Top-align table cells in rows that cross fragmentainer boundaries.

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index 7fffc1397a6be6c64a33997803c4158ccad603e6..f8802d139c13fd2d530f187aec0b6f0dba3bc916 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -1175,7 +1175,19 @@ void LayoutTableSection::layoutRows() {
       relayoutCellIfFlexed(*cell, r, rHeight);
 
       SubtreeLayoutScope layouter(*cell);
-      cell->computeIntrinsicPadding(rHeight, layouter);
+      LayoutUnit rowLogicalTop(m_rowPos[rowIndex]);
+      EVerticalAlign cellVerticalAlign;
+      // If the cell crosses a fragmentainer boundary, just align it at the
+      // top. That's how it was laid out initially, before we knew the final
+      // row height, and re-aligning it now could result in the cell being
+      // fragmented differently, which could change its height and thus violate
+      // the requested alignment. Give up instead of risking circular
+      // dependencies and unstable layout.
+      if (crossesPageBoundary(rowLogicalTop, LayoutUnit(rHeight)))
+        cellVerticalAlign = VerticalAlignTop;
+      else
+        cellVerticalAlign = cell->style()->verticalAlign();
+      cell->computeIntrinsicPadding(rHeight, cellVerticalAlign, layouter);
 
       LayoutRect oldCellRect = cell->frameRect();