Clusterfuzz table cell writing mode bug fix

LocalFrameView was keeping a list of orthogonal fragment roots
that was out of sync ater cell changed its writing mode.
The fix is to keep it in sync.
I believe fix is safe, because calling RemoveOrthogonalWritingModeRoot
is safe if cell is not in the list.

Bug: 1120956
Change-Id: I16ee0f8971a0ea17f78a9970913467a13d897c15
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2371308Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#800923}

third_party/blink/renderer/core/layout/layout_table_cell.cc

@@ -446,6 +446,7 @@ void LayoutTableCell::UpdateStyleWritingModeFromRow(const LayoutObject* row) {
   SetModifiedStyleOutsideStyleRecalc(new_style,
                                      LayoutObject::ApplyStyleChanges::kNo);
   SetHorizontalWritingMode(StyleRef().IsHorizontalWritingMode());
+  UnmarkOrthogonalWritingModeRoot();
 }
 
 void LayoutTableCell::StyleDidChange(StyleDifference diff,