In some edge cases (such as in accessible/tests/crashtests/1472024-1.html), there can be an outer HTML table which contains an inner table according to layout, but the inner table isn't included in the a11y tree.
The inner table has no semantic value, so including it wouldn't be appropriate.
However, HTMLTableAccessible::Col/RowExtent previously retrieved the table using the a11y tree, which meant we used the layout frame for the outer table instead of the inner table.
This resulted in assertions.
To fix this, always ask the cell's layout frame for the correct table frame, rather than walking the a11y tree.
As a bonus, this simplifies and trims the code somewhat.
Differential Revision: https://phabricator.services.mozilla.com/D184066
4d6b8a2e6c