[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 16 matching lines @@
 #include "core/CSSPropertyNames.h"
 #include "core/CSSValueKeywords.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/html/HTMLTableElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/layout/LayoutTableCell.h"
 
 using namespace std;
-using namespace std;
 
 namespace blink {
 
-// Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
-// least 2^17.
-// Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to 1.
-// TODO(dgrogan): Determine Edge's colspan limit.
-static const unsigned maxColSpan = 8190;
-static const unsigned maxRowSpan = 65534;
-
 using namespace HTMLNames;
 
 inline HTMLTableCellElement::HTMLTableCellElement(const QualifiedName& tagName,
                                                   Document& document)
     : HTMLTablePartElement(tagName, document) {}
 
 DEFINE_ELEMENT_FACTORY_WITH_TAGNAME(HTMLTableCellElement)
 
 unsigned HTMLTableCellElement::colSpan() const {
   const AtomicString& colSpanValue = fastGetAttribute(colspanAttr);
   unsigned value = 0;
   if (colSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(colSpanValue, value))
     return 1;
-  return max(1u, min(value, maxColSpan));
+  return max(1u, min(value, static_cast<unsigned>(kMaxColSpan)));

[mstensho (USE GERRIT), 2016/11/22 07:04:29]

Could perhaps add static unsigned HTMLTableCellElement::maxColSpan() and
maxRowSpan() getters (that just return kMaxFoo, or maybe just remove the new
enum and return hard-coded values - not sure what's nicer), to get rid of this
cast here?

[dgrogan, 2016/12/01 21:51:44]

Good idea, I went with returning hard-coded values.

 }
 
 unsigned HTMLTableCellElement::rowSpan() const {
   const AtomicString& rowSpanValue = fastGetAttribute(rowspanAttr);
   unsigned value = 0;
   if (rowSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(rowSpanValue, value))
     return 1;
-  return max(1u, min(value, maxRowSpan));
+  return max(1u, min(value, static_cast<unsigned>(kMaxRowSpan)));
 }
 
 int HTMLTableCellElement::cellIndex() const {
   if (!isHTMLTableRowElement(parentElement()))
     return -1;
 
   int index = 0;
   for (const HTMLTableCellElement* element =
            Traversal<HTMLTableCellElement>::previousSibling(*this);
        element;
@@ skipping 31 matching lines @@
     }
   } else {
     HTMLTablePartElement::collectStyleForPresentationAttribute(name, value,
                                                                style);
   }
 }
 
 void HTMLTableCellElement::parseAttribute(const QualifiedName& name,
                                           const AtomicString& oldValue,
                                           const AtomicString& value) {
-  if (name == rowspanAttr) {
-    if (layoutObject() && layoutObject()->isTableCell())
-      toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
-  } else if (name == colspanAttr) {
+  if (name == rowspanAttr || name == colspanAttr) {

[dgrogan, 2016/11/22 00:35:31]

No behavior change, just code simplification while I'm here.

[mstensho (USE GERRIT), 2016/11/22 07:04:29]

Nice! Less for everyone to read and process. :)

     if (layoutObject() && layoutObject()->isTableCell())
       toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
   } else {
     HTMLTablePartElement::parseAttribute(name, oldValue, value);
   }
 }
 
 const StylePropertySet*
 HTMLTableCellElement::additionalPresentationAttributeStyle() {
   if (HTMLTableElement* table = findParentTable())
@@ skipping 31 matching lines @@
 
 const AtomicString& HTMLTableCellElement::headers() const {
   return fastGetAttribute(headersAttr);
 }
 
 void HTMLTableCellElement::setRowSpan(unsigned n) {
   setUnsignedIntegralAttribute(rowspanAttr, n);
 }
 
 }  // namespace blink