[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/html/HTMLTableColElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp b/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
index 0199445ee167c78468dc07bb4870e39af52865a2..0d22d1d222310b9ebb7bdf4b6c070a07320dd26c 100644
--- a/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTableColElement.cpp
@@ -26,9 +26,11 @@
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
+#include "core/html/HTMLTableCellElement.h"
 #include "core/html/HTMLTableElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/layout/LayoutTableCol.h"
+#include <algorithm>
 
 namespace blink {
 
@@ -69,6 +71,8 @@ void HTMLTableColElement::parseAttribute(const QualifiedName& name,
       // zero, set it to 1.
       newSpan = 1;
     }
+    newSpan = std::min(

[dgrogan, 2016/11/22 00:35:31]

The real behavior change.

+        newSpan, static_cast<unsigned>(HTMLTableCellElement::kMaxColSpan));
     m_span = newSpan;
     if (layoutObject() && layoutObject()->isLayoutTableCol())
       layoutObject()->updateFromElement();