Fix crash when establishing an inline continuation inside a block continuation.

Source/core/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 432 matching lines @@
     }
 
     if (!beforeChild && !last->firstChild())
         return nextToLast;
     return last;
 }
 
 void RenderBlock::addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild)
 {
     RenderBlock* flow = continuationBefore(beforeChild);
-    ASSERT(!beforeChild || beforeChild->parent()->isAnonymousColumnSpanBlock() || beforeChild->parent()->isRenderBlock());
     RenderBoxModelObject* beforeChildParent = 0;
-    if (beforeChild)
+    if (beforeChild) {
         beforeChildParent = toRenderBoxModelObject(beforeChild->parent());
-    else {
+        // Don't attempt to insert into something that isn't a RenderBlockFlow (block
+        // container). While the DOM nodes of |beforeChild| and |newChild| are siblings, there may
+        // be anonymous table wrapper objects around |beforeChild| on the layout side. Therefore,
+        // find the nearest RenderBlockFlow. If it turns out that the new renderer doesn't belong
+        // inside the anonymous table, this will make sure that it's really put on the outside. If
+        // it turns out that it does belong inside it, the normal child insertion machinery will
+        // make sure it ends up there, and at the right place too. We cannot just guess that it's
+        // going to be right under the parent of |beforeChild|.
+        while (beforeChildParent && !beforeChildParent->isRenderBlockFlow()) {
+            ASSERT(!beforeChildParent->virtualContinuation());
+            ASSERT(beforeChildParent->isAnonymous());
+            ASSERT(beforeChildParent != this);

[Julien - ping for review, 2015/01/29 10:28:31]

RELEASE_ASSERT as this could yield to more madness?

[mstensho (USE GERRIT), 2015/01/29 12:08:42]

Done.

+            beforeChildParent = toRenderBoxModelObject(beforeChildParent->parent());
+        }
+        ASSERT(beforeChildParent);
+    } else {
         RenderBoxModelObject* cont = flow->continuation();
         if (cont)
             beforeChildParent = cont;
         else
             beforeChildParent = flow;
     }
 
     if (newChild->isFloatingOrOutOfFlowPositioned()) {
         beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
         return;
@@ skipping 3479 matching lines @@
 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const RenderObject* obj) const
 {
     showRenderObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace blink