depends on the line width.
             // When the child shifts to clear an item, its width can
             // change (because it has more available line width).
             // So go ahead and mark the item as dirty.
-            child->setChildNeedsLayout(MarkOnlyThis);
+            child.setChildNeedsLayout(MarkOnlyThis);
         }
         
         if (childRenderBlock) {
-            if (!child->avoidsFloats() && childRenderBlock->containsFloats())
+            if (!child.avoidsFloats() && childRenderBlock->containsFloats())
                 toRenderBlockFlow(childRenderBlock)->markAllDescendantsWithFloatsForLayout();
-            if (!child->needsLayout())
-                child->markForPaginationRelayoutIfNeeded();
+            if (!child.needsLayout())
+                child.markForPaginationRelayoutIfNeeded();
         }
 
         // Our guess was wrong. Make the child lay itself out again.
-        child->layoutIfNeeded();
+        child.layoutIfNeeded();
     }
 
     LayoutUnit oldTop = logicalTopAfterClear;
@@ -1354,7 +1370,7 @@
 
     if (pageLogicalHeightForOffset(result)) {
         LayoutUnit remainingLogicalHeight = pageRemainingLogicalHeightForOffset(result, ExcludePageBoundary);
-        LayoutUnit spaceShortage = child->logicalHeight() - remainingLogicalHeight;
+        LayoutUnit spaceShortage = child.logicalHeight() - remainingLogicalHeight;
         if (spaceShortage > 0) {
             // If the child crosses a column boundary, report a break, in case nothing inside it has already
             // done so. The column balancer needs to know how much it has to stretch the columns to make more
@@ -1489,7 +1505,7 @@
 {
     ASSERT(lineToBreak >= 0);
     if (!m_rareData)
-        m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+        m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
 
     ASSERT(!m_rareData->m_didBreakAtLineToAvoidWidow);
     m_rareData->m_lineBreakToAvoidWidow = lineToBreak;
@@ -1555,9 +1571,9 @@
     // to this grid.
 }
 
-bool RenderBlockFlow::containsFloat(RenderBox* renderer) const
+bool RenderBlockFlow::containsFloat(RenderBox& renderer) const
 {
-    return m_floatingObjects && m_floatingObjects->set().contains<RenderBox&, FloatingObjectHashTranslator>(*renderer);
+    return m_floatingObjects && m_floatingObjects->set().contains<RenderBox&, FloatingObjectHashTranslator>(renderer);
 }
 
 void RenderBlockFlow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -1581,7 +1597,7 @@
                 if (currBlock->hasOverhangingFloats()) {
                     for (auto it = floatingObjectSet.begin(); it != end; ++it) {
                         RenderBox& renderer = (*it)->renderer();
-                        if (currBlock->hasOverhangingFloat(&renderer)) {
+                        if (currBlock->hasOverhangingFloat(renderer)) {
                             parentBlock = currBlock;
                             break;
                         }
@@ -1654,7 +1670,7 @@
             FloatingObject* floatingObject = it->get();
 
             // Don't insert the object again if it's already in the list
-            if (toBlockFlow->containsFloat(&floatingObject->renderer()))
+            if (toBlockFlow->containsFloat(floatingObject->renderer()))
                 continue;
 
             toBlockFlow->m_floatingObjects->add(floatingObject->unsafeClone());
@@ -1740,7 +1756,7 @@
     }
 }
 
-void RenderBlockFlow::clipOutFloatingObjects(RenderBlock* rootBlock, const PaintInfo* paintInfo, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock)
+void RenderBlockFlow::clipOutFloatingObjects(RenderBlock& rootBlock, const PaintInfo* paintInfo, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock)
 {
     if (m_floatingObjects) {
         const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
@@ -1750,7 +1766,7 @@
             LayoutRect floatBox(offsetFromRootBlock.width() + xPositionForFloatIncludingMargin(floatingObject),
                 offsetFromRootBlock.height() + yPositionForFloatIncludingMargin(floatingObject),
                 floatingObject->renderer().width(), floatingObject->renderer().height());
-            rootBlock->flipForWritingMode(floatBox);
+            rootBlock.flipForWritingMode(floatBox);
             floatBox.move(rootBlockPhysicalPosition.x(), rootBlockPhysicalPosition.y());
             paintInfo->context->clipOut(pixelSnappedIntRect(floatBox));
         }
@@ -1770,9 +1786,9 @@
     m_floatingObjects->clear();
 }
 
-FloatingObject* RenderBlockFlow::insertFloatingObject(RenderBox* floatBox)
+FloatingObject* RenderBlockFlow::insertFloatingObject(RenderBox& floatBox)
 {
-    ASSERT(floatBox->isFloating());
+    ASSERT(floatBox.isFloating());
 
     // Create the list of special objects if we don't aleady have one
     if (!m_floatingObjects)
@@ -1780,44 +1796,44 @@
     else {
         // Don't insert the floatingObject again if it's already in the list
         const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(*floatBox);
+        auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(floatBox);
         if (it != floatingObjectSet.end())
             return it->get();
     }
 
     // Create the special floatingObject entry & append it to the list
 
-    std::unique_ptr<FloatingObject> floatingObject = FloatingObject::create(*floatBox);
+    std::unique_ptr<FloatingObject> floatingObject = FloatingObject::create(floatBox);
     
     // Our location is irrelevant if we're unsplittable or no pagination is in effect.
     // Just go ahead and lay out the float.
-    bool isChildRenderBlock = floatBox->isRenderBlock();
-    if (isChildRenderBlock && !floatBox->needsLayout() && view().layoutState()->pageLogicalHeightChanged())
-        floatBox->setChildNeedsLayout(MarkOnlyThis);
+    bool isChildRenderBlock = floatBox.isRenderBlock();
+    if (isChildRenderBlock && !floatBox.needsLayout() && view().layoutState()->pageLogicalHeightChanged())
+        floatBox.setChildNeedsLayout(MarkOnlyThis);
             
     bool needsBlockDirectionLocationSetBeforeLayout = isChildRenderBlock && view().layoutState()->needsBlockDirectionLocationSetBeforeLayout();
     if (!needsBlockDirectionLocationSetBeforeLayout || isWritingModeRoot()) // We are unsplittable if we're a block flow root.
-        floatBox->layoutIfNeeded();
+        floatBox.layoutIfNeeded();
     else {
-        floatBox->updateLogicalWidth();
-        floatBox->computeAndSetBlockDirectionMargins(this);
+        floatBox.updateLogicalWidth();
+        floatBox.computeAndSetBlockDirectionMargins(this);
     }
 
     setLogicalWidthForFloat(floatingObject.get(), logicalWidthForChild(floatBox) + marginStartForChild(floatBox) + marginEndForChild(floatBox));
 
 #if ENABLE(CSS_SHAPES)
-    if (ShapeOutsideInfo* shapeOutside = floatBox->shapeOutsideInfo())
+    if (ShapeOutsideInfo* shapeOutside = floatBox.shapeOutsideInfo())
         shapeOutside->setShapeSize(logicalWidthForChild(floatBox), logicalHeightForChild(floatBox));
 #endif
 
     return m_floatingObjects->add(std::move(floatingObject));
 }
 
-void RenderBlockFlow::removeFloatingObject(RenderBox* floatBox)
+void RenderBlockFlow::removeFloatingObject(RenderBox& floatBox)
 {
     if (m_floatingObjects) {
         const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(*floatBox);
+        auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(floatBox);
         if (it != floatingObjectSet.end()) {
             FloatingObject* floatingObject = it->get();
             if (childrenInline()) {
@@ -1866,7 +1882,7 @@
 
 LayoutPoint RenderBlockFlow::computeLogicalLocationForFloat(const FloatingObject* floatingObject, LayoutUnit logicalTopOffset) const
 {
-    RenderBox* childBox = &floatingObject->renderer();
+    RenderBox& childBox = floatingObject->renderer();
     LayoutUnit logicalLeftOffset = logicalLeftOffsetForContent(logicalTopOffset); // Constant part of left offset.
     LayoutUnit logicalRightOffset; // Constant part of right offset.
 #if ENABLE(CSS_SHAPES)
@@ -1900,7 +1916,7 @@
 
     bool insideFlowThread = flowThreadContainingBlock();
 
-    if (childBox->style()->floating() == LeftFloat) {
+    if (childBox.style()->floating() == LeftFloat) {
         LayoutUnit heightRemainingLeft = 1;
         LayoutUnit heightRemainingRight = 1;
         floatLogicalLeft = logicalLeftOffsetForLineIgnoringShapeOutside(logicalTopOffset, logicalLeftOffset, false, &heightRemainingLeft);
@@ -1982,15 +1998,15 @@
         if (floatingObject->renderer().containingBlock() != this)
             continue;
 
-        RenderBox* childBox = &floatingObject->renderer();
+        RenderBox& childBox = floatingObject->renderer();
 
         LayoutUnit childLogicalLeftMargin = style()->isLeftToRightDirection() ? marginStartForChild(childBox) : marginEndForChild(childBox);
 
-        LayoutRect oldRect = childBox->frameRect();
+        LayoutRect oldRect = childBox.frameRect();
 
-        if (childBox->style()->clear() & CLEFT)
+        if (childBox.style()->clear() & CLEFT)
             logicalTop = max(lowestFloatLogicalBottom(FloatingObject::FloatLeft), logicalTop);
-        if (childBox->style()->clear() & CRIGHT)
+        if (childBox.style()->clear() & CRIGHT)
             logicalTop = max(lowestFloatLogicalBottom(FloatingObject::FloatRight), logicalTop);
 
         LayoutPoint floatLogicalLocation = computeLogicalLocationForFloat(floatingObject, logicalTop);
@@ -2004,10 +2020,10 @@
 
         LayoutState* layoutState = view().layoutState();
         bool isPaginated = layoutState->isPaginated();
-        if (isPaginated && !childBox->needsLayout())
-            childBox->markForPaginationRelayoutIfNeeded();
+        if (isPaginated && !childBox.needsLayout())
+            childBox.markForPaginationRelayoutIfNeeded();
         
-        childBox->layoutIfNeeded();
+        childBox.layoutIfNeeded();
 
         if (isPaginated) {
             // If we are unsplittable and don't fit, then we need to move down.
@@ -2017,7 +2033,7 @@
             // See if we have a pagination strut that is making us move down further.
             // Note that an unsplittable child can't also have a pagination strut, so this is
             // exclusive with the case above.
-            RenderBlock* childBlock = childBox->isRenderBlock() ? toRenderBlock(childBox) : 0;
+            RenderBlock* childBlock = childBox.isRenderBlock() ? toRenderBlock(&childBox) : nullptr;
             if (childBlock && childBlock->paginationStrut()) {
                 newLogicalTop += childBlock->paginationStrut();
                 childBlock->setPaginationStrut(0);
@@ -2034,12 +2050,12 @@
         
                 if (childBlock)
                     childBlock->setChildNeedsLayout(MarkOnlyThis);
-                childBox->layoutIfNeeded();
+                childBox.layoutIfNeeded();
             }
 
             if (updateRegionRangeForBoxChild(childBox)) {
-                childBox->setNeedsLayout(MarkOnlyThis);
-                childBox->layoutIfNeeded();
+                childBox.setNeedsLayout(MarkOnlyThis);
+                childBox.layoutIfNeeded();
             }
         }
 
@@ -2050,8 +2066,8 @@
         m_floatingObjects->addPlacedObject(floatingObject);
 
         // If the child moved, we have to repaint it.
-        if (childBox->checkForRepaintDuringLayout())
-            childBox->repaintDuringLayoutIfMoved(oldRect);
+        if (childBox.checkForRepaintDuringLayout())
+            childBox.repaintDuringLayoutIfMoved(oldRect);
     }
     return true;
 }
@@ -2107,7 +2123,7 @@
 #if ENABLE(CSS_SHAPES)
         ShapeOutsideInfo* shapeOutside = floatingObject->renderer().shapeOutsideInfo();
         if (offsetMode == ShapeOutsideFloatShapeOffset && shapeOutside) {
-            LayoutUnit shapeBottom = logicalTopForFloat(floatingObject) + marginBeforeForChild(&(floatingObject->renderer())) + shapeOutside->shapeLogicalBottom();
+            LayoutUnit shapeBottom = logicalTopForFloat(floatingObject) + marginBeforeForChild(floatingObject->renderer()) + shapeOutside->shapeLogicalBottom();
             // Use the shapeBottom unless it extends outside of the margin box, in which case it is clipped.
             if (shapeBottom < floatBottom)
                 floatBottom = shapeBottom;
@@ -2135,20 +2151,20 @@
     return lowestFloatBottom;
 }
 
-LayoutUnit RenderBlockFlow::addOverhangingFloats(RenderBlockFlow* child, bool makeChildPaintOtherFloats)
+LayoutUnit RenderBlockFlow::addOverhangingFloats(RenderBlockFlow& child, bool makeChildPaintOtherFloats)
 {
     // Prevent floats from being added to the canvas by the root element, e.g., <html>.
-    if (child->hasOverflowClip() || !child->containsFloats() || child->isRoot() || child->hasColumns() || child->isWritingModeRoot())
+    if (child.hasOverflowClip() || !child.containsFloats() || child.isRoot() || child.hasColumns() || child.isWritingModeRoot())
         return 0;
 
-    LayoutUnit childLogicalTop = child->logicalTop();
-    LayoutUnit childLogicalLeft = child->logicalLeft();
+    LayoutUnit childLogicalTop = child.logicalTop();
+    LayoutUnit childLogicalLeft = child.logicalLeft();
     LayoutUnit lowestFloatLogicalBottom = 0;
 
     // Floats that will remain the child's responsibility to paint should factor into its
     // overflow.
-    auto childEnd = child->m_floatingObjects->set().end();
-    for (auto childIt = child->m_floatingObjects->set().begin(); childIt != childEnd; ++childIt) {
+    auto childEnd = child.m_floatingObjects->set().end();
+    for (auto childIt = child.m_floatingObjects->set().begin(); childIt != childEnd; ++childIt) {
         FloatingObject* floatingObject = childIt->get();
         LayoutUnit floatLogicalBottom = min(logicalBottomForFloat(floatingObject), LayoutUnit::max() - childLogicalTop);
         LayoutUnit logicalBottom = childLogicalTop + floatLogicalBottom;
@@ -2156,7 +2172,7 @@
 
         if (logicalBottom > logicalHeight()) {
             // If the object is not in the list, we add it now.
-            if (!containsFloat(&floatingObject->renderer())) {
+            if (!containsFloat(floatingObject->renderer())) {
                 LayoutSize offset = isHorizontalWritingMode() ? LayoutSize(-childLogicalLeft, -childLogicalTop) : LayoutSize(-childLogicalTop, -childLogicalLeft);
                 bool shouldPaint = false;
 
@@ -2176,7 +2192,7 @@
             }
         } else {
             if (makeChildPaintOtherFloats && !floatingObject->shouldPaint() && !floatingObject->renderer().hasSelfPaintingLayer()
-                && floatingObject->renderer().isDescendantOf(child) && floatingObject->renderer().enclosingFloatPaintingLayer() == child->enclosingFloatPaintingLayer()) {
+                && floatingObject->renderer().isDescendantOf(&child) && floatingObject->renderer().enclosingFloatPaintingLayer() == child.enclosingFloatPaintingLayer()) {
                 // The float is not overhanging from this block, so if it is a descendant of the child, the child should
                 // paint it (the other case is that it is intruding into the child), unless it has its own layer or enclosing
                 // layer.
@@ -2188,19 +2204,19 @@
             // Since the float doesn't overhang, it didn't get put into our list. We need to go ahead and add its overflow in to the
             // child now.
             if (floatingObject->isDescendant())
-                child->addOverflowFromChild(&floatingObject->renderer(), LayoutSize(xPositionForFloatIncludingMargin(floatingObject), yPositionForFloatIncludingMargin(floatingObject)));
+                child.addOverflowFromChild(&floatingObject->renderer(), LayoutSize(xPositionForFloatIncludingMargin(floatingObject), yPositionForFloatIncludingMargin(floatingObject)));
         }
     }
     return lowestFloatLogicalBottom;
 }
 
-bool RenderBlockFlow::hasOverhangingFloat(RenderBox* renderer)
+bool RenderBlockFlow::hasOverhangingFloat(RenderBox& renderer)
 {
     if (!m_floatingObjects || hasColumns() || !parent())
         return false;
 
     const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-    auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(*renderer);
+    auto it = floatingObjectSet.find<RenderBox&, FloatingObjectHashTranslator>(renderer);
     if (it == floatingObjectSet.end())
         return false;
 
@@ -2251,7 +2267,7 @@
     setChildNeedsLayout(markParents);
 
     if (floatToRemove)
-        removeFloatingObject(floatToRemove);
+        removeFloatingObject(*floatToRemove);
 
     // Iterate over our children and mark them as needed.
     if (!childrenInline()) {
@@ -2265,7 +2281,7 @@
                 continue;
             }
             RenderBlockFlow* childBlock = toRenderBlockFlow(child);
-            if ((floatToRemove ? childBlock->containsFloat(floatToRemove) : childBlock->containsFloats()) || childBlock->shrinkToAvoidFloats())
+            if ((floatToRemove ? childBlock->containsFloat(*floatToRemove) : childBlock->containsFloats()) || childBlock->shrinkToAvoidFloats())
                 childBlock->markAllDescendantsWithFloatsForLayout(floatToRemove, inLayout);
         }
     }
@@ -2285,25 +2301,25 @@
 
