Crashes when percent calculation of row's height goes very high.

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index a8f3d7752261439945f7837105e2a34c4ed9fcd0..b7528f52b286d9984606c40791a161706a60c77f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -330,14 +330,14 @@ void LayoutTableSection::populateSpanningRowsHeightFromCell(LayoutTableCell* cel
     spanningRowsHeight.spanningCellHeightIgnoringBorderSpacing += borderSpacingForRow(rowIndex + rowSpan - 1);
 }
 
-void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCell* cell, int totalPercent, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
+void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCell* cell, float totalPercent, int& extraRowSpanningHeight, Vector<int>& rowsHeight)
 {
     if (!extraRowSpanningHeight || !totalPercent)
         return;
 
     const unsigned rowSpan = cell->rowSpan();
     const unsigned rowIndex = cell->rowIndex();
-    int percent = std::min(totalPercent, 100);
+    float percent = std::min(totalPercent, 100.0f);
     const int tableHeight = m_rowPos[m_grid.size()] + extraRowSpanningHeight;
 
     // Our algorithm matches Firefox. Extra spanning height would be distributed Only in first percent height rows
@@ -347,9 +347,7 @@ void LayoutTableSection::distributeExtraRowSpanHeightToPercentRows(LayoutTableCe
         if (percent > 0 && extraRowSpanningHeight > 0) {
             // TODO(alancutter): Make this work correctly for calc lengths.
             if (m_grid[row].logicalHeight.hasPercent()) {
-                int toAdd = (tableHeight * m_grid[row].logicalHeight.percent() / 100) - rowsHeight[row - rowIndex];
-                // FIXME: Note that this is wrong if we have a percentage above 100% and may make us grow
-                // above the available space.
+                int toAdd = (tableHeight * std::min(m_grid[row].logicalHeight.percent(), percent) / 100) - rowsHeight[row - rowIndex];

[a.suchit2, 2016/01/19 13:02:16]

Do we need to use LayoutUnit here after this change.
IMO, remaining percent should be used if current row percent is bigger then
remaining percent.

If we use LayoutUnit((tableHeight * m_grid[row].logicalHeight.percent() / 100) -
rowsHeight[row - rowIndex]) then percent would be calculated based on the
current row value and total percent will exceeds the limit 100.

[mstensho (USE GERRIT), 2016/01/20 13:00:59]

OK, I get it now. I had a hard time following the logic of this method, but I
suppose we're just trying to copy the behavior of Firefox.

Your change makes sense.

 
                 toAdd = std::max(std::min(toAdd, extraRowSpanningHeight), 0);
                 accumulatedPositionIncrease += toAdd;