Crashes when percent calculation of row's height goes very high.

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index a8f3d7752261439945f7837105e2a34c4ed9fcd0..f6e8b0593a5aa6c7b63896f2053f962e5f9f03b5 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -330,14 +330,14 @@ void LayoutTableSection::populateSpanningRowsHeightFromCell(LayoutTableCell* cel
     spanningRowsHeight.spanningCellHeightIgnoringBorderSpacing += borderSpacingForRow(rowIndex + rowSpan - 1);
 }
 
-void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCell* cell, int totalPercent, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
+void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCell* cell, float totalPercent, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
 {
     if (!extraRowSpanningHeight || !totalPercent)
         return;
 
     const unsigned rowSpan = cell->rowSpan();
     const unsigned rowIndex = cell->rowIndex();
-    int percent = std::min(totalPercent, 100);
+    float percent = std::min(totalPercent, 100.0f);
     const int tableHeight = m_rowPos[m_grid.size()] + extraRowSpanningHeight;
 
     // Our algorithm matches Firefox. Extra spanning height would be distributed Only in first percent height rows
@@ -347,9 +347,9 @@ void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCe
         if (percent > 0 && extraRowSpanningHeight > 0) {
             // TODO(alancutter): Make this work correctly for calc lengths.
             if (m_grid[row].logicalHeight.hasPercent()) {
-                int toAdd = (tableHeight * m_grid[row].logicalHeight.percent() / 100) - rowsHeight[row - rowIndex];
-                // FIXME: Note that this is wrong if we have a percentage above 100% and may make us grow
-                // above the available space.
+                int toAdd = (tableHeight *

[mstensho (USE GERRIT), 2016/01/18 14:37:03]

Please indent properly or put this back together on one line.

[a.suchit2, 2016/01/19 13:02:16]

Done.

+    std::min(m_grid[row].logicalHeight.percent(), percent) / 100)
+    - rowsHeight[row - rowIndex];
 
                 toAdd = std::max(std::min(toAdd, extraRowSpanningHeight), 0);
                 accumulatedPositionIncrease += toAdd;