clusterfuzz OrtogonalChild fix

Another subtle bug related to adjusting table cells writing mode.

The problem is that Layout code keep track of orthogonal LayoutBoxes.
This list must be kept in sync after cell changes its writing mode.

Previous fix took care of keeping track of table cell, but did
not consider table cell's children.

Table cell's children could either become a root, or stop being
a root.

This fix updates the root state of table cell's children.

Thank you clusterfuzz!

Bug: 1124997
Change-Id: If8c123ba3172f505ea1dc2494a7b53c4a7290e9d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2393618
Auto-Submit: Aleks Totic <atotic@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804707}

third_party/blink/renderer/core/layout/layout_table_cell.cc

@@ -447,6 +447,17 @@ void LayoutTableCell::UpdateStyleWritingModeFromRow(const LayoutObject* row) {
                                      LayoutObject::ApplyStyleChanges::kNo);
   SetHorizontalWritingMode(StyleRef().IsHorizontalWritingMode());
   UnmarkOrthogonalWritingModeRoot();
+
+  for (LayoutObject* child = FirstChild(); child;
+       child = child->NextSibling()) {
+    if (child->IsBox()) {
+      LayoutBox* box_child = ToLayoutBox(child);
+      if (box_child->IsOrthogonalWritingModeRoot())
+        box_child->MarkOrthogonalWritingModeRoot();
+      else
+        box_child->UnmarkOrthogonalWritingModeRoot();
+    }
+  }
 }
 
 void LayoutTableCell::StyleDidChange(StyleDifference diff,