Merge 125234

Source/WebCore/rendering/RenderBox.cpp

Index: Source/WebCore/rendering/RenderBox.cpp
===================================================================
--- Source/WebCore/rendering/RenderBox.cpp	(revision 126672)
+++ Source/WebCore/rendering/RenderBox.cpp	(working copy)
@@ -3994,6 +3994,10 @@
             RenderBox* postBox = boxToSplit->createAnonymousBoxWithSameTypeAs(this);
             postBox->setChildrenInline(boxToSplit->childrenInline());
             RenderBox* parentBox = toRenderBox(boxToSplit->parent());
+            // We need to invalidate the |parentBox| before inserting the new node
+            // so that the table repainting logic knows the structure is dirty.
+            // See for example RenderTableCell:clippedOverflowRectForRepaint.
+            markBoxForRelayoutAfterSplit(parentBox);
             parentBox->virtualChildren()->insertChildNode(parentBox, postBox, boxToSplit->nextSibling());
             boxToSplit->moveChildrenTo(postBox, beforeChild, 0, true);