Revert 164125 "ASSERTION FAILED: !object || object->isTable()"

Revert 164125 "ASSERTION FAILED: !object || object->isTable()"

Caused multiple use-after-free bugs. See bugs 330626, 331029.

> ASSERTION FAILED: !object || object->isTable()
> 
> The issue is caused by call sites of
> RenderBlock::addChildIgnoringAnonymousColumnBlocks
> that basically bypass the RenderTable::addChild logic causing
> all sorts of mayhem. The fix I decided on is to fix the previous
> RenderBlock function as it's the safest approach to the current
> madness.
> 
> This change adds an extra ASSERT into RenderObjectChildList to
> catch further problem earlier.
> 
> BUG=309421
> 
> Review URL: https://codereview.chromium.org/111873005

TBR=jchaffraix@chromium.org

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=164405

[inferno, 2014-01-01 00:45:41]

Committed patchset #1 manually as r164405.