         RenderBlockFlow* nextBlock = toRenderBlockFlow(next);
         for (auto it = floatingObjectSet.begin(); it != end; ++it) {
-            RenderBox* floatingBox = &(*it)->renderer();
-            if (floatToRemove && floatingBox != floatToRemove)
+            RenderBox& floatingBox = (*it)->renderer();
+            if (floatToRemove && &floatingBox != floatToRemove)
                 continue;
             if (nextBlock->containsFloat(floatingBox))
-                nextBlock->markAllDescendantsWithFloatsForLayout(floatingBox);
+                nextBlock->markAllDescendantsWithFloatsForLayout(&floatingBox);
         }
     }
 }
 
-LayoutUnit RenderBlockFlow::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
+LayoutUnit RenderBlockFlow::getClearDelta(RenderBox& child, LayoutUnit logicalTop)
 {
     // There is no need to compute clearance if we have no floats.
     if (!containsFloats())
         return 0;
     
     // At least one float is present. We need to perform the clearance computation.
-    bool clearSet = child->style()->clear() != CNONE;
+    bool clearSet = child.style()->clear() != CNONE;
     LayoutUnit logicalBottom = 0;
-    switch (child->style()->clear()) {
+    switch (child.style()->clear()) {
     case CNONE:
         break;
     case CLEFT:
@@ -2319,7 +2335,7 @@
 
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
     LayoutUnit result = clearSet ? max<LayoutUnit>(0, logicalBottom - logicalTop) : LayoutUnit();
-    if (!result && child->avoidsFloats()) {
+    if (!result && child.avoidsFloats()) {
         LayoutUnit newLogicalTop = logicalTop;
         while (true) {
             LayoutUnit availableLogicalWidthAtNewLogicalTopOffset = availableLogicalWidthForLine(newLogicalTop, false, logicalHeightForChild(child));
@@ -2327,32 +2343,32 @@
                 return newLogicalTop - logicalTop;
 
             RenderRegion* region = regionAtBlockOffset(logicalTopForChild(child));
-            LayoutRect borderBox = child->borderBoxRectInRegion(region, DoNotCacheRenderBoxRegionInfo);
+            LayoutRect borderBox = child.borderBoxRectInRegion(region, DoNotCacheRenderBoxRegionInfo);
             LayoutUnit childLogicalWidthAtOldLogicalTopOffset = isHorizontalWritingMode() ? borderBox.width() : borderBox.height();
 
             // FIXME: None of this is right for perpendicular writing-mode children.
-            LayoutUnit childOldLogicalWidth = child->logicalWidth();
-            LayoutUnit childOldMarginLeft = child->marginLeft();
-            LayoutUnit childOldMarginRight = child->marginRight();
-            LayoutUnit childOldLogicalTop = child->logicalTop();
+            LayoutUnit childOldLogicalWidth = child.logicalWidth();
+            LayoutUnit childOldMarginLeft = child.marginLeft();
+            LayoutUnit childOldMarginRight = child.marginRight();
+            LayoutUnit childOldLogicalTop = child.logicalTop();
 
-            child->setLogicalTop(newLogicalTop);
-            child->updateLogicalWidth();
+            child.setLogicalTop(newLogicalTop);
+            child.updateLogicalWidth();
             region = regionAtBlockOffset(logicalTopForChild(child));
-            borderBox = child->borderBoxRectInRegion(region, DoNotCacheRenderBoxRegionInfo);
+            borderBox = child.borderBoxRectInRegion(region, DoNotCacheRenderBoxRegionInfo);
             LayoutUnit childLogicalWidthAtNewLogicalTopOffset = isHorizontalWritingMode() ? borderBox.width() : borderBox.height();
 
-            child->setLogicalTop(childOldLogicalTop);
-            child->setLogicalWidth(childOldLogicalWidth);
-            child->setMarginLeft(childOldMarginLeft);
-            child->setMarginRight(childOldMarginRight);
+            child.setLogicalTop(childOldLogicalTop);
+            child.setLogicalWidth(childOldLogicalWidth);
+            child.setMarginLeft(childOldMarginLeft);
+            child.setMarginRight(childOldMarginRight);
             
             if (childLogicalWidthAtNewLogicalTopOffset <= availableLogicalWidthAtNewLogicalTopOffset) {
                 // Even though we may not be moving, if the logical width did shrink because of the presence of new floats, then
                 // we need to force a relayout as though we shifted. This happens because of the dynamic addition of overhanging floats
                 // from previous siblings when negative margins exist on a child (see the addOverhangingFloats call at the end of collapseMargins).
                 if (childLogicalWidthAtOldLogicalTopOffset != childLogicalWidthAtNewLogicalTopOffset)
-                    child->setChildNeedsLayout(MarkOnlyThis);
+                    child.setChildNeedsLayout(MarkOnlyThis);
                 return newLogicalTop - logicalTop;
             }
 
@@ -2524,7 +2540,7 @@
     return lastLineBox()->logicalTop() + style->fontMetrics().ascent(lastRootBox()->baselineType());
 }
 
-GapRects RenderBlockFlow::inlineSelectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+GapRects RenderBlockFlow::inlineSelectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     GapRects result;
@@ -2557,7 +2573,7 @@
         
         LayoutRect logicalRect(curr->logicalLeft(), selTop, curr->logicalWidth(), selTop + selHeight);
         logicalRect.move(isHorizontalWritingMode() ? offsetFromRootBlock : offsetFromRootBlock.transposedSize());
-        LayoutRect physicalRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
+        LayoutRect physicalRect = rootBlock.logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
         if (!paintInfo || (isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
             || (!isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
             result.unite(curr->lineSelectionGap(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock, selTop, selHeight, cache, paintInfo));
@@ -2631,7 +2647,7 @@
     if (m_rareData)
         return *m_rareData;
 
-    m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+    m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
     return *m_rareData;
 }
 
@@ -2843,7 +2859,7 @@
         if (!isHorizontalWritingMode())
             point = point.transposedPoint();
         if (closestBox->renderer().isReplaced())
-            return positionForPointRespectingEditingBoundaries(this, &toRenderBox(closestBox->renderer()), point);
+            return positionForPointRespectingEditingBoundaries(*this, toRenderBox(closestBox->renderer()), point);
         return closestBox->renderer().positionForPoint(point);
     }
 
diff --git a/Source/WebCore/rendering/RenderBlockFlow.h b/Source/WebCore/rendering/RenderBlockFlow.h
index 900c27a..9d0df97 100644
--- a/Source/WebCore/rendering/RenderBlockFlow.h
+++ b/Source/WebCore/rendering/RenderBlockFlow.h
@@ -87,13 +87,13 @@
         LayoutUnit m_positiveMarginAfter;
         LayoutUnit m_negativeMarginAfter;
     };
-    MarginValues marginValuesForChild(RenderBox* child) const;
+    MarginValues marginValuesForChild(RenderBox& child) const;
 
     // Allocated only when some of these fields have non-default values
     struct RenderBlockFlowRareData {
         WTF_MAKE_NONCOPYABLE(RenderBlockFlowRareData); WTF_MAKE_FAST_ALLOCATED;
     public:
-        RenderBlockFlowRareData(const RenderBlockFlow* block)
+        RenderBlockFlowRareData(const RenderBlockFlow& block)
             : m_margins(positiveMarginBeforeDefault(block), negativeMarginBeforeDefault(block), positiveMarginAfterDefault(block), negativeMarginAfterDefault(block))
             , m_lineBreakToAvoidWidow(-1)
             , m_lineGridBox(nullptr)
@@ -104,21 +104,21 @@
         { 
         }
 
-        static LayoutUnit positiveMarginBeforeDefault(const RenderBlock* block)
+        static LayoutUnit positiveMarginBeforeDefault(const RenderBlock& block)
         { 
-            return std::max<LayoutUnit>(block->marginBefore(), 0);
+            return std::max<LayoutUnit>(block.marginBefore(), 0);
         }
-        static LayoutUnit negativeMarginBeforeDefault(const RenderBlock* block)
+        static LayoutUnit negativeMarginBeforeDefault(const RenderBlock& block)
         { 
-            return std::max<LayoutUnit>(-block->marginBefore(), 0);
+            return std::max<LayoutUnit>(-block.marginBefore(), 0);
         }
-        static LayoutUnit positiveMarginAfterDefault(const RenderBlock* block)
+        static LayoutUnit positiveMarginAfterDefault(const RenderBlock& block)
         {
-            return std::max<LayoutUnit>(block->marginAfter(), 0);
+            return std::max<LayoutUnit>(block.marginAfter(), 0);
         }
-        static LayoutUnit negativeMarginAfterDefault(const RenderBlock* block)
+        static LayoutUnit negativeMarginAfterDefault(const RenderBlock& block)
         {
-            return std::max<LayoutUnit>(-block->marginAfter(), 0);
+            return std::max<LayoutUnit>(-block.marginAfter(), 0);
         }
         
         MarginValues m_margins;
@@ -164,7 +164,7 @@
         LayoutUnit m_negativeMargin;
 
     public:
-        MarginInfo(RenderBlockFlow*, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding);
+        MarginInfo(RenderBlockFlow&, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding);
 
         void setAtBeforeSideOfBlock(bool b) { m_atBeforeSideOfBlock = b; }
         void setAtAfterSideOfBlock(bool b) { m_atAfterSideOfBlock = b; }
@@ -210,14 +210,17 @@
         LayoutUnit margin() const { return m_positiveMargin - m_negativeMargin; }
     };
 
-    void layoutBlockChild(RenderBox* child, MarginInfo&, LayoutUnit& previousFloatLogicalBottom, LayoutUnit& maxFloatLogicalBottom);
-    void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
+    void layoutBlockChild(RenderBox& child, MarginInfo&, LayoutUnit& previousFloatLogicalBottom, LayoutUnit& maxFloatLogicalBottom);
+    void adjustPositionedBlock(RenderBox& child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
 
-    LayoutUnit collapseMargins(RenderBox* child, MarginInfo&);
-    LayoutUnit clearFloatsIfNeeded(RenderBox* child, MarginInfo&, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos);
-    LayoutUnit estimateLogicalTopPosition(RenderBox* child, const MarginInfo&, LayoutUnit& estimateWithoutPagination);
-    void marginBeforeEstimateForChild(RenderBox*, LayoutUnit&, LayoutUnit&, bool&) const;
+    void setStaticInlinePositionForChild(RenderBox& child, LayoutUnit blockOffset, LayoutUnit inlinePosition);
+    void updateStaticInlinePositionForChild(RenderBox& child, LayoutUnit logicalTop);
+
+    LayoutUnit collapseMargins(RenderBox& child, MarginInfo&);
+    LayoutUnit clearFloatsIfNeeded(RenderBox& child, MarginInfo&, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos);
+    LayoutUnit estimateLogicalTopPosition(RenderBox& child, const MarginInfo&, LayoutUnit& estimateWithoutPagination);
+    void marginBeforeEstimateForChild(RenderBox&, LayoutUnit&, LayoutUnit&, bool&) const;
     void handleAfterSideOfBlock(LayoutUnit top, LayoutUnit bottom, MarginInfo&);
     void setCollapsedBottomMargin(const MarginInfo&);
 
@@ -236,7 +239,7 @@
     void setLineGridBox(RootInlineBox* box)
     {
         if (!m_rareData)
-            m_rareData = adoptPtr(new RenderBlockFlowRareData(this));
+            m_rareData = adoptPtr(new RenderBlockFlowRareData(*this));
         if (m_rareData->m_lineGridBox)
             m_rareData->m_lineGridBox->destroy(renderArena());
         m_rareData->m_lineGridBox = box;
@@ -247,14 +250,14 @@
     void setRenderNamedFlowFragment(RenderNamedFlowFragment*);
 
     bool containsFloats() const OVERRIDE { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
-    bool containsFloat(RenderBox*) const;
+    bool containsFloat(RenderBox&) const;
 
     virtual void deleteLines() OVERRIDE;
     virtual void computeOverflow(LayoutUnit oldClientAfterEdge, bool recomputeFloats = false) OVERRIDE;
 
     void removeFloatingObjects();
-    void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
-    void markSiblingsWithFloatsForLayout(RenderBox* floatToRemove = 0);
+    void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = nullptr, bool inLayout = true);
+    void markSiblingsWithFloatsForLayout(RenderBox* floatToRemove = nullptr);
 
     LayoutUnit logicalTopForFloat(const FloatingObject* floatingObject) const { return isHorizontalWritingMode() ? floatingObject->y() : floatingObject->x(); }
     LayoutUnit logicalBottomForFloat(const FloatingObject* floatingObject) const { return isHorizontalWritingMode() ? floatingObject->maxY() : floatingObject->maxX(); }
@@ -325,17 +328,17 @@
 #endif
 
 protected:
-    LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockFlowRareData::positiveMarginBeforeDefault(this); }
-    LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockFlowRareData::negativeMarginBeforeDefault(this); }
-    LayoutUnit maxPositiveMarginAfter() const { return m_rareData ? m_rareData->m_margins.positiveMarginAfter() : RenderBlockFlowRareData::positiveMarginAfterDefault(this); }
-    LayoutUnit maxNegativeMarginAfter() const { return m_rareData ? m_rareData->m_margins.negativeMarginAfter() : RenderBlockFlowRareData::negativeMarginAfterDefault(this); }
+    LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockFlowRareData::positiveMarginBeforeDefault(*this); }
+    LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockFlowRareData::negativeMarginBeforeDefault(*this); }
+    LayoutUnit maxPositiveMarginAfter() const { return m_rareData ? m_rareData->m_margins.positiveMarginAfter() : RenderBlockFlowRareData::positiveMarginAfterDefault(*this); }
+    LayoutUnit maxNegativeMarginAfter() const { return m_rareData ? m_rareData->m_margins.negativeMarginAfter() : RenderBlockFlowRareData::negativeMarginAfterDefault(*this); }
 
     void initMaxMarginValues()
     {
         if (!m_rareData)
             return;
-        m_rareData->m_margins = MarginValues(RenderBlockFlowRareData::positiveMarginBeforeDefault(this) , RenderBlockFlowRareData::negativeMarginBeforeDefault(this),
-            RenderBlockFlowRareData::positiveMarginAfterDefault(this), RenderBlockFlowRareData::negativeMarginAfterDefault(this));
+        m_rareData->m_margins = MarginValues(RenderBlockFlowRareData::positiveMarginBeforeDefault(*this) , RenderBlockFlowRareData::negativeMarginBeforeDefault(*this),
+            RenderBlockFlowRareData::positiveMarginAfterDefault(*this), RenderBlockFlowRareData::negativeMarginAfterDefault(*this));
         m_rareData->m_discardMarginBefore = false;
         m_rareData->m_discardMarginAfter = false;
     }
@@ -349,15 +352,14 @@
     bool mustDiscardMarginBefore() const;
     bool mustDiscardMarginAfter() const;
 
-    bool mustDiscardMarginBeforeForChild(const RenderBox*) const;
-    bool mustDiscardMarginAfterForChild(const RenderBox*) const;
+    bool mustDiscardMarginBeforeForChild(const RenderBox&) const;
+    bool mustDiscardMarginAfterForChild(const RenderBox&) const;
+    bool mustSeparateMarginBeforeForChild(const RenderBox&) const;
+    bool mustSeparateMarginAfterForChild(const RenderBox&) const;
 
-    bool mustSeparateMarginBeforeForChild(const RenderBox*) const;
-    bool mustSeparateMarginAfterForChild(const RenderBox*) const;
-
-    LayoutUnit applyBeforeBreak(RenderBox* child, LayoutUnit logicalOffset); // If the child has a before break, then return a new yPos that shifts to the top of the next page/column.
-    LayoutUnit applyAfterBreak(RenderBox* child, LayoutUnit logicalOffset, MarginInfo&); // If the child has an after break, then return a new offset that shifts to the top of the next page/column.
-    LayoutUnit adjustBlockChildForPagination(LayoutUnit logicalTopAfterClear, LayoutUnit estimateWithoutPagination, RenderBox* child, bool atBeforeSideOfBlock);
+    LayoutUnit applyBeforeBreak(RenderBox& child, LayoutUnit logicalOffset); // If the child has a before break, then return a new yPos that shifts to the top of the next page/column.
+    LayoutUnit applyAfterBreak(RenderBox& child, LayoutUnit logicalOffset, MarginInfo&); // If the child has an after break, then return a new offset that shifts to the top of the next page/column.
+    LayoutUnit adjustBlockChildForPagination(LayoutUnit logicalTopAfterClear, LayoutUnit estimateWithoutPagination, RenderBox& child, bool atBeforeSideOfBlock);
 
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle) OVERRIDE;
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle) OVERRIDE;
@@ -373,10 +375,10 @@
 
     virtual void moveAllChildrenIncludingFloatsTo(RenderBlock* toBlock, bool fullRemoveInsert) OVERRIDE;
     virtual void repaintOverhangingFloats(bool paintAllDescendants) OVERRIDE FINAL;
-    virtual void clipOutFloatingObjects(RenderBlock*, const PaintInfo*, const LayoutPoint&, const LayoutSize&) OVERRIDE;
+    virtual void clipOutFloatingObjects(RenderBlock&, const PaintInfo*, const LayoutPoint&, const LayoutSize&) OVERRIDE;
 
