[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.h

Index: third_party/WebKit/Source/core/html/HTMLTableCellElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLTableCellElement.h b/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
index 35564bd8951b2c7f7e2ba962d5f57574eef6ae3d..b5a91c97e5ab77ca19a90695936e6ec68464d402 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
@@ -50,6 +50,17 @@ class CORE_EXPORT HTMLTableCellElement final : public HTMLTablePartElement {
   const AtomicString& headers() const;
   void setRowSpan(unsigned);
 
+  // Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
+  // least 2^17.
+  // Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to
+  // 1.
+  // TODO(dgrogan): Change these to HTML's new specified behavior when
+  // https://github.com/whatwg/html/issues/1198 is resolved.
+  // Public so that HTMLColElement can use maxColSpan. maxRowSpan is only used
+  // by this class but keeping them together seems desirable.
+  static unsigned maxColSpan() { return 8190u; }
+  static unsigned maxRowSpan() { return 65534u; }
+
  private:
   HTMLTableCellElement(const QualifiedName&, Document&);