[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/layout/LayoutTableCell.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc.
  *               All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 104 matching lines @@
   }
   if (nextCell()) {
     // TODO(dgrogan): Same as above re: setChildNeedsLayout vs setNeedsLayout.
     nextCell()->setNeedsLayout(LayoutInvalidationReason::TableChanged);
     nextCell()->setPreferredLogicalWidthsDirty();
   }
 }
 
 unsigned LayoutTableCell::parseColSpanFromDOM() const {
   ASSERT(node());
+  // TODO(dgrogan): HTMLTableCellElement::colSpan() already clamps to something
+  // smaller than maxColumnIndex; can we just DCHECK here?
   if (isHTMLTableCellElement(*node()))
     return std::min<unsigned>(toHTMLTableCellElement(*node()).colSpan(),
                               maxColumnIndex);
   return 1;
 }
 
 unsigned LayoutTableCell::parseRowSpanFromDOM() const {
   ASSERT(node());
   if (isHTMLTableCellElement(*node()))
     return std::min<unsigned>(toHTMLTableCellElement(*node()).rowSpan(),
@@ skipping 1346 matching lines @@
     cb->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 void LayoutTableCell::adjustChildDebugRect(LayoutRect& r) const {
   r.move(0, -intrinsicPaddingBefore());
 }
 
 }  // namespace blink