| Log Message: |
Revert 164125 "ASSERTION FAILED: !object || object->isTable()"
Caused multiple use-after-free bugs. See bugs 330626, 331029.
> ASSERTION FAILED: !object || object->isTable()
>
> The issue is caused by call sites of
> RenderBlock::addChildIgnoringAnonymousColumnBlocks
> that basically bypass the RenderTable::addChild logic causing
> all sorts of mayhem. The fix I decided on is to fix the previous
> RenderBlock function as it's the safest approach to the current
> madness.
>
> This change adds an extra ASSERT into RenderObjectChildList to
> catch further problem earlier.
>
> BUG=309421
>
> Review URL: https://codereview.chromium.org/111873005
TBR=jchaffraix@chromium.org
Review URL: https://codereview.chromium.org/104593014
|