[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableCellElement.h

Index: third_party/WebKit/Source/core/html/HTMLTableCellElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLTableCellElement.h b/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
index 35564bd8951b2c7f7e2ba962d5f57574eef6ae3d..c5e58e9696da7514a2bf5e2a78dbd3163e5a4fb5 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLTableCellElement.h
@@ -50,6 +50,19 @@ class CORE_EXPORT HTMLTableCellElement final : public HTMLTablePartElement {
   const AtomicString& headers() const;
   void setRowSpan(unsigned);
 
+  // Rowspan: match Firefox's limit of 65,534. Edge has a higher limit, at
+  // least 2^17.
+  // Colspan: Firefox uses a limit of 1,000 for colspan and resets the value to
+  // 1.
+  // TODO(dgrogan): Change this to HTML's new specified behavior when
+  // https://github.com/whatwg/html/issues/1198 is resolved.
+  // C++ note: apparently we can't use static const int for these because they
+  // are passed to std::min, which takes const T& and you can't take a reference
+  // of a static variable initialized in the class declaration.
+  // Public so that HTMLColElement can use maxColSpan. maxRowSpan is only used
+  // by this class but keeping them together seems desirable.
+  enum { kMaxColSpan = 8190, kMaxRowSpan = 65534 };
+
  private:
   HTMLTableCellElement(const QualifiedName&, Document&);