Crashes when percent calculation of row's height goes very high.

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index afb1424af20b17dd535baaf7b8b72eb90a7b5c23..defb9b1615fb154cc41bfffd95ad8c1bbff6d81e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -303,14 +303,16 @@ void LayoutTableSection::populateSpanningRowsHeightFromCell(LayoutTableCell* cel
     spanningRowsHeight.spanningCellHeightIgnoringBorderSpacing += borderSpacingForRow(rowIndex + rowSpan - 1);
 }
 
-void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCell* cell, int totalPercent, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
+void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(
+    LayoutTableCell* cell, float totalPercent, int& extraRowSpanningHeight,

[mstensho (USE GERRIT), 2015/11/02 10:46:42]

Please put this back on one line.

[a.suchit2, 2016/01/12 06:46:35]

Done.

+    Vector<int>& rowsHeight)
 {
     if (!extraRowSpanningHeight || !totalPercent)
         return;
 
     const unsigned rowSpan = cell->rowSpan();
     const unsigned rowIndex = cell->rowIndex();
-    int percent = std::min(totalPercent, 100);
+    float percent = std::min(totalPercent, 100.0f);
     const int tableHeight = m_rowPos[m_grid.size()] + extraRowSpanningHeight;
 
     // Our algorithm matches Firefox. Extra spanning height would be distributed Only in first percent height rows
@@ -320,9 +322,9 @@ void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCe
         if (percent > 0 && extraRowSpanningHeight > 0) {
             // TODO(alancutter): Make this work correctly for calc lengths.
             if (m_grid[row].logicalHeight.hasPercent()) {
-                int toAdd = (tableHeight * m_grid[row].logicalHeight.percent() / 100) - rowsHeight[row - rowIndex];
-                // FIXME: Note that this is wrong if we have a percentage above 100% and may make us grow
-                // above the available space.
+                int toAdd = (tableHeight *
+    std::min(m_grid[row].logicalHeight.percent(), percent) / 100)

[mstensho (USE GERRIT), 2015/11/02 10:46:42]

OK, so what you want to avoid here is integer overflow. How about using an
intermediary LayoutUnit here, which does saturated arithmetic? We certainly
don't want toAdd to be 0, which is the result of your changes.

I'm talking about changing toAdd from int to LayoutUnit.

Alternatively, change it from int to float.

[a.suchit2, 2016/01/12 06:46:35]

I am avoiding high value of percent which is not acceptable and trying to take
min. value which can be adjusted here.
In terms of the overflow, it may happen for int/float/double for all.
I did not get here that, how will LayoutUnit/float be helpful for changing toAdd
?

[mstensho (USE GERRIT), 2016/01/18 14:37:03]

Because LayoutUnit cannot overflow, since it uses saturated arithmetic.

The original code is:
int toAdd = (tableHeight * m_grid[row].logicalHeight.percent() / 100) -
rowsHeight[row - rowIndex];

Just wrapping a LayoutUnit around the right-hand side here will make the
assertion go away:

int toAdd = LayoutUnit((tableHeight * m_grid[row].logicalHeight.percent() / 100)
- rowsHeight[row - rowIndex]);

[a.suchit2, 2016/01/19 13:02:16]

Replied on latest patch set 5.

+    - rowsHeight[row - rowIndex];
 
                 toAdd = std::max(std::min(toAdd, extraRowSpanningHeight), 0);
                 accumulatedPositionIncrease += toAdd;