Added another guard to the NodeRenderingContext::nextSibling() fast path and its twin.

Source/core/dom/NodeRenderingTraversal.h

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 75 matching lines @@
 #endif
         return node->parentNodeGuaranteedHostFree();
     }
 
     return parentSlow(node, details);
 }
 
 inline Node* nextSibling(const Node* node)
 {
     if (!node->needsShadowTreeWalker()) {
-        ASSERT(nextSiblingSlow(node) == node->nextSibling());
-        return node->nextSibling();
+        Node* next = node->nextSibling();
+        if (!next || !next->isInsertionPoint()) {
+            ASSERT(nextSiblingSlow(node) == next);
+            return next;
+        }
     }
 
     return nextSiblingSlow(node);
 }
 
 inline Node* previousSibling(const Node* node)
 {
     if (!node->needsShadowTreeWalker()) {
-        ASSERT(previousSiblingSlow(node) == node->previousSibling());
-        return node->previousSibling();
+        Node* prev = node->previousSibling();
+        if (!prev || !prev->isInsertionPoint()) {
+            ASSERT(previousSiblingSlow(node) == prev);
+            return prev;
+        }
     }
 
     return previousSiblingSlow(node);
 }
 
 }
 
 } // namespace WebCore
 
 #endif