Heap-use-after-free in WebCore::RenderBlock::insertIntoTrackedRendererMaps
https://bugs.webkit.org/show_bug.cgi?id=105654

Reviewed by Simon Fraser.

Source/WebCore:

As with position:relative, position:sticky does not apply to table sections.

Test: fast/block/sticky-position-containing-block-crash.html

* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle):

LayoutTests:

* fast/block/sticky-position-containing-block-crash-expected.txt: Added.
* fast/block/sticky-position-containing-block-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138908 268f45cc-cd09-0410-ab3c-d52691b4dbfc