Remove unreachable fragment case in "in cell" insertion mode

Fixes #7242.

Author: not-my-profile

source

@@ -127427,11 +127427,13 @@ document.body.appendChild(text);
    <dt>A start tag whose tag name is one of: "caption", "col",
    "colgroup", "tbody", "td", "tfoot", "th", "thead", "tr"</dt>
    <dd>
-    <p>If the <span>stack of open elements</span> does <em>not</em> <span data-x="has an element in
-    table scope">have a <code>td</code> or <code>th</code> element in table scope</span>, then this
-    is a <span>parse error</span>; ignore the token. (<span>fragment case</span>)</p>
+    <p><span>Assert</span>: The <span>stack of open elements</span> <span data-x="has an element in
+    table scope">has a <code>td</code> or <code>th</code> element in table scope</span>.</p>
+    <!-- Because "in row" only switches to "in cell" if a td or th element is on the stack
+    and the rules for resetting the insertion mode only yield "in cell" if last is false
+    (i.e. not if node is the fragment context). -->
 
-    <p>Otherwise, <span>close the cell</span> (see below) and reprocess the token.</p>
+    <p><span>Close the cell</span> (see below) and reprocess the token.</p>
    </dd>
 
    <dt>An end tag whose tag name is one of: "body", "caption",