[css-tables] Fix divide-by-zero resulting from 32-bit overflow

third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp

Index: third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
diff --git a/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp b/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
index 1399d70e12b0c7ac9f3148814a95ac16edf7c697..064ddc8644d82b649f6809ef418cd180185cd265 100644
--- a/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
+++ b/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
@@ -296,7 +296,7 @@ void TableLayoutAlgorithmFixed::layout() {
     }
   } else {
     // Divide the remaining width among the auto columns.
-    ASSERT(autoSpan >= numAuto);
+    DCHECK_GE(autoSpan, numAuto);

[dgrogan, 2016/11/22 00:35:31]

The reproduction triggered this because autoSpan was 0 and numAuto was 2.

     int remainingWidth = tableLogicalWidth - totalFixedWidth -
                          totalPercentWidth - hspacing * (autoSpan - numAuto);
     int lastAuto = 0;
@@ -310,7 +310,7 @@ void TableLayoutAlgorithmFixed::layout() {
           break;
         lastAuto = i;
         numAuto--;
-        ASSERT(autoSpan >= span);
+        DCHECK_GE(autoSpan, span);
         autoSpan -= span;
       }
     }