Heap-buffer-overflow in void std::__final_insertion_sort.

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index 4845ec9a454442c85dd298c705dbaa761a276494..b5e77a063205e9a62207401ef81466cc62ad1423 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -414,7 +414,7 @@ static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell*
         return true;
     // Sorting lower row index first because first we need to apply the extra height of spanning cell which
     // comes first in the table so lower rows's position would increment in sequence.
-    if (cellIsFullyIncludedInOtherCell(cell2, cell1))
+    if (!cellIsFullyIncludedInOtherCell(cell2, cell1))
         return (cell1->rowIndex() < cell2->rowIndex());
 
     return false;