Crash when opening web page http://build.webkit.org/waterfall.

Source/core/rendering/RenderTableSection.cpp

Index: Source/core/rendering/RenderTableSection.cpp
diff --git a/Source/core/rendering/RenderTableSection.cpp b/Source/core/rendering/RenderTableSection.cpp
index d55550b194e2a47ede55dfeadeb3dbd0a2b987b9..d94648a728ef857eee24acb6b4195f8a3e57f143 100644
--- a/Source/core/rendering/RenderTableSection.cpp
+++ b/Source/core/rendering/RenderTableSection.cpp
@@ -373,17 +373,28 @@ void RenderTableSection::distributeExtraRowSpanHeightToRemainingRows(RenderTable
 // To avoid unneeded extra height distributions, we apply the following sorting algorithm:
 // 1. We sort by increasing start row but decreasing last row (ie the top-most, shortest cells first).
 // 2. For cells spanning the same rows, we sort by intrinsic size.
-static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell* cell2, const RenderTableCell* cell1)
+static bool compareRowSpanCellsInHeightDistributionOrder(const RenderTableCell* secondCell, const RenderTableCell* firstCell)

[Julien - ping for review, 2013/08/23 22:00:47]

The arguments are still backwards :-/

I was fine with the old naming, just that the arguments' order is arg2, arg1
which is the opposite of what every programmer would assume.

[a.suchit, 2013/09/04 13:21:48]

Done.

 {
-    unsigned cellRowIndex1 = cell1->rowIndex();
-    unsigned cellRowSpan1 = cell1->rowSpan();
-    unsigned cellRowIndex2 = cell2->rowIndex();
-    unsigned cellRowSpan2 = cell2->rowSpan();
+    unsigned firstCellRowIndex = firstCell->rowIndex();
+    unsigned firstCellRowSpan = firstCell->rowSpan();
+    unsigned secondCellRowIndex = secondCell->rowIndex();
+    unsigned secondCellRowSpan = secondCell->rowSpan();
+
+    // Sorting bigger height cell first if cells are at same index with same span because we will skip smaller
+    // height cell to distribute it's extra height.
+    if (firstCellRowIndex == secondCellRowIndex && firstCellRowSpan == secondCellRowSpan)
+        return (secondCell->logicalHeightForRowSizing() > firstCell->logicalHeightForRowSizing());
+    // Sorting inner most cell first because if inner spanning cell'e extra height is distributed then outer
+    // spanning cell's extra height will adjust accordingly. In reverse order, there is more chances that outer
+    // spanning cell's height will exceed than defined by user.
+    if (secondCellRowIndex >= firstCellRowIndex && (secondCellRowIndex + secondCellRowSpan) <= (firstCellRowIndex + firstCellRowSpan))
+        return true;
+    // Sorting lower row index first because first we need to apply the extra height of spanning cell which
+    // comes first in the table so lower rows's position would increment in sequence.
+    if (!(firstCellRowIndex >= secondCellRowIndex && (firstCellRowIndex + firstCellRowSpan) <= (secondCellRowIndex + secondCellRowSpan)))
+        return (secondCellRowIndex < firstCellRowIndex);
 
-    if (cellRowIndex1 == cellRowIndex2 && cellRowSpan1 == cellRowSpan2)
-        return (cell2->logicalHeightForRowSizing() > cell1->logicalHeightForRowSizing());
-
-    return (cellRowIndex2 >= cellRowIndex1 && (cellRowIndex2 + cellRowSpan2) <= (cellRowIndex1 + cellRowSpan1));
+    return false;
 }
 
 // Distribute rowSpan cell height in rows those comes in rowSpan cell based on the ratio of row's height if