End tag of </td> or </th> in "in cell" mode wrongly asserts current node will be "tr"

http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-intd

The passage:

Switch the insertion mode to "in row". (The current node will be a tr element at this point.)

The current node will not necessarily be a tr in the fragment case.

WebKit had this as an ASSERT in our TreeBuilder:
http://trac.webkit.org/browser/trunk/WebCore/html/HTMLTreeBuilder.cpp?rev=65006#L2000

But that ASSERT is false in the case of:

<table><tr></tr></table>
<script>
    rows = document.getElementsByTagName("tr");
    for (i = 0; i < rows.length; ++i)
        rows[i].innerHTML += "<td>foo</td>";
</script>

Assuming I"m understanding the fragment case and how innerHTML is supposed to work correctly.

I recommend changing "(The current node will be a tr element at this point.)" to "(The current node will be a tr element at this point, except in the fragment case.)"

In the fragment case the "context element" must be a tr for this to be allowed (I think).