Crash when inner and outer spanning cells end indexes are same.

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index 7bd443359e355938b2044e683827cb9af469f036..282e7fa45ab0745dbbfa2c5ae61cf3c6524ae5f8 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -414,7 +414,7 @@ void RenderTableSection::distributeRowSpanHeightToRows(SpanningRenderTableCells&
         int originalBeforePosition = m_rowPos[rowIndex + rowSpan];
 
         if (extraHeightToPropagate) {
-            for (unsigned row = lastRowIndex + lastRowSpan + 1; row <= rowIndex + rowSpan; row++)
+            for (unsigned row = lastRowIndex + lastRowSpan; row <= rowIndex + rowSpan; row++)
                 m_rowPos[row] += extraHeightToPropagate;
         }
 
@@ -455,11 +455,12 @@ void RenderTableSection::distributeRowSpanHeightToRows(SpanningRenderTableCells&
 
         // Getting total changed height in the table
         extraHeightToPropagate = m_rowPos[rowIndex + rowSpan] - originalBeforePosition;
+        m_rowPos[rowIndex + rowSpan] -= extraHeightToPropagate;

[Julien - ping for review, 2013/08/05 22:21:10]

This line seems dumb: can't we just patch the distribute functions to not touch
the |rowIndex + rowSpan|'s row instead?

[suchit.agrawal, 2013/08/05 23:33:55]

|extraHeightToPropagate| is calculated based on the position changed of
|rowIndex + rowSpan|.
This is last row of the spanning cell. we does not know how much extra height
would be applicable for this row which would be calculated by only distributed
functions only.
And meaning of distributed functions would be changes if we escape one row in
all row to distribute height. Some ASSERTs also used there which will not allow
it.
Even here, we don't know that which distributed function given the new height to
this row.

Or we can do following :

int originalBeforePosition = m_rowPos[rowIndex + rowSpan]; above can be changed
based on condition 
if (rowIndex + rowSpan == lastRowIndex + lastRowSpan)
originalBeforePosition = m_rowPos[rowIndex + rowSpan] - extraHeightToPropagate;
else
originalBeforePosition = m_rowPos[rowIndex + rowSpan];

But this will not work in below case :
where A rowspan value is 3 or more and B rowspan value is 2.

+---+---+
|   |   |
|   +---+---+
| A |   |   |
|   | B +---+
|   |   |   |
+---+---+---+

So I think, we need to stick on it. If you have any suggestions please let me
know. I will try my best to change it. Thanks

     }
 
     if (extraHeightToPropagate) {
         // Apply changed height by rowSpan cells to rows present at the end of the table
-        for (unsigned row = lastRowIndex + lastRowSpan + 1; row <= m_grid.size(); row++)
+        for (unsigned row = lastRowIndex + lastRowSpan; row <= m_grid.size(); row++)
             m_rowPos[row] += extraHeightToPropagate;
     }
 }