ASSERTION FAILED: span >= 1 in WebCore::RenderTable::slowColElement

Source/core/html/HTMLTableColElement.cpp

Index: Source/core/html/HTMLTableColElement.cpp
diff --git a/Source/core/html/HTMLTableColElement.cpp b/Source/core/html/HTMLTableColElement.cpp
index 19e301d95c045add824696d4600acab78d74193a..e754179c445ffad894aab357ae9435af71f4da93 100644
--- a/Source/core/html/HTMLTableColElement.cpp
+++ b/Source/core/html/HTMLTableColElement.cpp
@@ -64,7 +64,9 @@ void HTMLTableColElement::collectStyleForPresentationAttribute(const QualifiedNa
 void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == spanAttr) {
-        m_span = !value.isNull() ? value.toInt() : 1;
+        int newSpan = value.toInt();
+        // Use 1 if number is too big or zero.

[Julien - ping for review, 2014/03/13 18:29:24]

This comment is ambiguous IMO: if |value| is not a number you would also get 0.

I would just put the quote from HTML5 (along with an explanation why it covers
also invalid integers):

// |span| must be a valid non-negative integer greater than zero.
// toInt() returns 0 if |value| is not a valid integer so we only check this
value.

+        m_span = newSpan ? newSpan : 1;
         if (renderer() && renderer()->isRenderTableCol())
             renderer()->updateFromElement();
     } else if (name == widthAttr) {