[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp b/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
index c414195daca17161efb89a1043eb1be98da77a7e..148fdbab3445ff743a438f25fb661f33054a6f46 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
@@ -34,17 +34,9 @@
 #include "core/layout/LayoutTableCell.h"
 
 using namespace std;
-using namespace std;
 
 namespace blink {
 
-// Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
-// least 2^17.
-// Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to 1.
-// TODO(dgrogan): Determine Edge's colspan limit.
-static const unsigned maxColSpan = 8190;
-static const unsigned maxRowSpan = 65534;
-
 using namespace HTMLNames;
 
 inline HTMLTableCellElement::HTMLTableCellElement(const QualifiedName& tagName,
@@ -59,7 +51,7 @@ unsigned HTMLTableCellElement::colSpan() const {
   if (colSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(colSpanValue, value))
     return 1;
-  return max(1u, min(value, maxColSpan));
+  return max(1u, min(value, maxColSpan()));
 }
 
 unsigned HTMLTableCellElement::rowSpan() const {
@@ -68,7 +60,7 @@ unsigned HTMLTableCellElement::rowSpan() const {
   if (rowSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(rowSpanValue, value))
     return 1;
-  return max(1u, min(value, maxRowSpan));
+  return max(1u, min(value, maxRowSpan()));
 }
 
 int HTMLTableCellElement::cellIndex() const {
@@ -120,10 +112,7 @@ void HTMLTableCellElement::collectStyleForPresentationAttribute(
 void HTMLTableCellElement::parseAttribute(const QualifiedName& name,
                                           const AtomicString& oldValue,
                                           const AtomicString& value) {
-  if (name == rowspanAttr) {
-    if (layoutObject() && layoutObject()->isTableCell())
-      toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
-  } else if (name == colspanAttr) {
+  if (name == rowspanAttr || name == colspanAttr) {
     if (layoutObject() && layoutObject()->isTableCell())
       toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
   } else {