HTMLTableSectionElement.insertRow(0) / HTMLTableRowElement.insertCell(0) do not behave correctly

Source/core/html/HTMLTableRowElement.cpp

Index: Source/core/html/HTMLTableRowElement.cpp
diff --git a/Source/core/html/HTMLTableRowElement.cpp b/Source/core/html/HTMLTableRowElement.cpp
index d6fd9cefc8fe7f4f2adeddf0c77c22868c22e1aa..bbb0e2dcef1ebc1652dab1f354a10c2559e13dac 100644
--- a/Source/core/html/HTMLTableRowElement.cpp
+++ b/Source/core/html/HTMLTableRowElement.cpp
@@ -129,14 +129,10 @@ PassRefPtr<HTMLElement> HTMLTableRowElement::insertCell(int index, ExceptionStat
     }
 
     RefPtr<HTMLTableCellElement> cell = HTMLTableCellElement::create(tdTag, document());
-    if (index < 0 || index >= numCells)
+    if (numCells == index || index == -1) {
         appendChild(cell, exceptionState);
-    else {
-        Node* n;
-        if (index < 1)
-            n = firstChild();
-        else
-            n = children->item(index);
+    } else {
+        Element* n = children->item(index);

[tkent, 2014/05/07 01:18:23]

What happens if index == -2?

[Inactive, 2014/05/07 01:33:20]

This cannot happen, we already check for this above (line 126).

         insertBefore(cell, n, exceptionState);
     }
     return cell.release();