Merge 97074 - Handle insertion into an anonymous table part that

Source/WebCore/rendering/RenderTableSection.cpp

Index: Source/WebCore/rendering/RenderTableSection.cpp
===================================================================
--- Source/WebCore/rendering/RenderTableSection.cpp	(revision 97084)
+++ Source/WebCore/rendering/RenderTableSection.cpp	(working copy)
@@ -112,6 +112,15 @@
             return;
         }
 
+        if (beforeChild && !beforeChild->isAnonymous() && beforeChild->parent() == this) {
+            RenderObject* row = beforeChild->previousSibling();
+            if (row && row->isTableRow()) {
+                ASSERT(row->isAnonymous());
+                row->addChild(child);
+                return;
+            }
+        }
+
         // If beforeChild is inside an anonymous cell/row, insert into the cell or into
         // the anonymous row containing it, if there is one.
         RenderObject* lastBox = last;
@@ -1173,6 +1182,8 @@
 
 void RenderTableSection::splitColumn(int pos, int first)
 {
+    ASSERT(!m_needsCellRecalc);
+
     if (m_cCol > pos)
         m_cCol++;
     for (int row = 0; row < m_gridRows; ++row) {