Crash when opening web page http://build.webkit.org/waterfall.

Source/core/rendering/RenderTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 365 matching lines @@
 static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell* cell2, const RenderTableCell* cell1)
 {
     unsigned cellRowIndex1 = cell1->rowIndex();
     unsigned cellRowSpan1 = cell1->rowSpan();
     unsigned cellRowIndex2 = cell2->rowIndex();
     unsigned cellRowSpan2 = cell2->rowSpan();
 
     if (cellRowIndex1 == cellRowIndex2 && cellRowSpan1 == cellRowSpan2)
         return (cell2->logicalHeightForRowSizing() > cell1->logicalHeightForRowSizing());
 
-    return (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));
+    bool ret = (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));

[Julien - ping for review, 2013/08/21 19:27:02]

If ret is true, you will return true (because !ret is false) so why don't you
just early return here?

Note that I am still concerned that this is just peppering over the issues: as
pointed out in a previous review, you are using non-strict inequality, which
makes it hard to see whether your function is really a weak ordering.

[a.suchit, 2013/08/22 10:26:17]

Done.

+
+    if (!ret && !(cellRowIndex1 >= cellRowIndex2 && (cellRowIndex1 + cellRowSpan1) <= (cellRowIndex2 + cellRowSpan2)))
+        return (cellRowIndex2 < cellRowIndex1);
+
+    return ret;

[Julien - ping for review, 2013/08/21 19:27:02]

|ret| is not a great name for a variable really.

[a.suchit, 2013/08/22 10:26:17]

Done.

 }
 
 // Distribute rowSpan cell height in rows those comes in rowSpan cell based on the ratio of row's height if
 // 1. RowSpan cell height is greater then the total height of rows in rowSpan cell
 void RenderTableSection::distributeRowSpanHeightToRows(SpanningRenderTableCells& rowSpanCells)
 {
     ASSERT(rowSpanCells.size());
 
     // 'rowSpanCells' list is already sorted based on the cells rowIndex in ascending order
     // Arrange row spanning cell in the order in which we need to process first.
@@ skipping 1287 matching lines @@
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
     view()->addLayoutDelta(oldCellLocation - cell->location());
 }
 
 } // namespace WebCore