[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.h

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 32 matching lines @@
   unsigned rowSpan() const;
 
   void setCellIndex(int);
 
   const AtomicString& abbr() const;
   const AtomicString& axis() const;
   void setColSpan(unsigned);
   const AtomicString& headers() const;
   void setRowSpan(unsigned);
 
+  // Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
+  // least 2^17.
+  // Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to
+  // 1.
+  // TODO(dgrogan): Change this to HTML's new specified behavior when
+  // https://github.com/whatwg/html/issues/1198 is resolved.
+  // C++ note: apparently we can't use static const int for these because they
+  // are passed to std::min, which takes const T& and you can't take a reference
+  // of a static variable initialized in the class declaration.
+  // Public so that HTMLColElement can use maxColSpan. maxRowSpan is only used
+  // by this class but keeping them together seems desirable.
+  enum { kMaxColSpan = 8190, kMaxRowSpan = 65534 };
+
  private:
   HTMLTableCellElement(const QualifiedName&, Document&);
 
   void parseAttribute(const QualifiedName&,
                       const AtomicString&,
                       const AtomicString&) override;
   bool isPresentationAttribute(const QualifiedName&) const override;
   void collectStyleForPresentationAttribute(const QualifiedName&,
                                             const AtomicString&,
                                             MutableStylePropertySet*) override;
   const StylePropertySet* additionalPresentationAttributeStyle() override;
 
   bool isURLAttribute(const Attribute&) const override;
   bool hasLegalLinkAttribute(const QualifiedName&) const override;
   const QualifiedName& subResourceAttributeName() const override;
 };
 
 inline bool isHTMLTableCellElement(const HTMLElement& element) {
   return element.hasTagName(HTMLNames::tdTag) ||
          element.hasTagName(HTMLNames::thTag);
 }
 
 DEFINE_HTMLELEMENT_TYPE_CASTS_WITH_FUNCTION(HTMLTableCellElement);
 
 }  // namespace blink
 
 #endif  // HTMLTableCellElement_h