-    FloatingObject* insertFloatingObject(RenderBox*);
-    void removeFloatingObject(RenderBox*);
+    FloatingObject* insertFloatingObject(RenderBox&);
+    void removeFloatingObject(RenderBox&);
     void removeFloatingObjectsBelow(FloatingObject*, int logicalOffset);
     LayoutPoint computeLogicalLocationForFloat(const FloatingObject*, LayoutUnit logicalTopOffset) const;
 
@@ -391,11 +393,11 @@
     LayoutUnit lowestFloatLogicalBottom(FloatingObject::Type = FloatingObject::FloatLeftRight) const; 
     LayoutUnit nextFloatLogicalBottomBelow(LayoutUnit, ShapeOutsideFloatOffsetMode = ShapeOutsideFloatMarginBoxOffset) const;
     
-    LayoutUnit addOverhangingFloats(RenderBlockFlow* child, bool makeChildPaintOtherFloats);
-    bool hasOverhangingFloat(RenderBox*);
+    LayoutUnit addOverhangingFloats(RenderBlockFlow& child, bool makeChildPaintOtherFloats);
+    bool hasOverhangingFloat(RenderBox&);
     void addIntrudingFloats(RenderBlockFlow* prev, LayoutUnit xoffset, LayoutUnit yoffset);
     bool hasOverhangingFloats() { return parent() && !hasColumns() && containsFloats() && lowestFloatLogicalBottom() > logicalHeight(); }
-    LayoutUnit getClearDelta(RenderBox* child, LayoutUnit yPos);
+    LayoutUnit getClearDelta(RenderBox& child, LayoutUnit yPos);
 
     virtual bool hitTestFloats(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset) OVERRIDE;
     virtual bool hitTestInlineChildren(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
@@ -408,7 +410,7 @@
 
     void markLinesDirtyInBlockRange(LayoutUnit logicalTop, LayoutUnit logicalBottom, RootInlineBox* highest = 0);
 
-    virtual GapRects inlineSelectionGaps(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    virtual GapRects inlineSelectionGaps(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit& lastLogicalTop, LayoutUnit& lastLogicalLeft, LayoutUnit& lastLogicalRight, const LogicalSelectionOffsetCaches&, const PaintInfo*) OVERRIDE;
     
     Position positionForBox(InlineBox*, bool start = true) const;
@@ -428,7 +430,7 @@
     virtual RootInlineBox* createRootInlineBox(); // Subclassed by SVG and Ruby.
     InlineFlowBox* createLineBoxes(RenderObject*, const LineInfo&, InlineBox* childBox, bool startsNewSegment);
     RootInlineBox* constructLine(BidiRunList<BidiRun>&, const LineInfo&);
-    void setMarginsForRubyRun(BidiRun*, RenderRubyRun*, RenderObject*, const LineInfo&);
+    void setMarginsForRubyRun(BidiRun*, RenderRubyRun&, RenderObject*, const LineInfo&);
     void computeInlineDirectionPositionsForLine(RootInlineBox*, const LineInfo&, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&, WordMeasurements&);
     BidiRun* computeInlineDirectionPositionsForSegment(RootInlineBox*, const LineInfo&, ETextAlign, float& logicalLeft,
         float& availableLogicalWidth, BidiRun* firstRun, BidiRun* trailingSpaceRun, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache&, WordMeasurements&);
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index f5f099e..48a0217 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -84,7 +84,7 @@
 
 class LineBreaker {
 public:
-    LineBreaker(RenderBlockFlow* block)
+    LineBreaker(RenderBlockFlow& block)
         : m_block(block)
     {
         reset();
@@ -95,6 +95,7 @@
     bool lineWasHyphenated() { return m_hyphenated; }
     const Vector<RenderBox*>& positionedObjects() { return m_positionedObjects; }
     EClear clear() { return m_clear; }
+
 private:
     void reset();
 
@@ -102,7 +103,7 @@
     void skipTrailingWhitespace(InlineIterator&, const LineInfo&);
     void skipLeadingWhitespace(InlineBidiResolver&, LineInfo&, FloatingObject* lastFloatFromPreviousLine, LineWidth&);
 
-    RenderBlockFlow* m_block;
+    RenderBlockFlow& m_block;
     bool m_hyphenated;
     EClear m_clear;
     Vector<RenderBox*> m_positionedObjects;
@@ -324,23 +325,23 @@
 
 // FIXME: Don't let counters mark themselves as needing pref width recalcs during layout
 // so we don't need this hack.
-static inline void updateCounterIfNeeded(RenderText* o)
+static inline void updateCounterIfNeeded(RenderText& renderText)
 {
-    if (!o->preferredLogicalWidthsDirty() || !o->isCounter())
+    if (!renderText.preferredLogicalWidthsDirty() || !renderText.isCounter())
         return;
-    toRenderCounter(o)->updateCounter();
+    toRenderCounter(renderText).updateCounter();
 }
 
-static inline void dirtyLineBoxesForRenderer(RenderObject* o, bool fullLayout)
+static inline void dirtyLineBoxesForRenderer(RenderObject& renderer, bool fullLayout)
 {
-    if (o->isText()) {
-        RenderText* renderText = toRenderText(o);
+    if (renderer.isText()) {
+        RenderText& renderText = toRenderText(renderer);
         updateCounterIfNeeded(renderText);
-        renderText->dirtyLineBoxes(fullLayout);
-    } else if (o->isLineBreak())
-        toRenderLineBreak(o)->dirtyLineBoxes(fullLayout);
+        renderText.dirtyLineBoxes(fullLayout);
+    } else if (renderer.isLineBreak())
+        toRenderLineBreak(renderer).dirtyLineBoxes(fullLayout);
     else
-        toRenderInline(o)->dirtyLineBoxes(fullLayout);
+        toRenderInline(renderer).dirtyLineBoxes(fullLayout);
 }
 
 static bool parentIsConstructedOrHaveNext(InlineFlowBox* parentBox)
@@ -586,7 +587,7 @@
         logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
 }
 
-void RenderBlockFlow::setMarginsForRubyRun(BidiRun* run, RenderRubyRun* renderer, RenderObject* previousObject, const LineInfo& lineInfo)
+void RenderBlockFlow::setMarginsForRubyRun(BidiRun* run, RenderRubyRun& renderer, RenderObject* previousObject, const LineInfo& lineInfo)
 {
     int startOverhang;
     int endOverhang;
@@ -597,7 +598,7 @@
             break;
         }
     }
-    renderer->getOverhang(lineInfo.isFirstLine(), renderer->style()->isLeftToRightDirection() ? previousObject : nextObject, renderer->style()->isLeftToRightDirection() ? nextObject : previousObject, startOverhang, endOverhang);
+    renderer.getOverhang(lineInfo.isFirstLine(), renderer.style()->isLeftToRightDirection() ? previousObject : nextObject, renderer.style()->isLeftToRightDirection() ? nextObject : previousObject, startOverhang, endOverhang);
     setMarginStartForChild(renderer, -startOverhang);
     setMarginEndForChild(renderer, -endOverhang);
 }
@@ -927,8 +928,8 @@
         } else {
             isAfterExpansion = false;
             if (!r->m_object->isRenderInline()) {
-                RenderBox* renderBox = toRenderBox(r->m_object);
-                if (renderBox->isRubyRun())
+                RenderBox& renderBox = toRenderBox(*r->m_object);
+                if (renderBox.isRubyRun())
                     setMarginsForRubyRun(r, toRenderRubyRun(renderBox), previousObject, lineInfo);
                 r->m_box->setLogicalWidth(logicalWidthForChild(renderBox));
                 totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
@@ -993,21 +994,21 @@
 }
 
 
-static void setStaticPositions(RenderBlockFlow* block, RenderBox* child)
+static void setStaticPositions(RenderBlockFlow& block, RenderBox& child)
 {
     // FIXME: The math here is actually not really right. It's a best-guess approximation that
     // will work for the common cases
-    RenderElement* containerBlock = child->container();
-    LayoutUnit blockHeight = block->logicalHeight();
+    RenderElement* containerBlock = child.container();
+    LayoutUnit blockHeight = block.logicalHeight();
     if (containerBlock->isRenderInline()) {
         // A relative positioned inline encloses us. In this case, we also have to determine our
         // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
         // inline so that we can obtain the value later.
-        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block->startAlignedOffsetForLine(blockHeight, false));
+        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block.startAlignedOffsetForLine(blockHeight, false));
         toRenderInline(containerBlock)->layer()->setStaticBlockPosition(blockHeight);
     }
-    block->updateStaticInlinePositionForChild(child, blockHeight);
-    child->layer()->setStaticBlockPosition(blockHeight);
+    block.updateStaticInlinePositionForChild(child, blockHeight);
+    child.layer()->setStaticBlockPosition(blockHeight);
 }
 
 template <typename CharacterType>
@@ -1079,7 +1080,7 @@
 {
     ASSERT(!floatingObject->originatingLine());
     floatingObject->setOriginatingLine(lastRootBox());
-    lastRootBox()->appendFloat(&floatingObject->renderer());
+    lastRootBox()->appendFloat(floatingObject->renderer());
 }
 
 // FIXME: This should be a BidiStatus constructor or create method.
@@ -1128,7 +1129,7 @@
 
         // FIXME: The fact that we have to construct an Iterator here
         // currently prevents this code from moving into BidiResolver.
-        if (!bidiFirstSkippingEmptyInlines(isolatedInline, &isolatedResolver))
+        if (!bidiFirstSkippingEmptyInlines(*isolatedInline, &isolatedResolver))
             continue;
 
         // The starting position is the beginning of the first run within the isolate that was identified
@@ -1516,7 +1517,7 @@
     RenderTextInfo renderTextInfo;
     VerticalPositionCache verticalPositionCache;
 
-    LineBreaker lineBreaker(this);
+    LineBreaker lineBreaker(*this);
 
 #if ENABLE(CSS_SHAPES)
     LayoutSize logicalOffsetFromShapeContainer;
@@ -1645,7 +1646,7 @@
         }
 
         for (size_t i = 0; i < lineBreaker.positionedObjects().size(); ++i)
-            setStaticPositions(this, lineBreaker.positionedObjects()[i]);
+            setStaticPositions(*this, *lineBreaker.positionedObjects()[i]);
 
         if (!layoutState.lineInfo().isEmpty()) {
             layoutState.lineInfo().setFirstLine(false);
@@ -1665,7 +1666,7 @@
             for (; it != end; ++it) {
                 FloatingObject* f = it->get();
                 appendFloatingObjectToLastLine(f);
-                ASSERT(&f->renderer() == layoutState.floats()[layoutState.floatIndex()].object);
+                ASSERT(&f->renderer() == &layoutState.floats()[layoutState.floatIndex()].object);
                 // If a float's geometry has changed, give up on syncing with clean lines.
                 if (layoutState.floats()[layoutState.floatIndex()].rect != f->frameRect())
                     checkForEndLineMatch = false;
@@ -1761,12 +1762,12 @@
                 if (layoutState.flowThread())
                     updateRegionForLine(line);
                 if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
-                    Vector<RenderBox*>::iterator end = cleanLineFloats->end();
-                    for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
-                        FloatingObject* floatingObject = insertFloatingObject(*f);
+                    for (auto it = cleanLineFloats->begin(), end = cleanLineFloats->end(); it != end; ++it) {
+                        RenderBox* floatingBox = *it;
+                        FloatingObject* floatingObject = insertFloatingObject(*floatingBox);
                         ASSERT(!floatingObject->originatingLine());
                         floatingObject->setOriginatingLine(line);
-                        setLogicalHeight(logicalTopForChild(*f) - marginBeforeForChild(*f) + delta);
+                        setLogicalHeight(logicalTopForChild(*floatingBox) - marginBeforeForChild(*floatingBox) + delta);
                         positionNewFloats();
                     }
                 }
@@ -1824,9 +1825,9 @@
     // painted.
     for (size_t i = 0; i < floatCount; ++i) {
         if (!floats[i].everHadLayout) {
-            RenderBox* f = floats[i].object;
-            if (!f->x() && !f->y() && f->checkForRepaintDuringLayout())
-                f->repaint();
+            RenderBox& box = floats[i].object;
+            if (!box.x() && !box.y() && box.checkForRepaintDuringLayout())
+                box.repaint();
         }
     }
 }
@@ -1871,40 +1872,40 @@
         // elements at the same time.
         bool hasInlineChild = false;
         Vector<RenderBox*> replacedChildren;
-        for (InlineWalker walker(this); !walker.atEnd(); walker.advance()) {
-            RenderObject* o = walker.current();
+        for (InlineWalker walker(*this); !walker.atEnd(); walker.advance()) {
+            RenderObject& o = *walker.current();
 
-            if (!hasInlineChild && o->isInline())
+            if (!hasInlineChild && o.isInline())
                 hasInlineChild = true;
 
-            if (o->isReplaced() || o->isFloating() || o->isOutOfFlowPositioned()) {
-                RenderBox* box = toRenderBox(o);
+            if (o.isReplaced() || o.isFloating() || o.isOutOfFlowPositioned()) {
+                RenderBox& box = toRenderBox(o);
 
-                if (relayoutChildren || box->hasRelativeDimensions())
-                    box->setChildNeedsLayout(MarkOnlyThis);
+                if (relayoutChildren || box.hasRelativeDimensions())
+                    box.setChildNeedsLayout(MarkOnlyThis);
 
                 // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
-                if (relayoutChildren && box->needsPreferredWidthsRecalculation())
-                    o->setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
+                if (relayoutChildren && box.needsPreferredWidthsRecalculation())
+                    box.setPreferredLogicalWidthsDirty(true, MarkOnlyThis);
 
-                if (o->isOutOfFlowPositioned())
-                    o->containingBlock()->insertPositionedObject(box);
-                else if (o->isFloating())
+                if (box.isOutOfFlowPositioned())
+                    box.containingBlock()->insertPositionedObject(box);
+                else if (box.isFloating())
                     layoutState.floats().append(FloatWithRect(box));
-                else if (isFullLayout || o->needsLayout()) {
+                else if (isFullLayout || box.needsLayout()) {
                     // Replaced element.
-                    box->dirtyLineBoxes(isFullLayout);
+                    box.dirtyLineBoxes(isFullLayout);
                     if (isFullLayout)
-                        replacedChildren.append(box);
+                        replacedChildren.append(&box);
                     else
-                        box->layoutIfNeeded();
+                        box.layoutIfNeeded();
                 }
-            } else if (o->isTextOrLineBreak() || (o->isRenderInline() && !walker.atEndOfInline())) {
-                if (o->isRenderInline())
-                    toRenderInline(o)->updateAlwaysCreateLineBoxes(layoutState.isFullLayout());
-                if (layoutState.isFullLayout() || o->selfNeedsLayout())
+            } else if (o.isTextOrLineBreak() || (o.isRenderInline() && !walker.atEndOfInline())) {
+                if (o.isRenderInline())
+                    toRenderInline(o).updateAlwaysCreateLineBoxes(layoutState.isFullLayout());
+                if (layoutState.isFullLayout() || o.selfNeedsLayout())
                     dirtyLineBoxesForRenderer(o, layoutState.isFullLayout());
-                o->clearNeedsLayout();
+                o.clearNeedsLayout();
             }
         }
 
@@ -1942,21 +1943,19 @@
     if (!cleanLineFloats)
         return;
 
