Before conversion to AXTableCell, isTableCell() should be called.

Source/modules/accessibility/AXTableColumn.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 72 matching lines @@
             LayoutTableCell* layoutCell = tableSection->primaryCellAt(r, m_columnIndex);
             if (!layoutCell)
                 continue;
 
             // Whenever cell's col is less then current column index, we've found the cell with colspan.
             // We do not need to add this cell, it's already been added.
             if (layoutCell->col() < m_columnIndex)
                 continue;
 
             AXObject* cell = axObjectCache()->getOrCreate(layoutCell->node());
-            if (!cell)
+            if (!cell || !cell->isTableCell())
                 continue;
 
             if (toAXTableCell(cell)->scanToDecideHeaderRole() == ColumnHeaderRole)
                 headers.append(cell);
         }
     }
 }
 
 AXObject* AXTableColumn::headerObject()
 {
@@ skipping 106 matching lines @@
         // make sure the last one isn't the same as this one (rowspan cells)
         if (m_children.size() > 0 && m_children.last() == cell)
             continue;
 
         m_children.append(cell);
         m_columnRect.unite(cell->elementRect());
     }
 }
 
 } // namespace blink