Add speculative CHECKs to track down a failing ASSERT

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index e5e961f6337e716db069190cfd719b37b6136b1d..662f688b8f0ebfd5f2be34cdf650338ea9acd534 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -1168,12 +1168,19 @@ void LayoutBlockFlow::layoutBlockChildren(bool relayoutChildren, SubtreeLayoutSc
     // It doesn't get included in the normal layout process but is instead skipped.
     LayoutObject* childToExclude = layoutSpecialExcludedChild(relayoutChildren, layoutScope);
 
-    LayoutBox* next = firstChildBox();
+    // TODO(foolip): Speculative CHECKs to crash if any non-LayoutBox
+    // children ever appear, the childrenInline() check at the call site
+    // should make this impossible. crbug.com/632848
+    LayoutObject* firstChild = this->firstChild();
+    CHECK(!firstChild || firstChild->isBox());
+    LayoutBox* next = toLayoutBox(firstChild);
     LayoutBox* lastNormalFlowChild = nullptr;
 
     while (next) {
         LayoutBox* child = next;
-        next = child->nextSiblingBox();
+        LayoutObject* nextSibling = child->nextSibling();
+        CHECK(!nextSibling || nextSibling->isBox());
+        next = toLayoutBox(nextSibling);
 
         child->setMayNeedPaintInvalidation();