Crash when inner and outer spanning cells end indexes are same.

Source/core/rendering/RenderTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 396 matching lines @@
         unsigned rowSpan = cell->rowSpan();
 
         // Only heightest spanning cell will distribute it's extra height in row if more then one spanning cells
         // present at same level.
         if (rowIndex == lastRowIndex && rowSpan == lastRowSpan)
             continue;
 
         int originalBeforePosition = m_rowPos[rowIndex + rowSpan];
 
         if (extraHeightToPropagate) {
-            for (unsigned row = lastRowIndex + lastRowSpan + 1; row <= rowIndex + rowSpan; row++)
+            for (unsigned row = lastRowIndex + lastRowSpan; row <= rowIndex + rowSpan; row++)
                 m_rowPos[row] += extraHeightToPropagate;
         }
 
         lastRowIndex = rowIndex;
         lastRowSpan = rowSpan;
 
         struct SpanningRowsHeight spanningRowsHeight;
 
         populateSpanningRowsHeightFromCell(cell, spanningRowsHeight);
 
@@ skipping 20 matching lines @@
         int extraRowSpanningHeight = spanningRowsHeight.spanningCellHeightIgnoringBorderSpacing - spanningRowsHeight.totalRowsHeight;
 
         distributeExtraRowSpanHeightToPercentRows(cell, totalPercent, extraRowSpanningHeight, spanningRowsHeight.rowHeight);
         distributeExtraRowSpanHeightToAutoRows(cell, totalAutoRowsHeight, extraRowSpanningHeight, spanningRowsHeight.rowHeight);
         distributeExtraRowSpanHeightToRemainingRows(cell, totalRemainingRowsHeight, extraRowSpanningHeight, spanningRowsHeight.rowHeight);
 
         ASSERT(!extraRowSpanningHeight);
 
         // Getting total changed height in the table
         extraHeightToPropagate = m_rowPos[rowIndex + rowSpan] - originalBeforePosition;
+        m_rowPos[rowIndex + rowSpan] -= extraHeightToPropagate;

[Julien - ping for review, 2013/08/05 22:21:10]

This line seems dumb: can't we just patch the distribute functions to not touch
the |rowIndex + rowSpan|'s row instead?

[suchit.agrawal, 2013/08/05 23:33:55]

|extraHeightToPropagate| is calculated based on the position changed of
|rowIndex + rowSpan|.
This is last row of the spanning cell. we does not know how much extra height
would be applicable for this row which would be calculated by only distributed
functions only.
And meaning of distributed functions would be changes if we escape one row in
all row to distribute height. Some ASSERTs also used there which will not allow
it.
Even here, we don't know that which distributed function given the new height to
this row.

Or we can do following :

int originalBeforePosition = m_rowPos[rowIndex + rowSpan]; above can be changed
based on condition 
if (rowIndex + rowSpan == lastRowIndex + lastRowSpan)
originalBeforePosition = m_rowPos[rowIndex + rowSpan] - extraHeightToPropagate;
else
originalBeforePosition = m_rowPos[rowIndex + rowSpan];

But this will not work in below case :
where A rowspan value is 3 or more and B rowspan value is 2.

+---+---+
|   |   |
|   +---+---+
| A |   |   |
|   | B +---+
|   |   |   |
+---+---+---+

So I think, we need to stick on it. If you have any suggestions please let me
know. I will try my best to change it. Thanks

     }
 
     if (extraHeightToPropagate) {
         // Apply changed height by rowSpan cells to rows present at the end of the table
-        for (unsigned row = lastRowIndex + lastRowSpan + 1; row <= m_grid.size(); row++)
+        for (unsigned row = lastRowIndex + lastRowSpan; row <= m_grid.size(); row++)
             m_rowPos[row] += extraHeightToPropagate;
     }
 }
 
 // Find out the baseline of the cell
 // If the cell's baseline is more then the row's baseline then the cell's baseline become the row's baseline
 // and if the row's baseline goes out of the row's boundries then adjust row height accordingly.
 void RenderTableSection::updateBaselineForCell(RenderTableCell* cell, unsigned row, LayoutUnit& baselineDescent)
 {
     if (!cell->isBaselineAligned())
@@ skipping 1201 matching lines @@
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
     view()->addLayoutDelta(oldCellLocation - cell->location());
 }
 
 } // namespace WebCore