Merge 139788

Source/WebCore/rendering/RenderObjectChildList.cpp

 /*
  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 135 matching lines @@
 }
 
 void RenderObjectChildList::insertChildNode(RenderObject* owner, RenderObject* child, RenderObject* beforeChild, bool notifyRenderer)
 {
     if (!beforeChild) {
         appendChildNode(owner, child, notifyRenderer);
         return;
     }
 
     ASSERT(!child->parent());
-    while (beforeChild->parent() != owner && beforeChild->parent()->isAnonymousBlock())
+    while (beforeChild->parent() && beforeChild->parent() != owner)
         beforeChild = beforeChild->parent();
-    ASSERT(beforeChild->parent() == owner);
+
+    // This should never happen, but if it does prevent render tree corruption
+    // where child->parent() ends up being owner but child->nextSibling()->parent()
+    // is not owner.
+    if (beforeChild->parent() != owner) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
 
     ASSERT(!owner->isBlockFlow() || (!child->isTableSection() && !child->isTableRow() && !child->isTableCell()));
 
     if (beforeChild == firstChild())
         setFirstChild(child);
 
     RenderObject* prev = beforeChild->previousSibling();
     child->setNextSibling(beforeChild);
     beforeChild->setPreviousSibling(child);
     if (prev)
@@ skipping 56 matching lines @@
     RenderObject* last = const_cast<RenderObject*>(owner);
     do {
         last = last->lastChild();
     } while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
     if (last && !last->isAfterContent())
         return 0;
     return last;
 }
 
 } // namespace WebCore