Add speculative CHECKs to track down a failing ASSERT

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1145 matching lines @@
 
 void LayoutBlockFlow::layoutBlockChildren(bool relayoutChildren, SubtreeLayoutScope& layoutScope, LayoutUnit beforeEdge, LayoutUnit afterEdge)
 {
     dirtyForLayoutFromPercentageHeightDescendants(layoutScope);
 
     BlockChildrenLayoutInfo layoutInfo(this, beforeEdge, afterEdge);
     MarginInfo& marginInfo = layoutInfo.marginInfo();
 
     LayoutObject* childToExclude = layoutSpecialExcludedChild(relayoutChildren, layoutScope);
 
     LayoutBox* next = firstChildBox();

[mstensho (USE GERRIT), 2016/09/02 18:10:35]

I don't have permission to see the bug report, but shouldn't you also check if
firstChild() isBox()?

[foolip, 2016/09/02 18:59:48]

Yeah, I had CHECK(slowFirstChild->isBox()) here, but then backed it out because
the failure was in fact on the nextSiblingBox call. I backed it mostly because
of the risk of perf regressions from two slowFirstChild() calls, but I suppose I
could rewrite it a bit to avoid that. WDYT? I'll add you to the issue too.

     LayoutBox* lastNormalFlowChild = nullptr;
 
     while (next) {
         LayoutBox* child = next;
+        // TODO(foolip): Speculative CHECK to crash if any non-LayoutBox
+        // children ever appear, the childrenInline() check at the call site
+        // should make this impossible. crbug.com/632848
+        CHECK(child->nextSibling()->isBox());
         next = child->nextSiblingBox();
 
         child->setMayNeedPaintInvalidation();
 
         if (childToExclude == child)
             continue; // Skip this child, since it will be positioned by the specialized subclass (ruby runs).
 
         updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, *child);
 
         if (child->isOutOfFlowPositioned()) {
@@ skipping 2562 matching lines @@
 
     return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(PaintInvalidationReason invalidationReason) const
 {
     BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(invalidationReason);
 }
 
 } // namespace blink