ASSERTION FAILED: span >= 1 in WebCore::RenderTable::slowColElement

Source/core/html/HTMLTableColElement.cpp

Index: Source/core/html/HTMLTableColElement.cpp
diff --git a/Source/core/html/HTMLTableColElement.cpp b/Source/core/html/HTMLTableColElement.cpp
index 19e301d95c045add824696d4600acab78d74193a..0447fa7fc23c334ead34c6e707a629b0df7664f5 100644
--- a/Source/core/html/HTMLTableColElement.cpp
+++ b/Source/core/html/HTMLTableColElement.cpp
@@ -64,7 +64,10 @@ void HTMLTableColElement::collectStyleForPresentationAttribute(const QualifiedNa
 void HTMLTableColElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
 {
     if (name == spanAttr) {
-        m_span = !value.isNull() ? value.toInt() : 1;
+        int newSpan = value.toInt();
+        // If the value of span is not a valid non-negative integer greater than zero,
+        // set it to 1.
+        m_span = newSpan ? newSpan : 1;
         if (renderer() && renderer()->isRenderTableCol())
             renderer()->updateFromElement();
     } else if (name == widthAttr) {