The ASSERT in appendNode() should not fire when OBJECTS are cloned.

Source/core/editing/CompositeEditCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 342 matching lines @@
         // Mutation events (bug 22634) from the text node insertion may have removed the refChild
         if (!refChild->inDocument())
             return;
         insertNodeBefore(insertChild, refChild);
     } else
         insertNodeAfter(insertChild, refChild);
 }
 
 void CompositeEditCommand::appendNode(PassRefPtrWillBeRawPtr<Node> node, PassRefPtrWillBeRawPtr<ContainerNode> parent)
 {
-    ASSERT(canHaveChildrenForEditing(parent.get()));
+    // When cloneParagraphUnderNewElement() clones the fallback content
+    // of an OBJECT element, the ASSERT below may fire since the return
+    // value of canHaveChildrenForEditing is not reliable until the render
+    // object of the OBJECT is created. Hence we ignore this check for OBJECTs.
+    ASSERT(canHaveChildrenForEditing(parent.get())
+        || (parent->isElementNode() && toElement(parent.get())->tagQName() == objectTag));
     applyCommandToComposite(AppendNodeCommand::create(parent, node));
 }
 
 void CompositeEditCommand::removeChildrenInRange(PassRefPtrWillBeRawPtr<Node> node, unsigned from, unsigned to)
 {
     WillBeHeapVector<RefPtrWillBeMember<Node>> children;
     Node* child = NodeTraversal::childAt(*node, from);
     for (unsigned i = from; child && i < to; i++, child = child->nextSibling())
         children.append(child);
 
@@ skipping 1119 matching lines @@
 }
 
 void CompositeEditCommand::trace(Visitor* visitor)
 {
     visitor->trace(m_commands);
     visitor->trace(m_composition);
     EditCommand::trace(visitor);
 }
 
 } // namespace blink