WebKit/Source/core/layout/LayoutBlock.cpp in Blink as used in Google Chrome before 49.0.2623.75 does not properly determine when anonymous block wrappers may exist which allows remote attackers to cause a denial of service (incorrect cast and assertion failure) or possibly have unspecified other impact via crafted JavaScript code.