Crashes when percent calculation of row's height goes very high.

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 296 matching lines @@
 {
     if (!extraRowSpanningHeight || !totalPercent)
         return;
 
     const unsigned rowSpan = cell->rowSpan();
     const unsigned rowIndex = cell->rowIndex();
     int percent = std::min(totalPercent, 100);
     const int tableHeight = m_rowPos[m_grid.size()] + extraRowSpanningHeight;
 
     // Our algorithm matches Firefox. Extra spanning height would be distributed Only in first percent height rows
     // those total percent is 100. Other percent rows would be uneffected even extra spanning height is remain.

[mstensho (USE GERRIT), 2015/10/16 18:19:13]

I have trouble with my overall understanding of this method. This comment seems
wrong. It doesn't stop at 100%

[a.suchit2, 2015/10/19 10:01:04]

line 320, 'percent > 0' have condition for stopping the further row.
and percent value is modified in line 333.

[mstensho (USE GERRIT), 2015/10/19 18:17:47]

Yeah, but what if the initial value of |percent| is 5000, for instance?

[a.suchit2, 2015/10/20 05:15:07]

yes, I am fixing same scenario here. But I should use remaining percent in place
of 100 in line 323.

[mstensho (USE GERRIT), 2015/10/20 08:12:37]

I think you should divide by |totalPercent|, but I think it's time for you to
upload another patch, and we'll take it from there.

     int accumulatedPositionIncrease = 0;
     for (unsigned row = rowIndex; row < (rowIndex + rowSpan); row++) {
         if (percent > 0 && extraRowSpanningHeight > 0) {
             // TODO(alancutter): Make this work correctly for calc lengths.
             if (m_grid[row].logicalHeight.hasPercent()) {
-                int toAdd = (tableHeight * m_grid[row].logicalHeight.percent() / 100) - rowsHeight[row - rowIndex];
+                float maxPercent = 100.0;

[mstensho (USE GERRIT), 2015/10/16 18:19:13]

I see no need for |maxPercent|. Just put 100.0 in the expression below.

If I were to introduce a local variable, it'd be for
m_grid[row].logicalHeight.percent(), which is used twice here.

[a.suchit2, 2015/10/19 10:01:04]

100.0 can not be used directly inside std::min because it is considered as
double and value return by m_grid[row].logicalHeight.percent() is float and
std::min gives compilation error.

[mstensho (USE GERRIT), 2015/10/19 18:17:47]

So float(100.0) should work, then.

[a.suchit2, 2015/10/20 05:15:07]

ok I will do it but I am not sure that it is acceptable or not.

+                int toAdd = (tableHeight *
+    std::min(m_grid[row].logicalHeight.percent(), maxPercent) / 100)

[mstensho (USE GERRIT), 2015/10/16 18:19:13]

Say, shouldn't you really divide by |totalPercent| and not 100 here? Especially
since we distribute the extra height over |totalPercent|%, which may be more
than 100, as far as I can tell.

[a.suchit2, 2015/10/19 10:01:04]

If we are using the |totalPercent| in place of 100 then row height is not based
on table height percent and we are consuming the whole |extraRowSpanningHeight|
height in percent cells. It means that whole |extraRowSpanningHeight| height
distributed in percent rows based on their ratio.

+    - rowsHeight[row - rowIndex];
                 // FIXME: Note that this is wrong if we have a percentage above 100% and may make us grow

[mstensho (USE GERRIT), 2015/10/16 18:19:13]

I guess this would no longer be the case, and that we'd behave correctly, even
with percent > 100?

[a.suchit2, 2015/10/19 10:01:04]

Yes, we can remove it.

                 // above the available space.
 
                 toAdd = std::max(std::min(toAdd, extraRowSpanningHeight), 0);
                 accumulatedPositionIncrease += toAdd;
                 extraRowSpanningHeight -= toAdd;
                 percent -= m_grid[row].logicalHeight.percent();
             }
         }
         m_rowPos[row + 1] += accumulatedPositionIncrease;
     }
@@ skipping 1309 matching lines @@
     // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
 }
 
 } // namespace blink