-    Vector<RenderBox*>::iterator end = cleanLineFloats->end();
-    for (Vector<RenderBox*>::iterator it = cleanLineFloats->begin(); it != end; ++it) {
+    for (auto it = cleanLineFloats->begin(), end = cleanLineFloats->end(); it != end; ++it) {
         RenderBox* floatingBox = *it;
         floatingBox->layoutIfNeeded();
         LayoutSize newSize(floatingBox->width() + floatingBox->marginWidth(), floatingBox->height() + floatingBox->marginHeight());
         ASSERT_WITH_SECURITY_IMPLICATION(floatIndex < floats.size());
-        if (floats[floatIndex].object != floatingBox) {
+        if (&floats[floatIndex].object != floatingBox) {
             encounteredNewFloat = true;
             return;
         }
 
         if (floats[floatIndex].rect.size() != newSize) {
             LayoutUnit floatTop = isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
-            LayoutUnit floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height())
-                                                                 : max(floats[floatIndex].rect.width(), newSize.width());
+            LayoutUnit floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) : max(floats[floatIndex].rect.width(), newSize.width());
             floatHeight = min(floatHeight, LayoutUnit::max() - floatTop);
             line->markDirty();
             markLinesDirtyInBlockRange(line->lineBottomWithLeading(), floatTop + floatHeight, line);
@@ -2048,14 +2047,14 @@
         RootInlineBox* line = firstRootBox();
         while (line != curr) {
             if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
-                Vector<RenderBox*>::iterator end = cleanLineFloats->end();
-                for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
-                    FloatingObject* floatingObject = insertFloatingObject(*f);
+                for (auto it = cleanLineFloats->begin(), end = cleanLineFloats->end(); it != end; ++it) {
+                    RenderBox* floatingBox = *it;
+                    FloatingObject* floatingObject = insertFloatingObject(*floatingBox);
                     ASSERT(!floatingObject->originatingLine());
                     floatingObject->setOriginatingLine(line);
-                    setLogicalHeight(logicalTopForChild(*f) - marginBeforeForChild(*f));
+                    setLogicalHeight(logicalTopForChild(*floatingBox) - marginBeforeForChild(*floatingBox));
                     positionNewFloats();
-                    ASSERT(layoutState.floats()[numCleanFloats].object == *f);
+                    ASSERT(&layoutState.floats()[numCleanFloats].object == floatingBox);
                     numCleanFloats++;
                 }
             }
@@ -2076,9 +2075,9 @@
     } else {
         TextDirection direction = style()->direction();
         if (style()->unicodeBidi() == Plaintext)
-            determineDirectionality(direction, InlineIterator(this, bidiFirstSkippingEmptyInlines(this), 0));
+            determineDirectionality(direction, InlineIterator(this, bidiFirstSkippingEmptyInlines(*this), 0));
         resolver.setStatus(BidiStatus(direction, isOverride(style()->unicodeBidi())));
-        InlineIterator iter = InlineIterator(this, bidiFirstSkippingEmptyInlines(this, &resolver), 0);
+        InlineIterator iter = InlineIterator(this, bidiFirstSkippingEmptyInlines(*this, &resolver), 0);
         resolver.setPosition(iter, numberOfIsolateAncestors(iter));
     }
     return curr;
@@ -2308,37 +2307,36 @@
 void LineBreaker::skipTrailingWhitespace(InlineIterator& iterator, const LineInfo& lineInfo)
 {
     while (!iterator.atEnd() && !requiresLineBox(iterator, lineInfo, TrailingWhitespace)) {
-        RenderObject* object = iterator.m_obj;
-        if (object->isOutOfFlowPositioned())
+        RenderObject& object = *iterator.m_obj;
+        if (object.isOutOfFlowPositioned())
             setStaticPositions(m_block, toRenderBox(object));
-        else if (object->isFloating())
-            m_block->insertFloatingObject(toRenderBox(object));
+        else if (object.isFloating())
+            m_block.insertFloatingObject(toRenderBox(object));
         iterator.increment();
     }
 }
 
-void LineBreaker::skipLeadingWhitespace(InlineBidiResolver& resolver, LineInfo& lineInfo,
-                                                     FloatingObject* lastFloatFromPreviousLine, LineWidth& width)
+void LineBreaker::skipLeadingWhitespace(InlineBidiResolver& resolver, LineInfo& lineInfo, FloatingObject* lastFloatFromPreviousLine, LineWidth& width)
 {
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), lineInfo, LeadingWhitespace)) {
-        RenderObject* object = resolver.position().m_obj;
-        if (object->isOutOfFlowPositioned()) {
+        RenderObject& object = *resolver.position().m_obj;
+        if (object.isOutOfFlowPositioned()) {
             setStaticPositions(m_block, toRenderBox(object));
-            if (object->style()->isOriginalDisplayInlineType()) {
-                resolver.runs().addRun(createRun(0, 1, object, resolver));
+            if (object.style()->isOriginalDisplayInlineType()) {
+                resolver.runs().addRun(createRun(0, 1, &object, resolver));
                 lineInfo.incrementRunsFromLeadingWhitespace();
             }
-        } else if (object->isFloating()) {
+        } else if (object.isFloating()) {
             // The top margin edge of a self-collapsing block that clears a float intrudes up into it by the height of the margin,
             // so in order to place this first child float at the top content edge of the self-collapsing block add the margin back in before placement.
-            LayoutUnit marginOffset = (!object->previousSibling() && m_block->isSelfCollapsingBlock() && m_block->style()->clear() && m_block->getClearDelta(m_block, LayoutUnit())) ? m_block->collapsedMarginBeforeForChild(m_block) : LayoutUnit();
-            LayoutUnit oldLogicalHeight = m_block->logicalHeight();
-            m_block->setLogicalHeight(oldLogicalHeight + marginOffset);
-            m_block->positionNewFloatOnLine(m_block->insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, lineInfo, width);
-            m_block->setLogicalHeight(oldLogicalHeight);
-        } else if (object->isText() && object->style()->hasTextCombine() && object->isCombineText() && !toRenderCombineText(*object).isCombined()) {
-            toRenderCombineText(*object).combineText();
-            if (toRenderCombineText(*object).isCombined())
+            LayoutUnit marginOffset = (!object.previousSibling() && m_block.isSelfCollapsingBlock() && m_block.style()->clear() && m_block.getClearDelta(m_block, LayoutUnit())) ? m_block.collapsedMarginBeforeForChild(m_block) : LayoutUnit();
+            LayoutUnit oldLogicalHeight = m_block.logicalHeight();
+            m_block.setLogicalHeight(oldLogicalHeight + marginOffset);
+            m_block.positionNewFloatOnLine(m_block.insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, lineInfo, width);
+            m_block.setLogicalHeight(oldLogicalHeight);
+        } else if (object.isText() && object.style()->hasTextCombine() && object.isCombineText() && !toRenderCombineText(object).isCombined()) {
+            toRenderCombineText(object).combineText();
+            if (toRenderCombineText(object).isCombined())
                 continue;
         }
         resolver.increment();
@@ -2348,7 +2346,7 @@
 
 // This is currently just used for list markers and inline flows that have line boxes. Neither should
 // have an effect on whitespace at the start of the line.
-static bool shouldSkipWhitespaceAfterStartObject(RenderBlockFlow* block, RenderObject* o, LineMidpointState& lineMidpointState)
+static bool shouldSkipWhitespaceAfterStartObject(RenderBlockFlow& block, RenderObject* o, LineMidpointState& lineMidpointState)
 {
     RenderObject* next = bidiNextSkippingEmptyInlines(block, o);
     while (next && next->isFloatingOrOutOfFlowPositioned())
@@ -2548,7 +2546,7 @@
 #if !ENABLE(CSS_SHAPES)
     return nextSegmentBreak(resolver, lineInfo, renderTextInfo, lastFloatFromPreviousLine, consecutiveHyphenatedLines, wordMeasurements);
 #else
-    ShapeInsideInfo* shapeInsideInfo = m_block->layoutShapeInsideInfo();
+    ShapeInsideInfo* shapeInsideInfo = m_block.layoutShapeInsideInfo();
 
     if (!shapeInsideInfo || !shapeInsideInfo->lineOverlapsShapeBounds())
         return nextSegmentBreak(resolver, lineInfo, renderTextInfo, lastFloatFromPreviousLine, consecutiveHyphenatedLines, wordMeasurements);
@@ -2657,23 +2655,23 @@
 }
 
 #if ENABLE(CSS_SHAPES)
-static void updateSegmentsForShapes(RenderBlockFlow* block, const FloatingObject* lastFloatFromPreviousLine, const WordMeasurements& wordMeasurements, LineWidth& width, bool isFirstLine)
+static void updateSegmentsForShapes(RenderBlockFlow& block, const FloatingObject* lastFloatFromPreviousLine, const WordMeasurements& wordMeasurements, LineWidth& width, bool isFirstLine)
 {
     ASSERT(lastFloatFromPreviousLine);
 
-    ShapeInsideInfo* shapeInsideInfo = block->layoutShapeInsideInfo();
+    ShapeInsideInfo* shapeInsideInfo = block.layoutShapeInsideInfo();
     if (!lastFloatFromPreviousLine->isPlaced() || !shapeInsideInfo)
         return;
 
-    bool isHorizontalWritingMode = block->isHorizontalWritingMode();
-    LayoutUnit logicalOffsetFromShapeContainer = block->logicalOffsetFromShapeAncestorContainer(shapeInsideInfo->owner()).height();
+    bool isHorizontalWritingMode = block.isHorizontalWritingMode();
+    LayoutUnit logicalOffsetFromShapeContainer = block.logicalOffsetFromShapeAncestorContainer(shapeInsideInfo->owner()).height();
 
-    LayoutUnit lineLogicalTop = block->logicalHeight() + logicalOffsetFromShapeContainer;
-    LayoutUnit lineLogicalHeight = block->lineHeight(isFirstLine, isHorizontalWritingMode ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes);
+    LayoutUnit lineLogicalTop = block.logicalHeight() + logicalOffsetFromShapeContainer;
+    LayoutUnit lineLogicalHeight = block.lineHeight(isFirstLine, isHorizontalWritingMode ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes);
     LayoutUnit lineLogicalBottom = lineLogicalTop + lineLogicalHeight;
 
-    LayoutUnit floatLogicalTop = block->logicalTopForFloat(lastFloatFromPreviousLine);
-    LayoutUnit floatLogicalBottom = block->logicalBottomForFloat(lastFloatFromPreviousLine);
+    LayoutUnit floatLogicalTop = block.logicalTopForFloat(lastFloatFromPreviousLine);
+    LayoutUnit floatLogicalBottom = block.logicalBottomForFloat(lastFloatFromPreviousLine);
 
     bool lineOverlapsWithFloat = (floatLogicalTop < lineLogicalBottom) && (lineLogicalTop < floatLogicalBottom);
     if (!lineOverlapsWithFloat)
@@ -2681,17 +2679,17 @@
 
     float minSegmentWidth = firstPositiveWidth(wordMeasurements);
 
-    LayoutUnit floatLogicalWidth = block->logicalWidthForFloat(lastFloatFromPreviousLine);
-    LayoutUnit availableLogicalWidth = block->logicalWidth() - block->logicalRightForFloat(lastFloatFromPreviousLine);
+    LayoutUnit floatLogicalWidth = block.logicalWidthForFloat(lastFloatFromPreviousLine);
+    LayoutUnit availableLogicalWidth = block.logicalWidth() - block.logicalRightForFloat(lastFloatFromPreviousLine);
     if (availableLogicalWidth < minSegmentWidth)
-        block->setLogicalHeight(floatLogicalBottom);
+        block.setLogicalHeight(floatLogicalBottom);
 
-    if (block->logicalHeight() < floatLogicalTop) {
+    if (block.logicalHeight() < floatLogicalTop) {
         shapeInsideInfo->adjustLogicalLineTop(minSegmentWidth + floatLogicalWidth);
-        block->setLogicalHeight(shapeInsideInfo->logicalLineTop() - logicalOffsetFromShapeContainer);
+        block.setLogicalHeight(shapeInsideInfo->logicalLineTop() - logicalOffsetFromShapeContainer);
     }
 
-    lineLogicalTop = block->logicalHeight() + logicalOffsetFromShapeContainer;
+    lineLogicalTop = block.logicalHeight() + logicalOffsetFromShapeContainer;
 
     shapeInsideInfo->updateSegmentsForLine(lineLogicalTop, lineLogicalHeight);
     width.updateCurrentShapeSegment();
@@ -2703,13 +2701,13 @@
 {
     reset();
 
-    ASSERT(resolver.position().root() == m_block);
+    ASSERT(resolver.position().root() == &m_block);
 
     bool appliedStartWidth = resolver.position().m_pos > 0;
     bool includeEndWidth = true;
     LineMidpointState& lineMidpointState = resolver.midpointState();
 
-    LineWidth width(*m_block, lineInfo.isFirstLine(), requiresIndent(lineInfo.isFirstLine(), lineInfo.previousLineBrokeCleanly(), *m_block->style()));
+    LineWidth width(m_block, lineInfo.isFirstLine(), requiresIndent(lineInfo.isFirstLine(), lineInfo.previousLineBrokeCleanly(), *m_block.style()));
 
     skipLeadingWhitespace(resolver, lineInfo, lastFloatFromPreviousLine, width);
 
@@ -2745,8 +2743,8 @@
     // Firefox and Opera will allow a table cell to grow to fit an image inside it under
     // very specific circumstances (in order to match common WinIE renderings).
     // Not supporting the quirk has caused us to mis-render some real sites. (See Bugzilla 10517.)
-    const RenderStyle& blockStyle = *m_block->style();
-    bool allowImagesToBreak = !m_block->document().inQuirksMode() || !m_block->isTableCell() || !blockStyle.logicalWidth().isIntrinsicOrAuto();
+    const RenderStyle& blockStyle = *m_block.style();
+    bool allowImagesToBreak = !m_block.document().inQuirksMode() || !m_block.isTableCell() || !blockStyle.logicalWidth().isIntrinsicOrAuto();
 
     EWhiteSpace currWS = blockStyle.whiteSpace();
     EWhiteSpace lastWS = currWS;
@@ -2783,7 +2781,7 @@
                 // cleanly.  Otherwise the <br> has no effect on whether the line is
                 // empty or not.
                 if (startingNewParagraph)
-                    lineInfo.setEmpty(false, m_block, &width);
+                    lineInfo.setEmpty(false, &m_block, &width);
                 trailingObjects.clear();
                 lineInfo.setPreviousLineBrokeCleanly(true);
 
@@ -2810,11 +2808,11 @@
             RenderBox* box = toRenderBox(current.m_obj);
             bool isInlineType = box->style()->isOriginalDisplayInlineType();
             if (!isInlineType)
-                m_block->setStaticInlinePositionForChild(box, m_block->logicalHeight(), m_block->startOffsetForContent(m_block->logicalHeight()));
+                m_block.setStaticInlinePositionForChild(*box, m_block.logicalHeight(), m_block.startOffsetForContent(m_block.logicalHeight()));
             else  {
                 // If our original display was an INLINE type, then we can go ahead
                 // and determine our static y position now.
-                box->layer()->setStaticBlockPosition(m_block->logicalHeight());
+                box->layer()->setStaticBlockPosition(m_block.logicalHeight());
             }
 
             // If we're ignoring spaces, we have to stop and include this object and
@@ -2829,14 +2827,14 @@
             // Reset prior line break context characters.
             renderTextInfo.m_lineBreakIterator.resetPriorContext();
         } else if (current.m_obj->isFloating()) {
-            RenderBox* floatBox = toRenderBox(current.m_obj);
-            FloatingObject* f = m_block->insertFloatingObject(floatBox);
+            RenderBox& floatBox = toRenderBox(*current.m_obj);
+            FloatingObject* f = m_block.insertFloatingObject(floatBox);
             // check if it fits in the current line.
             // If it does, position it now, otherwise, position
             // it after moving to next line (in newLine() func)
             // FIXME: Bug 110372: Properly position multiple stacked floats with non-rectangular shape outside.
-            if (floatsFitOnLine && width.fitsOnLineExcludingTrailingWhitespace(m_block->logicalWidthForFloat(f))) {
-                m_block->positionNewFloatOnLine(f, lastFloatFromPreviousLine, lineInfo, width);
+            if (floatsFitOnLine && width.fitsOnLineExcludingTrailingWhitespace(m_block.logicalWidthForFloat(f))) {
+                m_block.positionNewFloatOnLine(f, lastFloatFromPreviousLine, lineInfo, width);
                 if (lBreak.m_obj == current.m_obj) {
                     ASSERT(!lBreak.m_pos);
                     lBreak.increment();
@@ -2858,7 +2856,7 @@
                 // An empty inline that only has line-height, vertical-align or font-metrics will only get a
                 // line box to affect the height of the line if the rest of the line is not empty.
                 if (requiresLineBox)
-                    lineInfo.setEmpty(false, m_block, &width);
+                    lineInfo.setEmpty(false, &m_block, &width);
                 if (ignoringSpaces) {
                     trailingObjects.clear();
                     ensureLineBoxInsideIgnoredSpaces(lineMidpointState, current.m_obj);
@@ -2876,10 +2874,10 @@
 
             width.addUncommittedWidth(inlineLogicalWidth(current.m_obj) + borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
         } else if (current.m_obj->isReplaced()) {
-            RenderBox* replacedBox = toRenderBox(current.m_obj);
+            RenderBox& replacedBox = toRenderBox(*current.m_obj);
 
             if (atStart)
-                width.updateAvailableWidth(replacedBox->logicalHeight());
+                width.updateAvailableWidth(replacedBox.logicalHeight());
 
             // Break on replaced elements if either has normal white-space.
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!current.m_obj->isImage() || allowImagesToBreak))
@@ -2888,7 +2886,7 @@
             if (ignoringSpaces)
                 stopIgnoringSpaces(lineMidpointState, InlineIterator(0, current.m_obj, 0));
 
-            lineInfo.setEmpty(false, m_block, &width);
+            lineInfo.setEmpty(false, &m_block, &width);
             ignoringSpaces = false;
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
@@ -2896,7 +2894,7 @@
 
