Merge 123062 - Crash in RenderTableSection::addCell.

Source/WebCore/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 3933 matching lines @@
 {
     return style()->logicalHeight().isPercent()
             || style()->logicalMinHeight().isPercent()
             || style()->logicalMaxHeight().isPercent();
 }
 
 static void markBoxForRelayoutAfterSplit(RenderBox* box)
 {
     // FIXME: The table code should handle that automatically. If not,
     // we should fix it and remove the table part checks.
-    if (box->isTable())
-        toRenderTable(box)->setNeedsSectionRecalc();
-    else if (box->isTableSection())
+    if (box->isTable()) {
+        // Because we may have added some sections with already computed column structures, we need to
+        // sync the table structure with them now. This avoids crashes when adding new cells to the table.
+        toRenderTable(box)->forceSectionsRecalc();
+    } else if (box->isTableSection())
         toRenderTableSection(box)->setNeedsCellRecalc();
 
     box->setNeedsLayoutAndPrefWidthsRecalc();
 }
 
 RenderObject* RenderBox::splitAnonymousBoxesAroundChild(RenderObject* beforeChild)
 {
     bool didSplitParentAnonymousBoxes = false;
 
     while (beforeChild->parent() != this) {
@@ skipping 18 matching lines @@
     }
 
     if (didSplitParentAnonymousBoxes)
         markBoxForRelayoutAfterSplit(this);
 
     ASSERT(beforeChild->parent() == this);
     return beforeChild;
 }
 
 } // namespace WebCore