Add speculative CHECKs to track down a failing ASSERT

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1150 matching lines @@
     dirtyForLayoutFromPercentageHeightDescendants(layoutScope);
 
     BlockChildrenLayoutInfo layoutInfo(this, beforeEdge, afterEdge);
     MarginInfo& marginInfo = layoutInfo.marginInfo();
 
     // Fieldsets need to find their legend and position it inside the border of the object.
     // The legend then gets skipped during normal layout. The same is true for ruby text.
     // It doesn't get included in the normal layout process but is instead skipped.
     LayoutObject* childToExclude = layoutSpecialExcludedChild(relayoutChildren, layoutScope);
 
-    LayoutBox* next = firstChildBox();
+    // TODO(foolip): Speculative CHECKs to crash if any non-LayoutBox
+    // children ever appear, the childrenInline() check at the call site
+    // should make this impossible. crbug.com/632848
+    LayoutObject* firstChild = this->firstChild();
+    CHECK(!firstChild || firstChild->isBox());
+    LayoutBox* next = toLayoutBox(firstChild);
     LayoutBox* lastNormalFlowChild = nullptr;
 
     while (next) {
         LayoutBox* child = next;
-        next = child->nextSiblingBox();
+        LayoutObject* nextSibling = child->nextSibling();
+        CHECK(!nextSibling || nextSibling->isBox());
+        next = toLayoutBox(nextSibling);
 
         child->setMayNeedPaintInvalidation();
 
         if (childToExclude == child)
             continue; // Skip this child, since it will be positioned by the specialized subclass (fieldsets and ruby runs).
 
         updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, *child);
 
         if (child->isOutOfFlowPositioned()) {
             child->containingBlock()->insertPositionedObject(child);
@@ skipping 2566 matching lines @@
 
     return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(PaintInvalidationReason invalidationReason) const
 {
     BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(invalidationReason);
 }
 
 } // namespace blink