Revert 105795 - Merge 105685 - Crash in WebCore::RenderTableSection::rowLogicalHeightChanged

LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html

-<style>
-.c3 { position: fixed; }
-.c12:first-letter { visibility: inherit; }
-.c12 { -webkit-appearance: button; }
-.c13 { display: table-row; }
-.c13:nth-last-child(odd) { height: 80%; }
-</style>
-<script>
-if (window.layoutTestController)
-    layoutTestController.dumpAsText();
-
-function boom() {
-    var quote = document.createElement('q');
-    document.documentElement.appendChild(quote);
-
-    base = document.createElement('base');
-    base2 = document.createElement('base');
-    base2.setAttribute('class', 'c3');
-    quote.appendChild(base2);
-
-    var ins = document.createElement('ins');
-    base2.appendChild(ins);
-
-    var sub = document.createElement('sub');
-    var quote3 = document.createElement('q');
-    quote3.setAttribute('class', 'c12');
-    sub.appendChild(quote3);
-
-    figureRow = document.createElement('figure');
-    figureRow.setAttribute('class', 'c13');
-    document.documentElement.appendChild(figureRow);
-
-    var col = document.createElement('col');
-    col.setAttribute('class', 'c13');
-    document.documentElement.appendChild(col);
-
-    var select = document.createElement('select');
-    document.documentElement.appendChild(select);
-
-    code = document.createElement('code');
-    document.documentElement.appendChild(code);
-
-    quote2 = document.createElement('q');
-    setTimeout('quote2.appendChild(code);', 321);
-    ins.appendChild(sub);
-    setTimeout('base.appendChild(figureRow);', 251);
-    text = document.createTextNode('-1435037881');
-    setTimeout('figureRow.appendChild(text);', 206);
-}
-window.onload = boom;
-</script>
-<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
-<p>This test passes if it does not crash nor ASSERT.</p>