Check if length isSpecified before accessing.

Source/core/layout/LayoutTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 705 matching lines @@
 
     SpanningLayoutTableCells rowSpanCells;
 #if ENABLE(ASSERT)
     HashSet<const LayoutTableCell*> uniqueCells;
 #endif
 
     for (unsigned r = 0; r < m_grid.size(); r++) {
         m_grid[r].baseline = -1;
         LayoutUnit baselineDescent = 0;
 
-        // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
-        m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        if (m_grid[r].logicalHeight.isSpecified()) {
+            // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
+            m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        } else {
+            m_rowPos[r + 1] = std::max(m_rowPos[r], 0);

[Julien - ping for review, 2015/05/26 16:06:37]

We should probably put a comment about why it's OK to ignore the other values.
The reason is that the row already accounts for the cell's intrinsic logical
height (the other values should never show up here).

[dsinclair, 2015/05/27 15:20:06]

Done.

+        }
 
         Row& row = m_grid[r].row;
         unsigned totalCols = row.size();
         LayoutTableCell* lastRowSpanCell = 0;
 
         for (unsigned c = 0; c < totalCols; c++) {
             CellStruct& current = cellAt(r, c);
             for (unsigned i = 0; i < current.cells.size(); i++) {
                 cell = current.cells[i];
                 if (current.inColSpan && cell->rowSpan() == 1)
@@ skipping 884 matching lines @@
     // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
 }
 
 } // namespace blink