WebCore:

        Reviewed by Dave Hyatt.

        - fix <rdar://problem/5615307> Repro crash in WebKit!WebCore::RenderContainer::destroyLeftoverChildren

        Test: fast/table/insert-row-before-form.html

        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::addChild): Changed to ensure that the
        object a new cell is inserted before is a child of the row, and
        added an assertion that that object is either a cell or a form.
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::addChild): Changed to ensure that the
        object a new row is inserted before is a child of the table section, and
        added an assertion that that object is either a table row or a form.

LayoutTests:

        Reviewed by Dave Hyatt.

        - tests for <rdar://problem/5615307> Repro crash in WebKit!WebCore::RenderContainer::destroyLeftoverChildren

        * fast/table/insert-cell-before-form.html: Added.
        * fast/table/insert-row-before-form.html: Added.
        * platform/mac-leopard/fast/table: Added.
        * platform/mac-leopard/fast/table/insert-cell-before-form-expected.checksum: Added.
        * platform/mac-leopard/fast/table/insert-cell-before-form-expected.png: Added.
        * platform/mac-leopard/fast/table/insert-row-before-form-expected.checksum: Added.
        * platform/mac-leopard/fast/table/insert-row-before-form-expected.png: Added.
        * platform/mac/fast/table/insert-cell-before-form-expected.txt: Added.
        * platform/mac/fast/table/insert-row-before-form-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@29646 268f45cc-cd09-0410-ab3c-d52691b4dbfc
12 files changed