Merge 139788

Source/WebCore/rendering/RenderObjectChildList.cpp

Index: Source/WebCore/rendering/RenderObjectChildList.cpp
===================================================================
--- Source/WebCore/rendering/RenderObjectChildList.cpp	(revision 140738)
+++ Source/WebCore/rendering/RenderObjectChildList.cpp	(working copy)
@@ -153,10 +153,17 @@
     }
 
     ASSERT(!child->parent());
-    while (beforeChild->parent() != owner && beforeChild->parent()->isAnonymousBlock())
+    while (beforeChild->parent() && beforeChild->parent() != owner)
         beforeChild = beforeChild->parent();
-    ASSERT(beforeChild->parent() == owner);
 
+    // This should never happen, but if it does prevent render tree corruption
+    // where child->parent() ends up being owner but child->nextSibling()->parent()
+    // is not owner.
+    if (beforeChild->parent() != owner) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
     ASSERT(!owner->isBlockFlow() || (!child->isTableSection() && !child->isTableRow() && !child->isTableCell()));
 
     if (beforeChild == firstChild())