ASSERTION FAILED: !object || object->isTable()

The issue is caused by call sites of
RenderBlock::addChildIgnoringAnonymousColumnBlocks
that basically bypass the RenderTable::addChild logic causing
all sorts of mayhem. The fix I decided on is to fix the previous
RenderBlock function as it's the safest approach to the current
madness.

This change adds an extra ASSERT into RenderObjectChildList to
catch further problem earlier.

BUG=309421

Review URL: https://codereview.chromium.org/111873005

git-svn-id: svn://svn.chromium.org/blink/trunk@164125 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Update mavericks baselines for 3 failing tests after r164109.

Looks like we didn't pick up new baselines from the 10.9 bot; perhaps
the auto-rebaseline bot has not been restarted or isn't aware of it ...

TBR=robhogan@gmail.com, ojan@chromium.org
BUG=none

Review URL: https://codereview.chromium.org/93643006

git-svn-id: svn://svn.chromium.org/blink/trunk@164126 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Move SVGRareData bit field from Node to SVGElement

This frees up a bit in Node, and since SVGElement already had a bunch
of bools we can switch them to a bitfield and not grow the memory usage
there either.

Review URL: https://codereview.chromium.org/118373005

git-svn-id: svn://svn.chromium.org/blink/trunk@164127 bbb929c8-8fbe-4397-9dbb-9b2b20218538
remove unused methods from Navigator

BUG=

Review URL: https://codereview.chromium.org/117313003

git-svn-id: svn://svn.chromium.org/blink/trunk@164129 bbb929c8-8fbe-4397-9dbb-9b2b20218538