| Index: Source/core/rendering/RenderTableSection.cpp | 
| diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp | 
| index e594892ca244c1416edd9b8852b8d6c6594f41ca..a9d026ae2c83c043f92aba7ae1240e7d0968b347 100644 | 
| --- a/Source/core/rendering/RenderTableSection.cpp | 
| +++ b/Source/core/rendering/RenderTableSection.cpp | 
| @@ -127,7 +127,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild | 
| last = lastChild(); | 
| if (last && last->isAnonymous() && !last->isBeforeOrAfterContent()) { | 
| if (beforeChild == last) | 
| -                beforeChild = last->firstChild(); | 
| +                beforeChild = last->slowFirstChild(); | 
| last->addChild(child, beforeChild); | 
| return; | 
| } | 
| @@ -1509,7 +1509,7 @@ void RenderTableSection::recalcCells() | 
| tableRow->setRowIndex(insertionRow); | 
| setRowLogicalHeightToRowStyleLogicalHeight(m_grid[insertionRow]); | 
|  | 
| -            for (RenderObject* cell = row->firstChild(); cell; cell = cell->nextSibling()) { | 
| +            for (RenderObject* cell = tableRow->firstChild(); cell; cell = cell->nextSibling()) { | 
| if (!cell->isTableCell()) | 
| continue; | 
|  | 
|  |