HTMLTableSectionElement.insertRow(0) / HTMLTableRowElement.insertCell(0) do not behave correctly

Source/core/html/HTMLTableSectionElement.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 58 matching lines @@
     int numRows = children ? static_cast<int>(children->length()) : 0;
     if (index < -1 || index > numRows) {
         exceptionState.throwDOMException(IndexSizeError, "The provided index (" + String::number(index) + " is outside the range [-1, " + String::number(numRows) + "].");
         return nullptr;
     }
 
     RefPtr<HTMLTableRowElement> row = HTMLTableRowElement::create(document());
     if (numRows == index || index == -1) {
         appendChild(row, exceptionState);
     } else {
-        Node* n = index ? children->item(index) : firstChild();
+        Element* n = children->item(index);

[tkent, 2014/05/07 01:18:23]

nit: We can remove the local variable |n| and fold this line into the next.

[Inactive, 2014/05/07 01:37:13]

Done.

         insertBefore(row, n, exceptionState);
     }
     return row.release();
 }
 
 void HTMLTableSectionElement::deleteRow(int index, ExceptionState& exceptionState)
 {
     RefPtr<HTMLCollection> children = rows();
     int numRows = children ? (int)children->length() : 0;
     if (index == -1)
@@ skipping 13 matching lines @@
         ++rowCount;
     return rowCount;
 }
 
 PassRefPtr<HTMLCollection> HTMLTableSectionElement::rows()
 {
     return ensureCachedHTMLCollection(TSectionRows);
 }
 
 }