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot.
-            LayoutUnit replacedLogicalWidth = m_block->logicalWidthForChild(replacedBox) + m_block->marginStartForChild(replacedBox) + m_block->marginEndForChild(replacedBox) + inlineLogicalWidth(current.m_obj);
+            LayoutUnit replacedLogicalWidth = m_block.logicalWidthForChild(replacedBox) + m_block.marginStartForChild(replacedBox) + m_block.marginEndForChild(replacedBox) + inlineLogicalWidth(current.m_obj);
             if (current.m_obj->isListMarker()) {
                 if (blockStyle.collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(m_block, current.m_obj, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any
@@ -2966,7 +2964,7 @@
 #endif
 
             if (renderTextInfo.m_text != t) {
-                updateCounterIfNeeded(t);
+                updateCounterIfNeeded(*t);
                 renderTextInfo.m_text = t;
                 renderTextInfo.m_font = &f;
                 renderTextInfo.m_layout = f.createLayout(t, width.currentWidth(), collapseWhiteSpace);
@@ -2992,7 +2990,7 @@
                 currentCharacterIsSpace = c == ' ' || c == '\t' || (!preserveNewline && (c == '\n'));
 
                 if (!collapseWhiteSpace || !currentCharacterIsSpace)
-                    lineInfo.setEmpty(false, m_block, &width);
+                    lineInfo.setEmpty(false, &m_block, &width);
 
                 if (c == softHyphen && autoWrap && !hyphenWidth && style.hyphens() != HyphensNone) {
                     hyphenWidth = measureHyphenWidth(t, f, &fallbackFonts);
@@ -3295,7 +3293,7 @@
 
  end:
 #if ENABLE(CSS_SHAPES)
-    ShapeInsideInfo* shapeInfo = m_block->layoutShapeInsideInfo();
+    ShapeInsideInfo* shapeInfo = m_block.layoutShapeInsideInfo();
     bool segmentAllowsOverflow = !shapeInfo || !shapeInfo->hasSegments();
 #else
     bool segmentAllowsOverflow = true;
@@ -3465,11 +3463,11 @@
             break;
         if (logicalTopForFloat(floatingObject) == logicalHeight() + lineInfo.floatPaginationStrut()) {
             floatingObject->setPaginationStrut(paginationStrut + floatingObject->paginationStrut());
-            RenderBox* floatBox = &floatingObject->renderer();
+            RenderBox& floatBox = floatingObject->renderer();
             setLogicalTopForChild(floatBox, logicalTopForChild(floatBox) + marginBeforeForChild(floatBox) + paginationStrut);
-            if (floatBox->isRenderBlock())
-                toRenderBlock(floatBox)->setChildNeedsLayout(MarkOnlyThis);
-            floatBox->layoutIfNeeded();
+            if (floatBox.isRenderBlock())
+                toRenderBlock(floatBox).setChildNeedsLayout(MarkOnlyThis);
+            floatBox.layoutIfNeeded();
             // Save the old logical top before calling removePlacedObject which will set
             // isPlaced to false. Otherwise it will trigger an assert in logicalTopForFloat.
             LayoutUnit oldLogicalTop = logicalTopForFloat(floatingObject);
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index f7dafe6..455c8b3 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -223,7 +223,7 @@
     clearOverrideSize();
     clearContainingBlockOverrideSize();
 
-    RenderBlock::removePercentHeightDescendantIfNeeded(this);
+    RenderBlock::removePercentHeightDescendantIfNeeded(*this);
 
 #if ENABLE(CSS_SHAPES)
     ShapeOutsideInfo::removeInfo(this);
@@ -239,7 +239,7 @@
     for (auto curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
         if (curr->isRenderBlockFlow()) {
             RenderBlockFlow* currBlock = toRenderBlockFlow(curr);
-            if (!parentBlock || currBlock->containsFloat(this))
+            if (!parentBlock || currBlock->containsFloat(*this))
                 parentBlock = currBlock;
         }
     }
@@ -261,7 +261,7 @@
     }
 
     if (isOutOfFlowPositioned())
-        RenderBlock::removePositionedObject(this);
+        RenderBlock::removePositionedObject(*this);
 }
 
 void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
@@ -308,7 +308,7 @@
 
     RenderStyle* newStyle = style();
     if (needsLayout() && oldStyle) {
-        RenderBlock::removePercentHeightDescendantIfNeeded(this);
+        RenderBlock::removePercentHeightDescendantIfNeeded(*this);
 
         // Normally we can do optimized positioning layout for absolute/fixed positioned objects. There is one special case, however, which is
         // when the positioned object's margin-before is changed. In this case the parent has to get a layout in order to run margin collapsing
@@ -320,7 +320,7 @@
 
     if (RenderBlock::hasPercentHeightContainerMap() && firstChild()
         && oldHorizontalWritingMode != isHorizontalWritingMode())
-        RenderBlock::clearPercentHeightDescendantsFrom(this);
+        RenderBlock::clearPercentHeightDescendantsFrom(*this);
 
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
@@ -1966,7 +1966,7 @@
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
             RootInlineBox& rootBox = box->root();
-            rootBox.blockFlow().setStaticInlinePositionForChild(this, rootBox.lineTopWithLeading(), roundedLayoutUnit(box->logicalLeft()));
+            rootBox.blockFlow().setStaticInlinePositionForChild(*this, rootBox.lineTopWithLeading(), roundedLayoutUnit(box->logicalLeft()));
             if (style()->hasStaticInlinePosition(box->isHorizontal()))
                 setChildNeedsLayout(MarkOnlyThis); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         } else {
@@ -2228,7 +2228,7 @@
     
     if (!hasPerpendicularContainingBlock && containerLogicalWidth && containerLogicalWidth != (computedValues.m_extent + computedValues.m_margins.m_start + computedValues.m_margins.m_end)
         && !isFloating() && !isInline() && !cb->isFlexibleBoxIncludingDeprecated() && !cb->isRenderGrid()) {
-        LayoutUnit newMargin = containerLogicalWidth - computedValues.m_extent - cb->marginStartForChild(this);
+        LayoutUnit newMargin = containerLogicalWidth - computedValues.m_extent - cb->marginStartForChild(*this);
         bool hasInvertedDirection = cb->style()->isLeftToRightDirection() != style()->isLeftToRightDirection();
         if (hasInvertedDirection)
             computedValues.m_margins.m_start = newMargin;
@@ -2461,7 +2461,7 @@
     LayoutUnit logicalLeftOffset = 0;
     
     if (!isOutOfFlowPositioned() && avoidsFloats() && cb->containsFloats()) {
-        LayoutUnit startPositionDelta = cb->computeStartPositionDeltaForChildAvoidingFloats(this, marginStartInRegion, region);
+        LayoutUnit startPositionDelta = cb->computeStartPositionDeltaForChildAvoidingFloats(*this, marginStartInRegion, region);
         if (cb->style()->isLeftToRightDirection())
             logicalLeftDelta += startPositionDelta;
         else
@@ -2676,7 +2676,7 @@
         skippedAutoHeightContainingBlock = true;
         containingBlockChild = cb;
         cb = cb->containingBlock();
-        cb->addPercentHeightDescendant(const_cast<RenderBox*>(this));
+        cb->addPercentHeightDescendant(const_cast<RenderBox&>(*this));
     }
 
     RenderStyle* cbstyle = cb->style();
@@ -2833,7 +2833,7 @@
             auto cb = isOutOfFlowPositioned() ? container() : containingBlock();
             while (cb->isAnonymous() && !cb->isRenderView()) {
                 cb = cb->containingBlock();
-                toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
+                toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox&>(*this));
             }
 
             // FIXME: This calculation is not patched for block-flow yet.
@@ -2868,7 +2868,7 @@
                         availableHeight = max(availableHeight, intrinsicLogicalHeight());
                         return valueForLength(logicalHeight, availableHeight - borderAndPaddingLogicalHeight());
                     }
-                    toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
+                    toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox&>(*this));
                     cb = cb->containingBlock();
                 }
             }
@@ -2952,8 +2952,8 @@
     LayoutUnit marginBefore;
     LayoutUnit marginAfter;
     computeBlockDirectionMargins(containingBlock, marginBefore, marginAfter);
-    containingBlock->setMarginBeforeForChild(this, marginBefore);
-    containingBlock->setMarginAfterForChild(this, marginAfter);
+    containingBlock->setMarginBeforeForChild(*this, marginBefore);
+    containingBlock->setMarginAfterForChild(*this, marginAfter);
 }
 
 LayoutUnit RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObject* containingBlock, RenderRegion* region, bool checkForPerpendicularWritingMode) const
diff --git a/Source/WebCore/rendering/RenderCounter.h b/Source/WebCore/rendering/RenderCounter.h
index eae39f2..f6a6266 100644
--- a/Source/WebCore/rendering/RenderCounter.h
+++ b/Source/WebCore/rendering/RenderCounter.h
@@ -62,6 +62,12 @@
     friend class CounterNode;
 };
 
+inline RenderCounter& toRenderCounter(RenderObject& object)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(object.isCounter());
+    return static_cast<RenderCounter&>(object);
+}
+
 inline RenderCounter* toRenderCounter(RenderObject* object)
 {
     ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isCounter());
@@ -69,6 +75,7 @@
 }
 
 // This will catch anyone doing an unnecessary cast.
+void toRenderCounter(const RenderCounter&);
 void toRenderCounter(const RenderCounter*);
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index 95bcbb5..53fb420 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -478,7 +478,7 @@
         m_stretchingChildren = (style()->boxAlign() == BSTRETCH);
         for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
             if (child->isOutOfFlowPositioned()) {
-                child->containingBlock()->insertPositionedObject(child);
+                child->containingBlock()->insertPositionedObject(*child);
                 RenderLayer* childLayer = child->layer();
                 childLayer->setStaticInlinePosition(xPos); // FIXME: Not right for regions.
                 if (childLayer->staticBlockPosition() != yPos) {
@@ -725,7 +725,7 @@
                 child->setChildNeedsLayout(MarkOnlyThis);
 
             if (child->isOutOfFlowPositioned()) {
-                child->containingBlock()->insertPositionedObject(child);
+                child->containingBlock()->insertPositionedObject(*child);
                 RenderLayer* childLayer = child->layer();
                 childLayer->setStaticInlinePosition(borderStart() + paddingStart()); // FIXME: Not right for regions.
                 if (childLayer->staticBlockPosition() != height()) {
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 2a73396..952d75e 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -63,65 +63,68 @@
 
 RenderObject* RenderFieldset::layoutSpecialExcludedChild(bool relayoutChildren)
 {
-    RenderBox* legend = findLegend();
-    if (legend) {
-        if (relayoutChildren)
-            legend->setNeedsLayout();
-        legend->layoutIfNeeded();
+    RenderBox* box = findLegend();
+    if (!box)
+        return nullptr;
 
-        LayoutUnit logicalLeft;
-        if (style()->isLeftToRightDirection()) {
-            switch (legend->style()->textAlign()) {
-            case CENTER:
-                logicalLeft = (logicalWidth() - logicalWidthForChild(legend)) / 2;
-                break;
-            case RIGHT:
-                logicalLeft = logicalWidth() - borderEnd() - paddingEnd() - logicalWidthForChild(legend);
-                break;
-            default:
-                logicalLeft = borderStart() + paddingStart() + marginStartForChild(legend);
-                break;
-            }
-        } else {
-            switch (legend->style()->textAlign()) {
-            case LEFT:
-                logicalLeft = borderStart() + paddingStart();
-                break;
-            case CENTER: {
-                // Make sure that the extra pixel goes to the end side in RTL (since it went to the end side
-                // in LTR).
-                LayoutUnit centeredWidth = logicalWidth() - logicalWidthForChild(legend);
-                logicalLeft = centeredWidth - centeredWidth / 2;
-                break;
-            }
-            default:
-                logicalLeft = logicalWidth() - borderStart() - paddingStart() - marginStartForChild(legend) - logicalWidthForChild(legend);
-                break;
-            }
+    RenderBox& legend = *box;
+    if (relayoutChildren)
+        legend.setNeedsLayout();
+    legend.layoutIfNeeded();
+
+    LayoutUnit logicalLeft;
+    if (style()->isLeftToRightDirection()) {
+        switch (legend.style()->textAlign()) {
+        case CENTER:
+            logicalLeft = (logicalWidth() - logicalWidthForChild(legend)) / 2;
+            break;
+        case RIGHT:
+            logicalLeft = logicalWidth() - borderEnd() - paddingEnd() - logicalWidthForChild(legend);
+            break;
+        default:
+            logicalLeft = borderStart() + paddingStart() + marginStartForChild(legend);
+            break;
         }
-
-        setLogicalLeftForChild(legend, logicalLeft);
-
-        LayoutUnit fieldsetBorderBefore = borderBefore();
-        LayoutUnit legendLogicalHeight = logicalHeightForChild(legend);
-
-        LayoutUnit legendLogicalTop;
-        LayoutUnit collapsedLegendExtent;
-        // FIXME: We need to account for the legend's margin before too.
-        if (fieldsetBorderBefore > legendLogicalHeight) {
-            // The <legend> is smaller than the associated fieldset before border
-            // so the latter determines positioning of the <legend>. The sizing depends
-            // on the legend's margins as we want to still follow the author's cues.
-            // Firefox completely ignores the margins in this case which seems wrong.
-            legendLogicalTop = (fieldsetBorderBefore - legendLogicalHeight) / 2;
-            collapsedLegendExtent = max<LayoutUnit>(fieldsetBorderBefore, legendLogicalTop + legendLogicalHeight + marginAfterForChild(legend));
-        } else
-            collapsedLegendExtent = legendLogicalHeight + marginAfterForChild(legend);
-
-        setLogicalTopForChild(legend, legendLogicalTop);
-        setLogicalHeight(paddingBefore() + collapsedLegendExtent);
+    } else {
+        switch (legend.style()->textAlign()) {
+        case LEFT:
+            logicalLeft = borderStart() + paddingStart();
+            break;
+        case CENTER: {
+            // Make sure that the extra pixel goes to the end side in RTL (since it went to the end side
+            // in LTR).
+            LayoutUnit centeredWidth = logicalWidth() - logicalWidthForChild(legend);
+            logicalLeft = centeredWidth - centeredWidth / 2;
+            break;
+        }
+        default:
+            logicalLeft = logicalWidth() - borderStart() - paddingStart() - marginStartForChild(legend) - logicalWidthForChild(legend);
+            break;
+        }
     }
-    return legend;
+
+    setLogicalLeftForChild(legend, logicalLeft);
+
+    LayoutUnit fieldsetBorderBefore = borderBefore();
+    LayoutUnit legendLogicalHeight = logicalHeightForChild(legend);
+
+    LayoutUnit legendLogicalTop;
+    LayoutUnit collapsedLegendExtent;
+    // FIXME: We need to account for the legend's margin before too.
+    if (fieldsetBorderBefore > legendLogicalHeight) {
+        // The <legend> is smaller than the associated fieldset before border
+        // so the latter determines positioning of the <legend>. The sizing depends
+        // on the legend's margins as we want to still follow the author's cues.
+        // Firefox completely ignores the margins in this case which seems wrong.
+        legendLogicalTop = (fieldsetBorderBefore - legendLogicalHeight) / 2;
+        collapsedLegendExtent = max<LayoutUnit>(fieldsetBorderBefore, legendLogicalTop + legendLogicalHeight + marginAfterForChild(legend));
+    } else
+        collapsedLegendExtent = legendLogicalHeight + marginAfterForChild(legend);
+
+    setLogicalTopForChild(legend, legendLogicalTop);
+    setLogicalHeight(paddingBefore() + collapsedLegendExtent);
+
+    return &legend;
 }
 
 RenderBox* RenderFieldset::findLegend(FindLegendOption option) const
@@ -133,7 +136,7 @@
         if (legend->node() && (legend->node()->hasTagName(legendTag)))
             return toRenderBox(legend);
     }
-    return 0;
+    return nullptr;
 }
 
 void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index a03647d..2d5bc99 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -112,13 +112,13 @@
 };
 
 struct RenderFlexibleBox::Violation {
-    Violation(RenderBox* child, LayoutUnit childSize)
+    Violation(RenderBox& child, LayoutUnit childSize)
         : child(child)
         , childSize(childSize)
     {
     }
 
-    RenderBox* child;
+    RenderBox& child;
     LayoutUnit childSize;
 };
 
@@ -148,13 +148,13 @@
     return "RenderFlexibleBox";
 }
 
-static LayoutUnit marginLogicalWidthForChild(RenderBox* child, RenderStyle* parentStyle)
+static LayoutUnit marginLogicalWidthForChild(RenderBox& child, RenderStyle* parentStyle)
 {
     // A margin has three types: fixed, percentage, and auto (variable).
     // Auto and percentage margins become 0 when computing min/max width.
     // Fixed margins can be added in as is.
-    Length marginLeft = child->style()->marginStartUsing(parentStyle);
-    Length marginRight = child->style()->marginEndUsing(parentStyle);
+    Length marginLeft = child.style()->marginStartUsing(parentStyle);
+    Length marginRight = child.style()->marginEndUsing(parentStyle);
     LayoutUnit margin = 0;
     if (marginLeft.isFixed())
         margin += marginLeft.value();
@@ -172,7 +172,7 @@
         if (child->isOutOfFlowPositioned())
             continue;
 
-        LayoutUnit margin = marginLogicalWidthForChild(child, style());
+        LayoutUnit margin = marginLogicalWidthForChild(*child, style());
         bool hasOrthogonalWritingMode = child->isHorizontalWritingMode() != isHorizontalWritingMode();
         LayoutUnit minPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->minPreferredLogicalWidth();
         LayoutUnit maxPreferredLogicalWidth = hasOrthogonalWritingMode ? child->logicalHeight() : child->maxPreferredLogicalWidth();
@@ -234,16 +234,16 @@
     setPreferredLogicalWidthsDirty(false);
 }
 
