[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp

 /*
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2013 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License.
  *
@@ skipping 278 matching lines @@
             calcWidth[i] = m_width[i].percent() *
                            (tableLogicalWidth - totalFixedWidth) / totalPercent;
             totalPercentWidth += calcWidth[i];
           }
         }
       }
       totalWidth = totalFixedWidth + totalPercentWidth;
     }
   } else {
     // Divide the remaining width among the auto columns.
-    ASSERT(autoSpan >= numAuto);
+    DCHECK_GE(autoSpan, numAuto);

[dgrogan, 2016/11/22 00:35:31]

The reproduction triggered this because autoSpan was 0 and numAuto was 2.

     int remainingWidth = tableLogicalWidth - totalFixedWidth -
                          totalPercentWidth - hspacing * (autoSpan - numAuto);
     int lastAuto = 0;
     for (unsigned i = 0; i < nEffCols; i++) {
       if (m_width[i].isAuto()) {
         unsigned span = m_table->spanOfEffectiveColumn(i);
         int w = remainingWidth * span / autoSpan;

[dgrogan, 2016/11/22 00:35:31]

This is where the /0 happened.

         calcWidth[i] = w + hspacing * (span - 1);
         remainingWidth -= w;
         if (!remainingWidth)
           break;
         lastAuto = i;
         numAuto--;
-        ASSERT(autoSpan >= span);
+        DCHECK_GE(autoSpan, span);
         autoSpan -= span;
       }
     }
     // Last one gets the remainder.
     if (remainingWidth)
       calcWidth[lastAuto] += remainingWidth;
     totalWidth = tableLogicalWidth;
   }
 
   if (totalWidth < tableLogicalWidth) {
@@ skipping 22 matching lines @@
 void TableLayoutAlgorithmFixed::willChangeTableLayout() {
   // When switching table layout algorithm, we need to dirty the preferred
   // logical widths as we cleared the bits without computing them.
   // (see calcWidthArray above.) This optimization is preferred to always
   // computing the logical widths we never intended to use.
   m_table->recalcSectionsIfNeeded();
   m_table->markAllCellsWidthsDirtyAndOrNeedsLayout(LayoutTable::MarkDirtyOnly);
 }
 
 }  // namespace blink