Crash when opening web page http://build.webkit.org/waterfall.

While distribution of spanning cell's extra height, Sorting of the
cell's comparator function is missing condition of arranging cells
based on accending order of row indexes.

R=jchaffraix@chromium.org
BUG=276253

Review URL: https://chromiumcodereview.appspot.com/23351002

git-svn-id: svn://svn.chromium.org/blink/trunk@157283 bbb929c8-8fbe-4397-9dbb-9b2b20218538