[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp b/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
index c414195daca17161efb89a1043eb1be98da77a7e..a1c1003fb61d16fa1a8880cf25e33a016d330856 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTableCellElement.cpp
@@ -34,17 +34,9 @@
 #include "core/layout/LayoutTableCell.h"
 
 using namespace std;
-using namespace std;
 
 namespace blink {
 
-// Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
-// least 2^17.
-// Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to 1.
-// TODO(dgrogan): Determine Edge's colspan limit.
-static const unsigned maxColSpan = 8190;
-static const unsigned maxRowSpan = 65534;
-
 using namespace HTMLNames;
 
 inline HTMLTableCellElement::HTMLTableCellElement(const QualifiedName& tagName,
@@ -59,7 +51,7 @@ unsigned HTMLTableCellElement::colSpan() const {
   if (colSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(colSpanValue, value))
     return 1;
-  return max(1u, min(value, maxColSpan));
+  return max(1u, min(value, static_cast<unsigned>(kMaxColSpan)));

[mstensho (USE GERRIT), 2016/11/22 07:04:29]

Could perhaps add static unsigned HTMLTableCellElement::maxColSpan() and
maxRowSpan() getters (that just return kMaxFoo, or maybe just remove the new
enum and return hard-coded values - not sure what's nicer), to get rid of this
cast here?

[dgrogan, 2016/12/01 21:51:44]

Good idea, I went with returning hard-coded values.

 }
 
 unsigned HTMLTableCellElement::rowSpan() const {
@@ -68,7 +60,7 @@ unsigned HTMLTableCellElement::rowSpan() const {
   if (rowSpanValue.isEmpty() ||
       !parseHTMLNonNegativeInteger(rowSpanValue, value))
     return 1;
-  return max(1u, min(value, maxRowSpan));
+  return max(1u, min(value, static_cast<unsigned>(kMaxRowSpan)));
 }
 
 int HTMLTableCellElement::cellIndex() const {
@@ -120,10 +112,7 @@ void HTMLTableCellElement::collectStyleForPresentationAttribute(
 void HTMLTableCellElement::parseAttribute(const QualifiedName& name,
                                           const AtomicString& oldValue,
                                           const AtomicString& value) {
-  if (name == rowspanAttr) {
-    if (layoutObject() && layoutObject()->isTableCell())
-      toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
-  } else if (name == colspanAttr) {
+  if (name == rowspanAttr || name == colspanAttr) {

[dgrogan, 2016/11/22 00:35:31]

No behavior change, just code simplification while I'm here.

[mstensho (USE GERRIT), 2016/11/22 07:04:29]

Nice! Less for everyone to read and process. :)

     if (layoutObject() && layoutObject()->isTableCell())
       toLayoutTableCell(layoutObject())->colSpanOrRowSpanChanged();
   } else {