-static int synthesizedBaselineFromContentBox(const RenderBox* box, LineDirectionMode direction)
+static int synthesizedBaselineFromContentBox(const RenderBox& box, LineDirectionMode direction)
 {
-    return direction == HorizontalLine ? box->borderTop() + box->paddingTop() + box->contentHeight() : box->borderRight() + box->paddingRight() + box->contentWidth();
+    return direction == HorizontalLine ? box.borderTop() + box.paddingTop() + box.contentHeight() : box.borderRight() + box.paddingRight() + box.contentWidth();
 }
 
 int RenderFlexibleBox::baselinePosition(FontBaseline, bool, LineDirectionMode direction, LinePositionMode) const
 {
     int baseline = firstLineBaseline();
     if (baseline == -1)
-        baseline = synthesizedBaselineFromContentBox(this, direction);
+        baseline = synthesizedBaselineFromContentBox(*this, direction);
 
     int marginAscent = direction == HorizontalLine ? marginTop() : marginRight();
     return baseline + marginAscent;
@@ -258,7 +258,7 @@
     for (RenderBox* child = m_orderIterator.first(); child; child = m_orderIterator.next()) {
         if (child->isOutOfFlowPositioned())
             continue;
-        if (alignmentForChild(child) == AlignBaseline && !hasAutoMarginsInCrossAxis(child)) {
+        if (alignmentForChild(*child) == AlignBaseline && !hasAutoMarginsInCrossAxis(*child)) {
             baselineChild = child;
             break;
         }
@@ -273,17 +273,17 @@
     if (!baselineChild)
         return -1;
 
-    if (!isColumnFlow() && hasOrthogonalFlow(baselineChild))
-        return crossAxisExtentForChild(baselineChild) + baselineChild->logicalTop();
-    if (isColumnFlow() && !hasOrthogonalFlow(baselineChild))
-        return mainAxisExtentForChild(baselineChild) + baselineChild->logicalTop();
+    if (!isColumnFlow() && hasOrthogonalFlow(*baselineChild))
+        return crossAxisExtentForChild(*baselineChild) + baselineChild->logicalTop();
+    if (isColumnFlow() && !hasOrthogonalFlow(*baselineChild))
+        return mainAxisExtentForChild(*baselineChild) + baselineChild->logicalTop();
 
     int baseline = baselineChild->firstLineBaseline();
     if (baseline == -1) {
         // FIXME: We should pass |direction| into firstLineBoxBaseline and stop bailing out if we're a writing mode root.
         // This would also fix some cases where the flexbox is orthogonal to its container.
         LineDirectionMode direction = isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
-        return synthesizedBaselineFromContentBox(baselineChild, direction) + baselineChild->logicalTop();
+        return synthesizedBaselineFromContentBox(*baselineChild, direction) + baselineChild->logicalTop();
     }
 
     return baseline + baselineChild->logicalTop();
@@ -296,7 +296,7 @@
         return baseline;
 
     int marginAscent = direction == HorizontalLine ? marginTop() : marginRight();
-    return synthesizedBaselineFromContentBox(this, direction) + marginAscent;
+    return synthesizedBaselineFromContentBox(*this, direction) + marginAscent;
 }
 
 static EAlignItems resolveAlignment(const RenderStyle* parentStyle, const RenderStyle* childStyle)
@@ -412,7 +412,7 @@
 void RenderFlexibleBox::paintChildren(PaintInfo& paintInfo, const LayoutPoint& paintOffset, PaintInfo& paintInfoForChild, bool usePrintRect)
 {
     for (RenderBox* child = m_orderIterator.first(); child; child = m_orderIterator.next()) {
-        if (!paintChild(child, paintInfo, paintOffset, paintInfoForChild, usePrintRect))
+        if (!paintChild(*child, paintInfo, paintOffset, paintInfoForChild, usePrintRect))
             return;
     }
 }
@@ -441,16 +441,16 @@
     for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
         if (child->isOutOfFlowPositioned())
             continue;
-        LayoutUnit childLogicalBottom = logicalTopForChild(child) + logicalHeightForChild(child) + marginAfterForChild(child);
+        LayoutUnit childLogicalBottom = logicalTopForChild(*child) + logicalHeightForChild(*child) + marginAfterForChild(*child);
         maxChildLogicalBottom = std::max(maxChildLogicalBottom, childLogicalBottom);
     }
     return std::max(clientLogicalBottom(), maxChildLogicalBottom);
 }
 
-bool RenderFlexibleBox::hasOrthogonalFlow(RenderBox* child) const
+bool RenderFlexibleBox::hasOrthogonalFlow(RenderBox& child) const
 {
     // FIXME: If the child is a flexbox, then we need to check isHorizontalFlow.
-    return isHorizontalFlow() != child->isHorizontalWritingMode();
+    return isHorizontalFlow() != child.isHorizontalWritingMode();
 }
 
 bool RenderFlexibleBox::isColumnFlow() const
@@ -477,11 +477,11 @@
     return style()->flexWrap() != FlexNoWrap;
 }
 
-Length RenderFlexibleBox::flexBasisForChild(RenderBox* child) const
+Length RenderFlexibleBox::flexBasisForChild(RenderBox& child) const
 {
-    Length flexLength = child->style()->flexBasis();
+    Length flexLength = child.style()->flexBasis();
     if (flexLength.isAuto())
-        flexLength = isHorizontalFlow() ? child->style()->width() : child->style()->height();
+        flexLength = isHorizontalFlow() ? child.style()->width() : child.style()->height();
     return flexLength;
 }
 
@@ -493,14 +493,14 @@
         setWidth(extent);
 }
 
-LayoutUnit RenderFlexibleBox::crossAxisExtentForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::crossAxisExtentForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->height() : child->width();
+    return isHorizontalFlow() ? child.height() : child.width();
 }
 
-LayoutUnit RenderFlexibleBox::mainAxisExtentForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::mainAxisExtentForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->width() : child->height();
+    return isHorizontalFlow() ? child.width() : child.height();
 }
 
 LayoutUnit RenderFlexibleBox::crossAxisExtent() const
@@ -534,7 +534,7 @@
     return contentLogicalWidth();
 }
 
-LayoutUnit RenderFlexibleBox::computeMainAxisExtentForChild(RenderBox* child, SizeType sizeType, const Length& size)
+LayoutUnit RenderFlexibleBox::computeMainAxisExtentForChild(RenderBox& child, SizeType sizeType, const Length& size)
 {
     // FIXME: This is wrong for orthogonal flows. It should use the flexbox's writing-mode, not the child's in order
     // to figure out the logical height/width.
@@ -542,10 +542,10 @@
     // Instead, we need to layout the child an get the appropriate height value.
     // https://bugs.webkit.org/show_bug.cgi?id=113610
     if (isColumnFlow())
-        return child->computeContentLogicalHeight(size);
+        return child.computeContentLogicalHeight(size);
     // FIXME: Figure out how this should work for regions and pass in the appropriate values.
     RenderRegion* region = 0;
-    return child->computeLogicalWidthInRegionUsing(sizeType, size, contentLogicalWidth(), this, region) - child->borderAndPaddingLogicalWidth();
+    return child.computeLogicalWidthInRegionUsing(sizeType, size, contentLogicalWidth(), this, region) - child.borderAndPaddingLogicalWidth();
 }
 
 WritingMode RenderFlexibleBox::transformedWritingMode() const
@@ -658,55 +658,55 @@
     return paddingTop();
 }
 
-LayoutUnit RenderFlexibleBox::flowAwareMarginStartForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::flowAwareMarginStartForChild(RenderBox& child) const
 {
     if (isHorizontalFlow())
-        return isLeftToRightFlow() ? child->marginLeft() : child->marginRight();
-    return isLeftToRightFlow() ? child->marginTop() : child->marginBottom();
+        return isLeftToRightFlow() ? child.marginLeft() : child.marginRight();
+    return isLeftToRightFlow() ? child.marginTop() : child.marginBottom();
 }
 
-LayoutUnit RenderFlexibleBox::flowAwareMarginEndForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::flowAwareMarginEndForChild(RenderBox& child) const
 {
     if (isHorizontalFlow())
-        return isLeftToRightFlow() ? child->marginRight() : child->marginLeft();
-    return isLeftToRightFlow() ? child->marginBottom() : child->marginTop();
+        return isLeftToRightFlow() ? child.marginRight() : child.marginLeft();
+    return isLeftToRightFlow() ? child.marginBottom() : child.marginTop();
 }
 
-LayoutUnit RenderFlexibleBox::flowAwareMarginBeforeForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::flowAwareMarginBeforeForChild(RenderBox& child) const
 {
     switch (transformedWritingMode()) {
     case TopToBottomWritingMode:
-        return child->marginTop();
+        return child.marginTop();
     case BottomToTopWritingMode:
-        return child->marginBottom();
+        return child.marginBottom();
     case LeftToRightWritingMode:
-        return child->marginLeft();
+        return child.marginLeft();
     case RightToLeftWritingMode:
-        return child->marginRight();
+        return child.marginRight();
     }
     ASSERT_NOT_REACHED();
     return marginTop();
 }
 
-LayoutUnit RenderFlexibleBox::flowAwareMarginAfterForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::flowAwareMarginAfterForChild(RenderBox& child) const
 {
     switch (transformedWritingMode()) {
     case TopToBottomWritingMode:
-        return child->marginBottom();
+        return child.marginBottom();
     case BottomToTopWritingMode:
-        return child->marginTop();
+        return child.marginTop();
     case LeftToRightWritingMode:
-        return child->marginRight();
+        return child.marginRight();
     case RightToLeftWritingMode:
-        return child->marginLeft();
+        return child.marginLeft();
     }
     ASSERT_NOT_REACHED();
     return marginBottom();
 }
 
-LayoutUnit RenderFlexibleBox::crossAxisMarginExtentForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::crossAxisMarginExtentForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->marginHeight() : child->marginWidth();
+    return isHorizontalFlow() ? child.marginHeight() : child.marginWidth();
 }
 
 LayoutUnit RenderFlexibleBox::crossAxisScrollbarExtent() const
@@ -714,43 +714,43 @@
     return isHorizontalFlow() ? horizontalScrollbarHeight() : verticalScrollbarWidth();
 }
 
-LayoutPoint RenderFlexibleBox::flowAwareLocationForChild(RenderBox* child) const
+LayoutPoint RenderFlexibleBox::flowAwareLocationForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->location() : child->location().transposedPoint();
+    return isHorizontalFlow() ? child.location() : child.location().transposedPoint();
 }
 
-void RenderFlexibleBox::setFlowAwareLocationForChild(RenderBox* child, const LayoutPoint& location)
+void RenderFlexibleBox::setFlowAwareLocationForChild(RenderBox& child, const LayoutPoint& location)
 {
     if (isHorizontalFlow())
-        child->setLocation(location);
+        child.setLocation(location);
     else
-        child->setLocation(location.transposedPoint());
+        child.setLocation(location.transposedPoint());
 }
 
-LayoutUnit RenderFlexibleBox::mainAxisBorderAndPaddingExtentForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::mainAxisBorderAndPaddingExtentForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->borderAndPaddingWidth() : child->borderAndPaddingHeight();
+    return isHorizontalFlow() ? child.borderAndPaddingWidth() : child.borderAndPaddingHeight();
 }
 
-LayoutUnit RenderFlexibleBox::mainAxisScrollbarExtentForChild(RenderBox* child) const
+LayoutUnit RenderFlexibleBox::mainAxisScrollbarExtentForChild(RenderBox& child) const
 {
-    return isHorizontalFlow() ? child->verticalScrollbarWidth() : child->horizontalScrollbarHeight();
+    return isHorizontalFlow() ? child.verticalScrollbarWidth() : child.horizontalScrollbarHeight();
 }
 
-LayoutUnit RenderFlexibleBox::preferredMainAxisContentExtentForChild(RenderBox* child, bool hasInfiniteLineLength)
+LayoutUnit RenderFlexibleBox::preferredMainAxisContentExtentForChild(RenderBox& child, bool hasInfiniteLineLength)
 {
-    bool hasOverrideSize = child->hasOverrideWidth() || child->hasOverrideHeight();
+    bool hasOverrideSize = child.hasOverrideWidth() || child.hasOverrideHeight();
     if (hasOverrideSize)
-        child->clearOverrideSize();
+        child.clearOverrideSize();
 
     Length flexBasis = flexBasisForChild(child);
     if (flexBasis.isAuto() || (flexBasis.isFixed() && !flexBasis.value() && hasInfiniteLineLength)) {
         if (hasOrthogonalFlow(child)) {
             if (hasOverrideSize)
-                child->setChildNeedsLayout(MarkOnlyThis);
-            child->layoutIfNeeded();
+                child.setChildNeedsLayout(MarkOnlyThis);
+            child.layoutIfNeeded();
         }
-        LayoutUnit mainAxisExtent = hasOrthogonalFlow(child) ? child->logicalHeight() : child->maxPreferredLogicalWidth();
+        LayoutUnit mainAxisExtent = hasOrthogonalFlow(child) ? child.logicalHeight() : child.maxPreferredLogicalWidth();
         ASSERT(mainAxisExtent - mainAxisBorderAndPaddingExtentForChild(child) >= 0);
         return mainAxisExtent - mainAxisBorderAndPaddingExtentForChild(child);
     }
@@ -824,77 +824,77 @@
     return sizeOfAutoMargin;
 }
 
-void RenderFlexibleBox::updateAutoMarginsInMainAxis(RenderBox* child, LayoutUnit autoMarginOffset)
+void RenderFlexibleBox::updateAutoMarginsInMainAxis(RenderBox& child, LayoutUnit autoMarginOffset)
 {
     ASSERT(autoMarginOffset >= 0);
 
     if (isHorizontalFlow()) {
-        if (child->style()->marginLeft().isAuto())
-            child->setMarginLeft(autoMarginOffset);
-        if (child->style()->marginRight().isAuto())
-            child->setMarginRight(autoMarginOffset);
+        if (child.style()->marginLeft().isAuto())
+            child.setMarginLeft(autoMarginOffset);
+        if (child.style()->marginRight().isAuto())
+            child.setMarginRight(autoMarginOffset);
     } else {
-        if (child->style()->marginTop().isAuto())
-            child->setMarginTop(autoMarginOffset);
-        if (child->style()->marginBottom().isAuto())
-            child->setMarginBottom(autoMarginOffset);
+        if (child.style()->marginTop().isAuto())
+            child.setMarginTop(autoMarginOffset);
+        if (child.style()->marginBottom().isAuto())
+            child.setMarginBottom(autoMarginOffset);
     }
 }
 
-bool RenderFlexibleBox::hasAutoMarginsInCrossAxis(RenderBox* child) const
+bool RenderFlexibleBox::hasAutoMarginsInCrossAxis(RenderBox& child) const
 {
     if (isHorizontalFlow())
-        return child->style()->marginTop().isAuto() || child->style()->marginBottom().isAuto();
-    return child->style()->marginLeft().isAuto() || child->style()->marginRight().isAuto();
+        return child.style()->marginTop().isAuto() || child.style()->marginBottom().isAuto();
+    return child.style()->marginLeft().isAuto() || child.style()->marginRight().isAuto();
 }
 
-LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox* child)
+LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox& child)
 {
-    ASSERT(!child->isOutOfFlowPositioned());
+    ASSERT(!child.isOutOfFlowPositioned());
     LayoutUnit childCrossExtent = crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child);
     return lineCrossAxisExtent - childCrossExtent;
 }
 
-bool RenderFlexibleBox::updateAutoMarginsInCrossAxis(RenderBox* child, LayoutUnit availableAlignmentSpace)
+bool RenderFlexibleBox::updateAutoMarginsInCrossAxis(RenderBox& child, LayoutUnit availableAlignmentSpace)
 {
-    ASSERT(!child->isOutOfFlowPositioned());
+    ASSERT(!child.isOutOfFlowPositioned());
     ASSERT(availableAlignmentSpace >= 0);
 
     bool isHorizontal = isHorizontalFlow();
-    Length start = isHorizontal ? child->style()->marginTop() : child->style()->marginLeft();
-    Length end = isHorizontal ? child->style()->marginBottom() : child->style()->marginRight();
+    Length start = isHorizontal ? child.style()->marginTop() : child.style()->marginLeft();
+    Length end = isHorizontal ? child.style()->marginBottom() : child.style()->marginRight();
     if (start.isAuto() && end.isAuto()) {
         adjustAlignmentForChild(child, availableAlignmentSpace / 2);
         if (isHorizontal) {
-            child->setMarginTop(availableAlignmentSpace / 2);
-            child->setMarginBottom(availableAlignmentSpace / 2);
+            child.setMarginTop(availableAlignmentSpace / 2);
+            child.setMarginBottom(availableAlignmentSpace / 2);
         } else {
-            child->setMarginLeft(availableAlignmentSpace / 2);
-            child->setMarginRight(availableAlignmentSpace / 2);
+            child.setMarginLeft(availableAlignmentSpace / 2);
+            child.setMarginRight(availableAlignmentSpace / 2);
         }
         return true;
     }
     if (start.isAuto()) {
         adjustAlignmentForChild(child, availableAlignmentSpace);
         if (isHorizontal)
-            child->setMarginTop(availableAlignmentSpace);
+            child.setMarginTop(availableAlignmentSpace);
         else
-            child->setMarginLeft(availableAlignmentSpace);
+            child.setMarginLeft(availableAlignmentSpace);
         return true;
     }
     if (end.isAuto()) {
         if (isHorizontal)
-            child->setMarginBottom(availableAlignmentSpace);
+            child.setMarginBottom(availableAlignmentSpace);
         else
-            child->setMarginRight(availableAlignmentSpace);
+            child.setMarginRight(availableAlignmentSpace);
         return true;
     }
     return false;
 }
 
