| Index: Source/core/rendering/RenderObjectChildList.cpp
|
| diff --git a/Source/core/rendering/RenderObjectChildList.cpp b/Source/core/rendering/RenderObjectChildList.cpp
|
| index 80cee464c7d0afa6a8214a6949222d37a71e2a87..f13276f2566e680ea6c2ed003517e5af7d5603d2 100644
|
| --- a/Source/core/rendering/RenderObjectChildList.cpp
|
| +++ b/Source/core/rendering/RenderObjectChildList.cpp
|
| @@ -115,6 +115,7 @@ void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* n
|
| {
|
| ASSERT(!newChild->parent());
|
| ASSERT(!owner->isRenderBlockFlow() || (!newChild->isTableSection() && !newChild->isTableRow() && !newChild->isTableCell()));
|
| + ASSERT_WITH_SECURITY_IMPLICATION(!owner->isTable() || (newChild->isTableCaption() || newChild->isTableSection() || newChild->isRenderTableCol()));
|
|
|
| while (beforeChild && beforeChild->parent() && beforeChild->parent() != owner)
|
| beforeChild = beforeChild->parent();
|
|
|