Heap-buffer-overflow in void std::__final_insertion_sort.

Source/core/rendering/RenderTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 396 matching lines @@
     // height cell to distribute it's extra height.
     if (cell1->rowIndex() == cell2->rowIndex() && cell1->rowSpan() == cell2->rowSpan())
         return (cell1->logicalHeightForRowSizing() > cell2->logicalHeightForRowSizing());
     // Sorting inner most cell first because if inner spanning cell'e extra height is distributed then outer
     // spanning cell's extra height will adjust accordingly. In reverse order, there is more chances that outer
     // spanning cell's height will exceed than defined by user.
     if (cellIsFullyIncludedInOtherCell(cell1, cell2))
         return true;
     // Sorting lower row index first because first we need to apply the extra height of spanning cell which
     // comes first in the table so lower rows's position would increment in sequence.
-    if (cellIsFullyIncludedInOtherCell(cell2, cell1))
+    if (!cellIsFullyIncludedInOtherCell(cell2, cell1))
         return (cell1->rowIndex() < cell2->rowIndex());
 
     return false;
 }
 
 bool RenderTableSection::isHeightNeededForRowHavingOnlySpanningCells(unsigned row)
 {
     unsigned totalCols = m_grid[row].row.size();
 
     if (!totalCols)
@@ skipping 1381 matching lines @@
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
     view()->addLayoutDelta(oldCellLocation - cell->location());
 }
 
 } // namespace WebCore