Stricter parsing for rowSpan/ColSpan on th/td element

Source/core/html/HTMLTableCellElement.cpp

Index: Source/core/html/HTMLTableCellElement.cpp
diff --git a/Source/core/html/HTMLTableCellElement.cpp b/Source/core/html/HTMLTableCellElement.cpp
index b7cb97d10fbdd9b8e867246941a1c00fe2c15f7a..cbcd04bfcbbf9918bb9207c3cc5d72758cbac964 100644
--- a/Source/core/html/HTMLTableCellElement.cpp
+++ b/Source/core/html/HTMLTableCellElement.cpp
@@ -31,6 +31,7 @@
 #include "core/dom/Attribute.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/html/HTMLTableElement.h"
+#include "core/html/parser/HTMLParserIdioms.h"
 #include "core/rendering/RenderTableCell.h"
 
 using std::max;
@@ -57,13 +58,19 @@ DEFINE_ELEMENT_FACTORY_WITH_TAGNAME(HTMLTableCellElement)
 int HTMLTableCellElement::colSpan() const
 {
     const AtomicString& colSpanValue = fastGetAttribute(colspanAttr);
-    return max(1, min(colSpanValue.toInt(), maxColRowSpan));
+    int value = 0;
+    if (colSpanValue.isEmpty() || !parseHTMLInteger(colSpanValue, value))
+        return 1;
+    return max(1, min(value, maxColRowSpan));
 }
 
 int HTMLTableCellElement::rowSpan() const
 {
     const AtomicString& rowSpanValue = fastGetAttribute(rowspanAttr);
-    return max(1, min(rowSpanValue.toInt(), maxColRowSpan));
+    int value = 0;
+    if (rowSpanValue.isEmpty() || !parseHTMLInteger(rowSpanValue, value))
+        return 1;
+    return max(1, min(value, maxColRowSpan));
 }
 
 int HTMLTableCellElement::cellIndex() const