ASSERTION FAILED: !object || object->isTable()

Source/core/rendering/RenderObjectChildList.cpp

 /*
  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 97 matching lines @@
     if (AXObjectCache* cache = owner->document().existingAXObjectCache())
         cache->childrenChanged(owner);
 
     return oldChild;
 }
 
 void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* newChild, RenderObject* beforeChild, bool notifyRenderer)
 {
     ASSERT(!newChild->parent());
     ASSERT(!owner->isRenderBlockFlow() || (!newChild->isTableSection() && !newChild->isTableRow() && !newChild->isTableCell()));
+    ASSERT_WITH_SECURITY_IMPLICATION(!owner->isTable() || (newChild->isTableCaption() || newChild->isTableSection() || newChild->isRenderTableCol()));
 
     while (beforeChild && beforeChild->parent() && beforeChild->parent() != owner)
         beforeChild = beforeChild->parent();
 
     // This should never happen, but if it does prevent render tree corruption
     // where child->parent() ends up being owner but child->nextSibling()->parent()
     // is not owner.
     if (beforeChild && beforeChild->parent() != owner) {
         ASSERT_NOT_REACHED();
         return;
@@ skipping 27 matching lines @@
 
     newChild->setNeedsLayoutAndPrefWidthsRecalc();
     if (!owner->normalChildNeedsLayout())
         owner->setChildNeedsLayout(); // We may supply the static position for an absolute positioned child.
 
     if (AXObjectCache* cache = owner->document().axObjectCache())
         cache->childrenChanged(owner);
 }
 
 } // namespace WebCore