Crash when opening web page http://build.webkit.org/waterfall.

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index d55550b194e2a47ede55dfeadeb3dbd0a2b987b9..6af52241b028a03208aaf7bbd08e3625244ae044 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -383,7 +383,12 @@ static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell*
     if (cellRowIndex1 == cellRowIndex2 && cellRowSpan1 == cellRowSpan2)
         return (cell2->logicalHeightForRowSizing() > cell1->logicalHeightForRowSizing());
 
-    return (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));
+    bool ret = (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));

[Julien - ping for review, 2013/08/21 19:27:02]

If ret is true, you will return true (because !ret is false) so why don't you
just early return here?

Note that I am still concerned that this is just peppering over the issues: as
pointed out in a previous review, you are using non-strict inequality, which
makes it hard to see whether your function is really a weak ordering.

[a.suchit, 2013/08/22 10:26:17]

Done.

+
+    if (!ret && !(cellRowIndex1 >= cellRowIndex2 && (cellRowIndex1 + cellRowSpan1) <= (cellRowIndex2 + cellRowSpan2)))
+        return (cellRowIndex2 < cellRowIndex1);
+
+    return ret;

[Julien - ping for review, 2013/08/21 19:27:02]

|ret| is not a great name for a variable really.

[a.suchit, 2013/08/22 10:26:17]

Done.

 }
 
 // Distribute rowSpan cell height in rows those comes in rowSpan cell based on the ratio of row's height if