Table Rowspan Crash With Huge Rowspan Cells 2

Test for chromium bug : 296003. Heap-buffer-overflow in void std::__final_insertion_sort.

For this test to PASS, it should not crash.

| row0col0 (rowspan=3) | row0col1 (rowspan=3) | row0col2 (rowspan=6) | row0col3 (rowspan=4) | row0col4 (rowspan=16) | row0col5 (rowspan=4) | row0col6 (rowspan=12) | row0col7 (rowspan=4) | row0col8 (rowspan=12) | | row1col9 | | row2col9 (rowspan=3) | row2col10 (rowspan=8) | row2col11 (rowspan=8) | row2col12 (rowspan=8) | row2col13 (rowspan=8) | | row3col0 | | row4col0 (rowspan=4) | row4col1 (rowspan=370) | | row5col3 | | row6col2 | | row7col2 (rowspan=6) | row7col3 (rowspan=6) | | row8col0 (rowspan=4) | row8col5 (rowspan=12) | row8col7 (rowspan=16) | row8col9 (rowspan=179) | row8col14 (rowspan=33) | | row9col15 (rowspan=35) | row9col16 (rowspan=3) | row9col17 (rowspan=6) | row9col18 (rowspan=24) | row9col19 (rowspan=19) | row9col20 (rowspan=3) | row9col21 (rowspan=13) | row9col22 (rowspan=22) | row9col23 (rowspan=5) | row9col24 (rowspan=20) |