-LayoutUnit RenderFlexibleBox::marginBoxAscentForChild(RenderBox* child)
+LayoutUnit RenderFlexibleBox::marginBoxAscentForChild(RenderBox& child)
 {
-    LayoutUnit ascent = child->firstLineBaseline();
+    LayoutUnit ascent = child.firstLineBaseline();
     if (ascent == -1)
         ascent = crossAxisExtentForChild(child);
     return ascent + flowAwareMarginBeforeForChild(child);
@@ -928,16 +928,16 @@
     }
 }
 
-LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(RenderBox* child, LayoutUnit childSize)
+LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(RenderBox& child, LayoutUnit childSize)
 {
-    Length max = isHorizontalFlow() ? child->style()->maxWidth() : child->style()->maxHeight();
+    Length max = isHorizontalFlow() ? child.style()->maxWidth() : child.style()->maxHeight();
     if (max.isSpecifiedOrIntrinsic()) {
         LayoutUnit maxExtent = computeMainAxisExtentForChild(child, MaxSize, max);
         if (maxExtent != -1 && childSize > maxExtent)
             childSize = maxExtent;
     }
 
-    Length min = isHorizontalFlow() ? child->style()->minWidth() : child->style()->minHeight();
+    Length min = isHorizontalFlow() ? child.style()->minWidth() : child.style()->minHeight();
     LayoutUnit minExtent = 0;
     if (min.isSpecifiedOrIntrinsic())
         minExtent = computeMainAxisExtentForChild(child, MinSize, min);
@@ -965,8 +965,8 @@
             continue;
         }
 
-        LayoutUnit childMainAxisExtent = preferredMainAxisContentExtentForChild(child, hasInfiniteLineLength);
-        LayoutUnit childMainAxisMarginBoxExtent = mainAxisBorderAndPaddingExtentForChild(child) + childMainAxisExtent;
+        LayoutUnit childMainAxisExtent = preferredMainAxisContentExtentForChild(*child, hasInfiniteLineLength);
+        LayoutUnit childMainAxisMarginBoxExtent = mainAxisBorderAndPaddingExtentForChild(*child) + childMainAxisExtent;
         childMainAxisMarginBoxExtent += isHorizontalFlow() ? child->marginWidth() : child->marginHeight();
 
         if (isMultiline() && preferredMainAxisExtent + childMainAxisMarginBoxExtent > lineBreakLength && lineHasInFlowItem)
@@ -977,7 +977,7 @@
         totalFlexGrow += child->style()->flexGrow();
         totalWeightedFlexShrink += child->style()->flexShrink() * childMainAxisExtent;
 
-        LayoutUnit childMinMaxAppliedMainAxisExtent = adjustChildSizeForMinAndMax(child, childMainAxisExtent);
+        LayoutUnit childMinMaxAppliedMainAxisExtent = adjustChildSizeForMinAndMax(*child, childMainAxisExtent);
         minMaxAppliedMainAxisExtent += childMinMaxAppliedMainAxisExtent - childMainAxisExtent + childMainAxisMarginBoxExtent;
     }
     return true;
@@ -986,13 +986,13 @@
 void RenderFlexibleBox::freezeViolations(const Vector<Violation>& violations, LayoutUnit& availableFreeSpace, double& totalFlexGrow, double& totalWeightedFlexShrink, InflexibleFlexItemSize& inflexibleItems, bool hasInfiniteLineLength)
 {
     for (size_t i = 0; i < violations.size(); ++i) {
-        RenderBox* child = violations[i].child;
+        RenderBox& child = violations[i].child;
         LayoutUnit childSize = violations[i].childSize;
         LayoutUnit preferredChildSize = preferredMainAxisContentExtentForChild(child, hasInfiniteLineLength);
         availableFreeSpace -= childSize - preferredChildSize;
-        totalFlexGrow -= child->style()->flexGrow();
-        totalWeightedFlexShrink -= child->style()->flexShrink() * preferredChildSize;
-        inflexibleItems.set(child, childSize);
+        totalFlexGrow -= child.style()->flexGrow();
+        totalWeightedFlexShrink -= child.style()->flexShrink() * preferredChildSize;
+        inflexibleItems.set(&child, childSize);
     }
 }
 
@@ -1005,22 +1005,22 @@
     Vector<Violation> minViolations;
     Vector<Violation> maxViolations;
     for (size_t i = 0; i < children.size(); ++i) {
-        RenderBox* child = children[i];
-        if (child->isOutOfFlowPositioned()) {
+        RenderBox& child = *children[i];
+        if (child.isOutOfFlowPositioned()) {
             childSizes.append(0);
             continue;
         }
 
-        if (inflexibleItems.contains(child))
-            childSizes.append(inflexibleItems.get(child));
+        if (inflexibleItems.contains(&child))
+            childSizes.append(inflexibleItems.get(&child));
         else {
             LayoutUnit preferredChildSize = preferredMainAxisContentExtentForChild(child, hasInfiniteLineLength);
             LayoutUnit childSize = preferredChildSize;
             double extraSpace = 0;
             if (availableFreeSpace > 0 && totalFlexGrow > 0 && flexSign == PositiveFlexibility && std::isfinite(totalFlexGrow))
-                extraSpace = availableFreeSpace * child->style()->flexGrow() / totalFlexGrow;
+                extraSpace = availableFreeSpace * child.style()->flexGrow() / totalFlexGrow;
             else if (availableFreeSpace < 0 && totalWeightedFlexShrink > 0 && flexSign == NegativeFlexibility && std::isfinite(totalWeightedFlexShrink))
-                extraSpace = availableFreeSpace * child->style()->flexShrink() * preferredChildSize / totalWeightedFlexShrink;
+                extraSpace = availableFreeSpace * child.style()->flexShrink() * preferredChildSize / totalWeightedFlexShrink;
             if (std::isfinite(extraSpace))
                 childSize += roundedLayoutUnit(extraSpace);
 
@@ -1071,19 +1071,19 @@
     return 0;
 }
 
-void RenderFlexibleBox::setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize)
+void RenderFlexibleBox::setLogicalOverrideSize(RenderBox& child, LayoutUnit childPreferredSize)
 {
     if (hasOrthogonalFlow(child))
-        child->setOverrideLogicalContentHeight(childPreferredSize - child->borderAndPaddingLogicalHeight());
+        child.setOverrideLogicalContentHeight(childPreferredSize - child.borderAndPaddingLogicalHeight());
     else
-        child->setOverrideLogicalContentWidth(childPreferredSize - child->borderAndPaddingLogicalWidth());
+        child.setOverrideLogicalContentWidth(childPreferredSize - child.borderAndPaddingLogicalWidth());
 }
 
-void RenderFlexibleBox::prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset, PositionedLayoutMode layoutMode)
+void RenderFlexibleBox::prepareChildForPositionedLayout(RenderBox& child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset, PositionedLayoutMode layoutMode)
 {
-    ASSERT(child->isOutOfFlowPositioned());
-    child->containingBlock()->insertPositionedObject(child);
-    RenderLayer* childLayer = child->layer();
+    ASSERT(child.isOutOfFlowPositioned());
+    child.containingBlock()->insertPositionedObject(child);
+    RenderLayer* childLayer = child.layer();
     LayoutUnit inlinePosition = isColumnFlow() ? crossAxisOffset : mainAxisOffset;
     if (layoutMode == FlipForRowReverse && style()->flexDirection() == FlowRowReverse)
         inlinePosition = mainAxisExtent() - mainAxisOffset;
@@ -1092,14 +1092,14 @@
     LayoutUnit staticBlockPosition = isColumnFlow() ? mainAxisOffset : crossAxisOffset;
     if (childLayer->staticBlockPosition() != staticBlockPosition) {
         childLayer->setStaticBlockPosition(staticBlockPosition);
-        if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
-            child->setChildNeedsLayout(MarkOnlyThis);
+        if (child.style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
+            child.setChildNeedsLayout(MarkOnlyThis);
     }
 }
 
-EAlignItems RenderFlexibleBox::alignmentForChild(RenderBox* child) const
+EAlignItems RenderFlexibleBox::alignmentForChild(RenderBox& child) const
 {
-    EAlignItems align = resolveAlignment(style(), child->style());
+    EAlignItems align = resolveAlignment(style(), child.style());
 
     if (align == AlignBaseline && hasOrthogonalFlow(child))
         align = AlignFlexStart;
@@ -1125,19 +1125,19 @@
     return count;
 }
 
-bool RenderFlexibleBox::needToStretchChild(RenderBox* child)
+bool RenderFlexibleBox::needToStretchChild(RenderBox& child)
 {
     if (alignmentForChild(child) != AlignStretch)
         return false;
 
-    Length crossAxisLength = isHorizontalFlow() ? child->style()->height() : child->style()->width();
+    Length crossAxisLength = isHorizontalFlow() ? child.style()->height() : child.style()->width();
     return crossAxisLength.isAuto();
 }
 
-void RenderFlexibleBox::resetAutoMarginsAndLogicalTopInCrossAxis(RenderBox* child)
+void RenderFlexibleBox::resetAutoMarginsAndLogicalTopInCrossAxis(RenderBox& child)
 {
     if (hasAutoMarginsInCrossAxis(child))
-        child->updateLogicalHeight();
+        child.updateLogicalHeight();
 }
 
 void RenderFlexibleBox::layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList& children, const Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, bool relayoutChildren, Vector<LineContext>& lineContexts)
@@ -1157,8 +1157,8 @@
     size_t seenInFlowPositionedChildren = 0;
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
     for (size_t i = 0; i < children.size(); ++i) {
-        RenderBox* child = children[i];
-        if (child->isOutOfFlowPositioned()) {
+        RenderBox& child = *children[i];
+        if (child.isOutOfFlowPositioned()) {
             prepareChildForPositionedLayout(child, mainAxisOffset, crossAxisOffset, FlipForRowReverse);
             continue;
         }
@@ -1167,13 +1167,13 @@
         setLogicalOverrideSize(child, childPreferredSize);
         // FIXME: Can avoid laying out here in some cases. See https://webkit.org/b/87905.
         if (needToStretchChild(child) || childPreferredSize != mainAxisExtentForChild(child))
-            child->setChildNeedsLayout(MarkOnlyThis);
+            child.setChildNeedsLayout(MarkOnlyThis);
         else {
             // To avoid double applying margin changes in updateAutoMarginsInCrossAxis, we reset the margins here.
             resetAutoMarginsAndLogicalTopInCrossAxis(child);
         }
         updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, child);
-        child->layoutIfNeeded();
+        child.layoutIfNeeded();
 
         updateAutoMarginsInMainAxis(child, autoMarginOffset);
 
@@ -1235,9 +1235,9 @@
 
     size_t seenInFlowPositionedChildren = 0;
     for (size_t i = 0; i < children.size(); ++i) {
-        RenderBox* child = children[i];
-        if (child->isOutOfFlowPositioned()) {
-            child->layer()->setStaticBlockPosition(mainAxisOffset);
+        RenderBox& child = *children[i];
+        if (child.isOutOfFlowPositioned()) {
+            child.layer()->setStaticBlockPosition(mainAxisOffset);
             continue;
         }
         mainAxisOffset -= mainAxisExtentForChild(child) + flowAwareMarginEndForChild(child);
@@ -1292,7 +1292,7 @@
     for (unsigned lineNumber = 0; lineNumber < lineContexts.size(); ++lineNumber) {
         lineContexts[lineNumber].crossAxisOffset += lineOffset;
         for (size_t childNumber = 0; childNumber < lineContexts[lineNumber].numberOfChildren; ++childNumber, child = m_orderIterator.next())
-            adjustAlignmentForChild(child, lineOffset);
+            adjustAlignmentForChild(*child, lineOffset);
 
         if (style()->alignContent() == AlignContentStretch && availableCrossAxisSpace > 0)
             lineContexts[lineNumber].crossAxisExtent += availableCrossAxisSpace / static_cast<unsigned>(lineContexts.size());
@@ -1301,11 +1301,11 @@
     }
 }
 
-void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit delta)
+void RenderFlexibleBox::adjustAlignmentForChild(RenderBox& child, LayoutUnit delta)
 {
-    if (child->isOutOfFlowPositioned()) {
-        LayoutUnit staticInlinePosition = child->layer()->staticInlinePosition();
-        LayoutUnit staticBlockPosition = child->layer()->staticBlockPosition();
+    if (child.isOutOfFlowPositioned()) {
+        LayoutUnit staticInlinePosition = child.layer()->staticInlinePosition();
+        LayoutUnit staticBlockPosition = child.layer()->staticBlockPosition();
         LayoutUnit mainAxis = isColumnFlow() ? staticBlockPosition : staticInlinePosition;
         LayoutUnit crossAxis = isColumnFlow() ? staticInlinePosition : staticBlockPosition;
         crossAxis += delta;
@@ -1331,41 +1331,41 @@
             ASSERT(child);
             if (child->isOutOfFlowPositioned()) {
                 if (style()->flexWrap() == FlexWrapReverse)
-                    adjustAlignmentForChild(child, lineCrossAxisExtent);
+                    adjustAlignmentForChild(*child, lineCrossAxisExtent);
                 continue;
             }
 
-            if (updateAutoMarginsInCrossAxis(child, std::max(LayoutUnit(0), availableAlignmentSpaceForChild(lineCrossAxisExtent, child))))
+            if (updateAutoMarginsInCrossAxis(*child, std::max(LayoutUnit(0), availableAlignmentSpaceForChild(lineCrossAxisExtent, *child))))
                 continue;
 
-            switch (alignmentForChild(child)) {
+            switch (alignmentForChild(*child)) {
             case AlignAuto:
                 ASSERT_NOT_REACHED();
                 break;
             case AlignStretch: {
-                applyStretchAlignmentToChild(child, lineCrossAxisExtent);
+                applyStretchAlignmentToChild(*child, lineCrossAxisExtent);
                 // Since wrap-reverse flips cross start and cross end, strech children should be aligned with the cross end.
                 if (style()->flexWrap() == FlexWrapReverse)
-                    adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
+                    adjustAlignmentForChild(*child, availableAlignmentSpaceForChild(lineCrossAxisExtent, *child));
                 break;
             }
             case AlignFlexStart:
                 break;
             case AlignFlexEnd:
-                adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
+                adjustAlignmentForChild(*child, availableAlignmentSpaceForChild(lineCrossAxisExtent, *child));
                 break;
             case AlignCenter:
-                adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) / 2);
+                adjustAlignmentForChild(*child, availableAlignmentSpaceForChild(lineCrossAxisExtent, *child) / 2);
                 break;
             case AlignBaseline: {
                 // FIXME: If we get here in columns, we want the use the descent, except we currently can't get the ascent/descent of orthogonal children.
                 // https://bugs.webkit.org/show_bug.cgi?id=98076
-                LayoutUnit ascent = marginBoxAscentForChild(child);
+                LayoutUnit ascent = marginBoxAscentForChild(*child);
                 LayoutUnit startOffset = maxAscent - ascent;
-                adjustAlignmentForChild(child, startOffset);
+                adjustAlignmentForChild(*child, startOffset);
 
                 if (style()->flexWrap() == FlexWrapReverse)
-                    minMarginAfterBaseline = std::min(minMarginAfterBaseline, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) - startOffset);
+                    minMarginAfterBaseline = std::min(minMarginAfterBaseline, availableAlignmentSpaceForChild(lineCrossAxisExtent, *child) - startOffset);
                 break;
             }
             }
@@ -1383,38 +1383,38 @@
         LayoutUnit minMarginAfterBaseline = minMarginAfterBaselines[lineNumber];
         for (size_t childNumber = 0; childNumber < lineContexts[lineNumber].numberOfChildren; ++childNumber, child = m_orderIterator.next()) {
             ASSERT(child);
-            if (alignmentForChild(child) == AlignBaseline && !hasAutoMarginsInCrossAxis(child) && minMarginAfterBaseline)
-                adjustAlignmentForChild(child, minMarginAfterBaseline);
+            if (alignmentForChild(*child) == AlignBaseline && !hasAutoMarginsInCrossAxis(*child) && minMarginAfterBaseline)
+                adjustAlignmentForChild(*child, minMarginAfterBaseline);
         }
     }
 }
 
-void RenderFlexibleBox::applyStretchAlignmentToChild(RenderBox* child, LayoutUnit lineCrossAxisExtent)
+void RenderFlexibleBox::applyStretchAlignmentToChild(RenderBox& child, LayoutUnit lineCrossAxisExtent)
 {
-    if (!isColumnFlow() && child->style()->logicalHeight().isAuto()) {
+    if (!isColumnFlow() && child.style()->logicalHeight().isAuto()) {
         // FIXME: If the child has orthogonal flow, then it already has an override height set, so use it.
         if (!hasOrthogonalFlow(child)) {
-            LayoutUnit stretchedLogicalHeight = child->logicalHeight() + availableAlignmentSpaceForChild(lineCrossAxisExtent, child);
-            LayoutUnit desiredLogicalHeight = child->constrainLogicalHeightByMinMax(stretchedLogicalHeight);
+            LayoutUnit stretchedLogicalHeight = child.logicalHeight() + availableAlignmentSpaceForChild(lineCrossAxisExtent, child);
+            LayoutUnit desiredLogicalHeight = child.constrainLogicalHeightByMinMax(stretchedLogicalHeight);
 
