Crash when opening web page http://build.webkit.org/waterfall.

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index d55550b194e2a47ede55dfeadeb3dbd0a2b987b9..339d9a0760adc0ec0766b1ebb8b43d083c87cc21 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -382,8 +382,12 @@ static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell*
 
     if (cellRowIndex1 == cellRowIndex2 && cellRowSpan1 == cellRowSpan2)
         return (cell2->logicalHeightForRowSizing() > cell1->logicalHeightForRowSizing());
+    else if (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1))

[Julien - ping for review, 2013/08/22 21:48:08]

The else is not mandated as you return all the time.

I would advocate towards commenting this code (with why comments) as it is
getting really hairy.

[suchit.agrawal, 2013/08/23 13:37:26]

Done.

+        return true;
+    else if (!(cellRowIndex1 >= cellRowIndex2 && (cellRowIndex1 + cellRowSpan1) <= (cellRowIndex2 + cellRowSpan2)))
+        return (cellRowIndex2 < cellRowIndex1);
 
-    return (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));
+    return false;

[a.suchit, 2013/08/22 10:26:17]

I think now it is strict equality. We are sorting the cells based on their row
indexes but if 2 cells are same size then more height cell will come first and
if one cell inside another cell then inner cell will come first.

[Julien - ping for review, 2013/08/22 21:48:08]

I don't have your confidence and based on the fact that we got it wrong once
already, I am betting that there are other bugs lying in the code.

[suchit.agrawal, 2013/08/23 13:37:26]

Sorry but last time, I don't have whole idea about std::sort(), how does it work
so I did mistake.

 }
 
 // Distribute rowSpan cell height in rows those comes in rowSpan cell based on the ratio of row's height if