Fix crash when establishing an inline continuation inside a block continuation.

Source/core/layout/LayoutTable.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 189 matching lines @@
     }
 
     if (beforeChild && !beforeChild->isTableSection() && needsTableSection(beforeChild))
         beforeChild = 0;
 
     LayoutTableSection* section = LayoutTableSection::createAnonymousWithParentRenderer(this);
     addChild(section, beforeChild);
     section->addChild(child);
 }
 
+void LayoutTable::addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild)
+{
+    // We need to bypass the RenderBlock implementation and instead do a normal addChild() (or we
+    // won't get there at all), so that any missing anonymous table part renderers are
+    // inserted. Otherwise we might end up with an insane render tree with inlines or blocks as
+    // direct children of a table, which will break assumptions made all over the code, which may
+    // lead to crashers and security issues.
+    addChild(newChild, beforeChild);
+}
+
 void LayoutTable::addCaption(const LayoutTableCaption* caption)
 {
     ASSERT(m_captions.find(caption) == kNotFound);
     m_captions.append(const_cast<LayoutTableCaption*>(caption));
 }
 
 void LayoutTable::removeCaption(const LayoutTableCaption* oldCaption)
 {
     size_t index = m_captions.find(oldCaption);
     ASSERT(index != kNotFound);
@@ skipping 1124 matching lines @@
 const BorderValue& LayoutTable::tableEndBorderAdjoiningCell(const LayoutTableCell* cell) const
 {
     ASSERT(cell->isFirstOrLastCellInRow());
     if (hasSameDirectionAs(cell->row()))
         return style()->borderEnd();
 
     return style()->borderStart();
 }
 
 }