Fix crash when establishing an inline continuation inside a block continuation.

Source/core/layout/LayoutTable.cpp

Index: Source/core/layout/LayoutTable.cpp
diff --git a/Source/core/layout/LayoutTable.cpp b/Source/core/layout/LayoutTable.cpp
index ae01460b50ad69914093e7b83218b2997be0bc7e..6cf3c1b05c3cec5a3569bcbb8d52401d6d446fd5 100644
--- a/Source/core/layout/LayoutTable.cpp
+++ b/Source/core/layout/LayoutTable.cpp
@@ -207,6 +207,16 @@ void LayoutTable::addChild(RenderObject* child, RenderObject* beforeChild)
     section->addChild(child);
 }
 
+void LayoutTable::addChildIgnoringContinuation(RenderObject* newChild, RenderObject* beforeChild)
+{
+    // We need to bypass the RenderBlock implementation and instead do a normal addChild() (or we
+    // won't get there at all), so that any missing anonymous table part renderers are
+    // inserted. Otherwise we might end up with an insane render tree with inlines or blocks as
+    // direct children of a table, which will break assumptions made all over the code, which may
+    // lead to crashers and security issues.
+    addChild(newChild, beforeChild);
+}
+
 void LayoutTable::addCaption(const LayoutTableCaption* caption)
 {
     ASSERT(m_captions.find(caption) == kNotFound);