             // FIXME: Can avoid laying out here in some cases. See https://webkit.org/b/87905.
-            if (desiredLogicalHeight != child->logicalHeight()) {
-                child->setOverrideLogicalContentHeight(desiredLogicalHeight - child->borderAndPaddingLogicalHeight());
-                child->setLogicalHeight(0);
-                child->setChildNeedsLayout(MarkOnlyThis);
-                child->layout();
+            if (desiredLogicalHeight != child.logicalHeight()) {
+                child.setOverrideLogicalContentHeight(desiredLogicalHeight - child.borderAndPaddingLogicalHeight());
+                child.setLogicalHeight(0);
+                child.setChildNeedsLayout(MarkOnlyThis);
+                child.layout();
             }
         }
-    } else if (isColumnFlow() && child->style()->logicalWidth().isAuto()) {
+    } else if (isColumnFlow() && child.style()->logicalWidth().isAuto()) {
         // FIXME: If the child doesn't have orthogonal flow, then it already has an override width set, so use it.
         if (hasOrthogonalFlow(child)) {
             LayoutUnit childWidth = std::max<LayoutUnit>(0, lineCrossAxisExtent - crossAxisMarginExtentForChild(child));
-            childWidth = child->constrainLogicalWidthInRegionByMinMax(childWidth, childWidth, this);
+            childWidth = child.constrainLogicalWidthInRegionByMinMax(childWidth, childWidth, this);
 
-            if (childWidth != child->logicalWidth()) {
-                child->setOverrideLogicalContentWidth(childWidth - child->borderAndPaddingLogicalWidth());
-                child->setChildNeedsLayout(MarkOnlyThis);
-                child->layout();
+            if (childWidth != child.logicalWidth()) {
+                child.setOverrideLogicalContentWidth(childWidth - child.borderAndPaddingLogicalWidth());
+                child.setChildNeedsLayout(MarkOnlyThis);
+                child.layout();
             }
         }
     }
@@ -1429,9 +1429,9 @@
     for (RenderBox* child = m_orderIterator.first(); child; child = m_orderIterator.next()) {
         if (child->isOutOfFlowPositioned())
             continue;
-        LayoutPoint location = flowAwareLocationForChild(child);
-        location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
-        setFlowAwareLocationForChild(child, location);
+        LayoutPoint location = flowAwareLocationForChild(*child);
+        location.setY(crossExtent - crossAxisExtentForChild(*child) - location.y());
+        setFlowAwareLocationForChild(*child, location);
     }
 }
 
@@ -1445,7 +1445,7 @@
             LayoutUnit lineCrossAxisExtent = lineContexts[lineNumber].crossAxisExtent;
             LayoutUnit originalOffset = lineContexts[lineNumber].crossAxisOffset - crossAxisStartEdge;
             LayoutUnit newOffset = contentExtent - originalOffset - lineCrossAxisExtent;
-            adjustAlignmentForChild(child, newOffset - originalOffset);
+            adjustAlignmentForChild(*child, newOffset - originalOffset);
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 7273a39..81ac12e 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -102,19 +102,19 @@
     // Use an inline capacity of 8, since flexbox containers usually have less than 8 children.
     typedef Vector<LayoutRect, 8> ChildFrameRects;
 
-    bool hasOrthogonalFlow(RenderBox* child) const;
+    bool hasOrthogonalFlow(RenderBox& child) const;
     bool isColumnFlow() const;
     bool isLeftToRightFlow() const;
     bool isMultiline() const;
-    Length flexBasisForChild(RenderBox* child) const;
+    Length flexBasisForChild(RenderBox& child) const;
     void setCrossAxisExtent(LayoutUnit);
-    LayoutUnit crossAxisExtentForChild(RenderBox* child) const;
-    LayoutUnit mainAxisExtentForChild(RenderBox* child) const;
+    LayoutUnit crossAxisExtentForChild(RenderBox& child) const;
+    LayoutUnit mainAxisExtentForChild(RenderBox& child) const;
     LayoutUnit crossAxisExtent() const;
     LayoutUnit mainAxisExtent() const;
     LayoutUnit crossAxisContentExtent() const;
     LayoutUnit mainAxisContentExtent(LayoutUnit contentLogicalHeight);
-    LayoutUnit computeMainAxisExtentForChild(RenderBox* child, SizeType, const Length& size);
+    LayoutUnit computeMainAxisExtentForChild(RenderBox& child, SizeType, const Length& size);
     WritingMode transformedWritingMode() const;
     LayoutUnit flowAwareBorderStart() const;
     LayoutUnit flowAwareBorderEnd() const;
@@ -124,52 +124,52 @@
     LayoutUnit flowAwarePaddingEnd() const;
     LayoutUnit flowAwarePaddingBefore() const;
     LayoutUnit flowAwarePaddingAfter() const;
-    LayoutUnit flowAwareMarginStartForChild(RenderBox* child) const;
-    LayoutUnit flowAwareMarginEndForChild(RenderBox* child) const;
-    LayoutUnit flowAwareMarginBeforeForChild(RenderBox* child) const;
-    LayoutUnit flowAwareMarginAfterForChild(RenderBox* child) const;
-    LayoutUnit crossAxisMarginExtentForChild(RenderBox* child) const;
+    LayoutUnit flowAwareMarginStartForChild(RenderBox& child) const;
+    LayoutUnit flowAwareMarginEndForChild(RenderBox& child) const;
+    LayoutUnit flowAwareMarginBeforeForChild(RenderBox& child) const;
+    LayoutUnit flowAwareMarginAfterForChild(RenderBox& child) const;
+    LayoutUnit crossAxisMarginExtentForChild(RenderBox& child) const;
     LayoutUnit crossAxisScrollbarExtent() const;
-    LayoutPoint flowAwareLocationForChild(RenderBox* child) const;
+    LayoutPoint flowAwareLocationForChild(RenderBox& child) const;
     // FIXME: Supporting layout deltas.
-    void setFlowAwareLocationForChild(RenderBox* child, const LayoutPoint&);
-    void adjustAlignmentForChild(RenderBox* child, LayoutUnit);
-    EAlignItems alignmentForChild(RenderBox* child) const;
-    LayoutUnit mainAxisBorderAndPaddingExtentForChild(RenderBox* child) const;
-    LayoutUnit mainAxisScrollbarExtentForChild(RenderBox* child) const;
-    LayoutUnit preferredMainAxisContentExtentForChild(RenderBox* child, bool hasInfiniteLineLength);
+    void setFlowAwareLocationForChild(RenderBox& child, const LayoutPoint&);
+    void adjustAlignmentForChild(RenderBox& child, LayoutUnit);
+    EAlignItems alignmentForChild(RenderBox& child) const;
+    LayoutUnit mainAxisBorderAndPaddingExtentForChild(RenderBox& child) const;
+    LayoutUnit mainAxisScrollbarExtentForChild(RenderBox& child) const;
+    LayoutUnit preferredMainAxisContentExtentForChild(RenderBox& child, bool hasInfiniteLineLength);
 
     void layoutFlexItems(bool relayoutChildren, Vector<LineContext>&);
     LayoutUnit autoMarginOffsetInMainAxis(const OrderedFlexItemList&, LayoutUnit& availableFreeSpace);
-    void updateAutoMarginsInMainAxis(RenderBox* child, LayoutUnit autoMarginOffset);
-    bool hasAutoMarginsInCrossAxis(RenderBox* child) const;
-    bool updateAutoMarginsInCrossAxis(RenderBox* child, LayoutUnit availableAlignmentSpace);
+    void updateAutoMarginsInMainAxis(RenderBox& child, LayoutUnit autoMarginOffset);
+    bool hasAutoMarginsInCrossAxis(RenderBox& child) const;
+    bool updateAutoMarginsInCrossAxis(RenderBox& child, LayoutUnit availableAlignmentSpace);
     void repositionLogicalHeightDependentFlexItems(Vector<LineContext>&);
     LayoutUnit clientLogicalBottomAfterRepositioning();
     void appendChildFrameRects(ChildFrameRects&);
     void repaintChildrenDuringLayoutIfMoved(const ChildFrameRects&);
 
-    LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox*);
-    LayoutUnit marginBoxAscentForChild(RenderBox*);
+    LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox&);
+    LayoutUnit marginBoxAscentForChild(RenderBox&);
 
     LayoutUnit computeChildMarginValue(const Length& margin);
     void computeMainAxisPreferredSizes(OrderHashSet&);
-    LayoutUnit adjustChildSizeForMinAndMax(RenderBox*, LayoutUnit childSize);
+    LayoutUnit adjustChildSizeForMinAndMax(RenderBox&, LayoutUnit childSize);
     bool computeNextFlexLine(OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, double& totalFlexGrow, double& totalWeightedFlexShrink, LayoutUnit& minMaxAppliedMainAxisExtent, bool& hasInfiniteLineLength);
 
     bool resolveFlexibleLengths(FlexSign, const OrderedFlexItemList&, LayoutUnit& availableFreeSpace, double& totalFlexGrow, double& totalWeightedFlexShrink, InflexibleFlexItemSize&, Vector<LayoutUnit>& childSizes, bool hasInfiniteLineLength);
     void freezeViolations(const Vector<Violation>&, LayoutUnit& availableFreeSpace, double& totalFlexGrow, double& totalWeightedFlexShrink, InflexibleFlexItemSize&, bool hasInfiniteLineLength);
 
-    void resetAutoMarginsAndLogicalTopInCrossAxis(RenderBox*);
-    bool needToStretchChild(RenderBox*);
-    void setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize);
-    void prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset, PositionedLayoutMode);
+    void resetAutoMarginsAndLogicalTopInCrossAxis(RenderBox&);
+    bool needToStretchChild(RenderBox&);
+    void setLogicalOverrideSize(RenderBox& child, LayoutUnit childPreferredSize);
+    void prepareChildForPositionedLayout(RenderBox& child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset, PositionedLayoutMode);
     size_t numberOfInFlowPositionedChildren(const OrderedFlexItemList&) const;
     void layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList&, const Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace, bool relayoutChildren, Vector<LineContext>&);
     void layoutColumnReverse(const OrderedFlexItemList&, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace);
     void alignFlexLines(Vector<LineContext>&);
     void alignChildren(const Vector<LineContext>&);
-    void applyStretchAlignmentToChild(RenderBox*, LayoutUnit lineCrossAxisExtent);
+    void applyStretchAlignmentToChild(RenderBox&, LayoutUnit lineCrossAxisExtent);
     void flipForRightToLeftColumn();
     void flipForWrapReverse(const Vector<LineContext>&, LayoutUnit crossAxisStartEdge);
 
diff --git a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
index ec9d810..c176b8a 100644
--- a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
+++ b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
@@ -172,9 +172,9 @@
     if (relayoutChildren)
         m_flowThread->setChildNeedsLayout(MarkOnlyThis);
     
-    setLogicalTopForChild(m_flowThread, borderAndPaddingBefore());
+    setLogicalTopForChild(*m_flowThread, borderAndPaddingBefore());
     m_flowThread->layoutIfNeeded();
-    determineLogicalLeftPositionForChild(m_flowThread);
+    determineLogicalLeftPositionForChild(*m_flowThread);
     
     return m_flowThread;
 }
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 8f30c9f..32bcf63 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -463,7 +463,7 @@
     return lineSnapAdjustment(newPageLogicalTop - (blockOffset + lineTopWithLeading()));
 }
 
-GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+GapRects RootInlineBox::lineSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
     LayoutUnit selTop, LayoutUnit selHeight, const LogicalSelectionOffsetCaches& cache, const PaintInfo* paintInfo)
 {
     RenderObject::SelectionState lineState = selectionState();
@@ -499,7 +499,7 @@
             if (box->selectionState() != RenderObject::SelectionNone) {
                 LayoutRect logicalRect(lastLogicalLeft, selTop, box->logicalLeft() - lastLogicalLeft, selHeight);
                 logicalRect.move(renderer().isHorizontalWritingMode() ? offsetFromRootBlock : LayoutSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
-                LayoutRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
+                LayoutRect gapRect = rootBlock.logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
                 if (isPreviousBoxSelected && gapRect.width() > 0 && gapRect.height() > 0) {
                     if (paintInfo && box->parent()->renderer().style()->visibility() == VISIBLE)
                         paintInfo->context->fillRect(gapRect, box->parent()->renderer().selectionBackgroundColor(), box->parent()->renderer().style()->colorSpace());
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 39c680a..a9bb5b1 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -134,7 +134,7 @@
     InlineBox* firstSelectedBox();
     InlineBox* lastSelectedBox();
 
-    GapRects lineSelectionGap(RenderBlock* rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
+    GapRects lineSelectionGap(RenderBlock& rootBlock, const LayoutPoint& rootBlockPhysicalPosition, const LayoutSize& offsetFromRootBlock,
         LayoutUnit selTop, LayoutUnit selHeight, const LogicalSelectionOffsetCaches&, const PaintInfo*);
 
     IntRect computeCaretRect(float logicalLeftPosition, unsigned caretWidth, LayoutUnit* extraWidthToEndOfLine) const;
@@ -142,13 +142,13 @@
     InlineBox* closestLeafChildForPoint(const IntPoint&, bool onlyEditableLeaves);
     InlineBox* closestLeafChildForLogicalLeftPosition(int, bool onlyEditableLeaves = false);
 
-    void appendFloat(RenderBox* floatingBox)
+    void appendFloat(RenderBox& floatingBox)
     {
         ASSERT(!isDirty());
         if (m_floats)
-            m_floats->append(floatingBox);
+            m_floats->append(&floatingBox);
         else
-            m_floats= adoptPtr(new Vector<RenderBox*>(1, floatingBox));
+            m_floats = adoptPtr(new Vector<RenderBox*>(1, &floatingBox));
     }
 
     Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
diff --git a/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp b/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp
index b714845..178b9684 100644
--- a/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp
+++ b/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp
@@ -56,7 +56,7 @@
 
 void ShapeOutsideInfo::updateDeltasForContainingBlockLine(const RenderBlockFlow* containingBlock, const FloatingObject* floatingObject, LayoutUnit lineTop, LayoutUnit lineHeight)
 {
-    LayoutUnit shapeTop = containingBlock->logicalTopForFloat(floatingObject) + std::max(LayoutUnit(), containingBlock->marginBeforeForChild(m_renderer));
+    LayoutUnit shapeTop = containingBlock->logicalTopForFloat(floatingObject) + std::max(LayoutUnit(), containingBlock->marginBeforeForChild(*m_renderer));
     LayoutUnit lineTopInShapeCoordinates = lineTop - shapeTop + logicalTopOffset();
 
     if (shapeSizeDirty() || m_lineTop != lineTopInShapeCoordinates || m_lineHeight != lineHeight) {
@@ -69,10 +69,10 @@
         if (lineOverlapsShapeBounds()) {
             SegmentList segments = computeSegmentsForLine(lineTopInShapeCoordinates, lineHeight);
             if (segments.size()) {
-                LayoutUnit rawLeftMarginBoxDelta = segments.first().logicalLeft + containingBlock->marginStartForChild(m_renderer);
+                LayoutUnit rawLeftMarginBoxDelta = segments.first().logicalLeft + containingBlock->marginStartForChild(*m_renderer);
                 m_leftMarginBoxDelta = clampTo<LayoutUnit>(rawLeftMarginBoxDelta, LayoutUnit(), floatMarginBoxWidth);
 
-                LayoutUnit rawRightMarginBoxDelta = segments.last().logicalRight - containingBlock->logicalWidthForChild(m_renderer) - containingBlock->marginEndForChild(m_renderer);
+                LayoutUnit rawRightMarginBoxDelta = segments.last().logicalRight - containingBlock->logicalWidthForChild(*m_renderer) - containingBlock->marginEndForChild(*m_renderer);
                 m_rightMarginBoxDelta = clampTo<LayoutUnit>(rawRightMarginBoxDelta, -floatMarginBoxWidth, LayoutUnit());
                 return;
             }
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index fa6b6ad..58940df 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -178,10 +178,10 @@
             ASSERT(cb);
             while (cb->isAnonymous() && !cb->isRenderView()) {
                 cb = cb->containingBlock();
-                cb->addPercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+                cb->addPercentHeightDescendant(const_cast<RenderSVGRoot&>(*this));
             }
         } else
-            RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+            RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot&>(*this));
 
         return resolveLengthAttributeForSVG(height, style()->effectiveZoom(), containingBlock()->availableLogicalHeight(IncludeMarginBorderPadding), &view());
     }
@@ -307,7 +307,7 @@
 
 void RenderSVGRoot::willBeDestroyed()
 {
-    RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+    RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot&>(*this));
 
     SVGResourcesCache::clientDestroyed(this);
     RenderReplaced::willBeDestroyed();