Recognize when an anonymous table cell has been generated to wrap a cell

Source/core/dom/Text.cpp

Index: Source/core/dom/Text.cpp
diff --git a/Source/core/dom/Text.cpp b/Source/core/dom/Text.cpp
index 71ce46fafe31b261b867f458704327e75b04cf5b..cbe43473484023544e5c5095819cd984c78a5cf2 100644
--- a/Source/core/dom/Text.cpp
+++ b/Source/core/dom/Text.cpp
@@ -33,6 +33,7 @@
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/events/ScopedEventQueue.h"
+#include "core/html/HTMLTableCellElement.h"
 #include "core/layout/LayoutText.h"
 #include "core/layout/LayoutTextCombine.h"
 #include "core/layout/svg/LayoutSVGInlineText.h"
@@ -244,8 +245,11 @@ static inline bool hasGeneratedAnonymousTableCells(const LayoutObject& parent)
     LayoutObject* child = parent.slowFirstChild();
     if (!child || !child->isAnonymous())
         return false;
-    if (child->isTableCell())
-        return true;
+    if (child->isTableCell()) {
+        LayoutObject* firstChild = child->slowFirstChild();
+        // Ignore the anonymous table cell if it is wrapping a table cell element (e.g. because of <td style="display:block;">).
+        return !firstChild || !firstChild->node() || !isHTMLTableCellElement(firstChild->node());
+    }
     if (child->isTableSection() || child->isTableRow())
         return hasGeneratedAnonymousTableCells(*child);
     return false;