[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableColElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp b/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
index 0199445ee167c78468dc07bb4870e39af52865a2..24c079ef2d52b0f8a37e51dcd5e7a07e7a479ffd 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
@@ -26,9 +26,11 @@
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
+#include "core/html/HTMLTableCellElement.h"
 #include "core/html/HTMLTableElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/layout/LayoutTableCol.h"
+#include <algorithm>
 
 namespace blink {
 
@@ -69,6 +71,7 @@ void HTMLTableColElement::parseAttribute(const QualifiedName& name,
       // zero, set it to 1.
       newSpan = 1;
     }
+    newSpan = std::min(newSpan, HTMLTableCellElement::maxColSpan());
     m_span = newSpan;
     if (layoutObject() && layoutObject()->isLayoutTableCol())
       layoutObject()->updateFromElement();