Check if length isSpecified before accessing.

Source/core/layout/LayoutTableSection.cpp

Index: Source/core/layout/LayoutTableSection.cpp
diff --git a/Source/core/layout/LayoutTableSection.cpp b/Source/core/layout/LayoutTableSection.cpp
index 34c709e8ef2d19ebda472fe4f9cfa77750ce14db..b6266d0584fe7d2215e12d4ff6302d5e36754325 100644
--- a/Source/core/layout/LayoutTableSection.cpp
+++ b/Source/core/layout/LayoutTableSection.cpp
@@ -723,8 +723,12 @@ int LayoutTableSection::calcRowLogicalHeight()
         m_grid[r].baseline = -1;
         LayoutUnit baselineDescent = 0;
 
-        // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
-        m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        if (m_grid[r].logicalHeight.isSpecified()) {
+            // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
+            m_rowPos[r + 1] = std::max(m_rowPos[r] + minimumValueForLength(m_grid[r].logicalHeight, 0).round(), 0);
+        } else {
+            m_rowPos[r + 1] = std::max(m_rowPos[r], 0);

[Julien - ping for review, 2015/05/26 16:06:37]

We should probably put a comment about why it's OK to ignore the other values.
The reason is that the row already accounts for the cell's intrinsic logical
height (the other values should never show up here).

[dsinclair, 2015/05/27 15:20:06]

Done.

+        }
 
         Row& row = m_grid[r].row;
         unsigned totalCols = row.size();