Col width is not honored when dynamically updated and it would not make table narrower

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index 259b3875b3a5cbddabbf57c0a9e82a1a02925846..f1d8f50a602dddba100b8005545ad8ac882dd08c 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -1487,9 +1487,9 @@ void RenderTableSection::imageChanged(WrappedImagePtr, const IntRect*)
 void RenderTableSection::recalcCells()
 {
     ASSERT(m_needsCellRecalc);
-    // We reset the flag here to ensure that |addCell| works. This is safe to do as
-    // fillRowsWithDefaultStartingAtPosition makes sure we match the table's columns
-    // representation.
+    // We reset the flag here to ensure that addCell() works. This is safe to do because we clear the grid
+    // and update its dimensions to be consistent with the table's column representation before we rebuild
+    // the grid using addCell().
     m_needsCellRecalc = false;
 
     m_cCol = 0;
@@ -1541,12 +1541,17 @@ void RenderTableSection::rowLogicalHeightChanged(unsigned rowIndex)
 void RenderTableSection::setNeedsCellRecalc()
 {
     m_needsCellRecalc = true;
+
+    // Clear the grid now to ensure that we don't hold onto any stale pointers (e.g. a cell renderer that is being removed).
+    m_grid.clear();

[Julien - ping for review, 2014/03/29 01:04:21]

As stated in codereview.chromium.org/208263012 (based on the comments in
https://bugs.webkit.org/show_bug.cgi?id=129561), this doesn't seem to be the
right fix. It shouldn't solve a crasher (or if it does, I would like to have
some investigation as to why) but is still a good defense-in-depth pattern.

+
     if (RenderTable* t = table())
         t->setNeedsSectionRecalc();
 }
 
 unsigned RenderTableSection::numColumns() const
 {
+    ASSERT(!m_needsCellRecalc);
     unsigned result = 0;
 
     for (unsigned r = 0; r < m_grid.size(); ++r) {