[CSSGridLayout] <embed> elements leaving stale pointers into grid

Source/core/rendering/RenderGrid.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 188 matching lines @@
 }
 
 void RenderGrid::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     // If the new requested beforeChild is not one of our children is because it's wrapped by an anonymous container. If
     // we do not special case this situation we could end up calling addChild() twice for the newChild, one with the
     // initial beforeChild and another one with its parent.
     if (beforeChild && beforeChild->parent() != this) {
         ASSERT(beforeChild->parent()->isAnonymous());
         beforeChild = splitAnonymousBoxesAroundChild(beforeChild);
+        dirtyGrid();
     }
 
     RenderBlock::addChild(newChild, beforeChild);
 
     if (gridIsDirty())
         return;
 
     if (!newChild->isBox()) {
         dirtyGrid();
         return;
@@ skipping 1204 matching lines @@
     if (isOutOfFlowPositioned())
         return "RenderGrid (positioned)";
     if (isAnonymous())
         return "RenderGrid (generated)";
     if (isRelPositioned())
         return "RenderGrid (relative positioned)";
     return "RenderGrid";
 }
 
 } // namespace blink