Check if length isSpecified before accessing.

Source/core/layout/LayoutTableSection.cpp

Index: Source/core/layout/LayoutTableSection.cpp
diff --git a/Source/core/layout/LayoutTableSection.cpp b/Source/core/layout/LayoutTableSection.cpp
index 34c709e8ef2d19ebda472fe4f9cfa77750ce14db..6519b756dd9f3d8cae1dc7186db6267237737bb8 100644
--- a/Source/core/layout/LayoutTableSection.cpp
+++ b/Source/core/layout/LayoutTableSection.cpp
@@ -723,8 +723,14 @@ int LayoutTableSection::calcRowLogicalHeight()
         m_grid[r].baseline = -1;
         LayoutUnit baselineDescent = 0;
 
-        // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
-        m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        if (m_grid[r].logicalHeight.isSpecified()) {
+            // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
+            m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        } else {
+            // Non-specified lengths are ignored because the row already accounts for the cells
+            // intrinsic logical height.
+            m_rowPos[r + 1] = std::max(m_rowPos[r], 0);
+        }
 
         Row& row = m_grid[r].row;
         unsigned totalCols = row.size();