Height of fixed height cell is not proper when cell's row is under row spanning cell.

Source/core/rendering/RenderTableSection.h

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 104 matching lines @@
             , baseline()
         {
         }
 
         Row row;
         RenderTableRow* rowRenderer;
         LayoutUnit baseline;
         Length logicalHeight;
     };
 
+    struct SpanningRowsHeight {
+        WTF_MAKE_NONCOPYABLE(SpanningRowsHeight);
+
+    public:
+        SpanningRowsHeight()
+            : totalRowsHeight(0)
+            , spanningCellHeightIgnoringBorderSpacing(0)
+        {
+        }
+
+        Vector<int> rowHeight;
+        int totalRowsHeight;
+        int spanningCellHeightIgnoringBorderSpacing;
+    };
+
     const BorderValue& borderAdjoiningTableStart() const
     {
         if (hasSameDirectionAs(table()))
             return style()->borderStart();
 
         return style()->borderEnd();
     }
 
     const BorderValue& borderAdjoiningTableEnd() const
     {
@@ skipping 84 matching lines @@
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) OVERRIDE;
 
     int borderSpacingForRow(unsigned row) const { return m_grid[row].rowRenderer ? table()->vBorderSpacing() : 0; }
 
     void ensureRows(unsigned);
 
+    void populateSpanningRowsHeightFromCell(RenderTableCell*, struct SpanningRowsHeight&);
+    void distributeExtraRowSpanHeightToPercentRows(RenderTableCell*, int, int&, Vector<int>&);
+    void distributeExtraRowSpanHeightToAutoRows(RenderTableCell*, int, int&, Vector<int>&);
+    void distributeExtraRowSpanHeightToRemainingRows(RenderTableCell*, int, int&, Vector<int>&);
     void distributeRowSpanHeightToRows(SpanningRenderTableCells& rowSpanCells);
 
     void distributeExtraLogicalHeightToPercentRows(int& extraLogicalHeight, int totalPercent);
     void distributeExtraLogicalHeightToAutoRows(int& extraLogicalHeight, unsigned autoRowsCount);
     void distributeRemainingExtraLogicalHeight(int& extraLogicalHeight);
 
     void updateBaselineForCell(RenderTableCell*, unsigned row, LayoutUnit& baselineDescent);
 
     bool hasOverflowingCell() const { return m_overflowingCells.size() || m_forceSlowPaintPathWithOverflowingCell; }
     void computeOverflowFromCells(unsigned totalRows, unsigned nEffCols);
@@ skipping 54 matching lines @@
     ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isTableSection());
     return static_cast<const RenderTableSection*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
 void toRenderTableSection(const RenderTableSection*);
 
 } // namespace WebCore
 
 #endif // RenderTableSection_h