ASSERTION FAILED: span >= 1 in WebCore::RenderTable::slowColElement

Source/core/html/HTMLTableColElement.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 46 matching lines @@
 {
     if (name == widthAttr)
         addHTMLLengthToStyle(style, CSSPropertyWidth, value);
     else
         HTMLTablePartElement::collectStyleForPresentationAttribute(name, value, style);
 }
 
 void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == spanAttr) {
-        m_span = !value.isNull() ? value.toInt() : 1;
+        int newSpan = value.toInt();
+        // Use 1 if number is too big or zero.

[Julien - ping for review, 2014/03/13 18:29:24]

This comment is ambiguous IMO: if |value| is not a number you would also get 0.

I would just put the quote from HTML5 (along with an explanation why it covers
also invalid integers):

// |span| must be a valid non-negative integer greater than zero.
// toInt() returns 0 if |value| is not a valid integer so we only check this
value.

+        m_span = newSpan ? newSpan : 1;
         if (renderer() && renderer()->isRenderTableCol())
             renderer()->updateFromElement();
     } else if (name == widthAttr) {
         if (!value.isEmpty()) {
             if (renderer() && renderer()->isRenderTableCol()) {
                 RenderTableCol* col = toRenderTableCol(renderer());
                 int newWidth = width().toInt();
                 if (newWidth != col->width())
                     col->setNeedsLayoutAndPrefWidthsRecalc();
             }
@@ skipping 15 matching lines @@
 {
     setIntegralAttribute(spanAttr, n);
 }
 
 const AtomicString& HTMLTableColElement::width() const
 {
     return getAttribute(widthAttr);
 }
 
 }