WebCore::RenderTableCell::setCol should put a cap on the column value.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 21 Mar 2016 23:29:58 +0000 (23:29 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 21 Mar 2016 23:29:58 +0000 (23:29 +0000)
commit3f027e7a8f6f3d4bbcfa54eb8144b8443d9c31b8
treee5c4a10a7aa504017fafbd199710fa7c1e0de8bd
parentd137dd4b98206342282436aafd06b3a36020d096
WebCore::RenderTableCell::setCol should put a cap on the column value.
https://bugs.webkit.org/show_bug.cgi?id=155642
<rdar://problem/15895201>

Reviewed by Simon Fraser.

This patch ensures that we don't crash when the column number is large enough.
see webkit.org/b/71135 for more information.

Source/WebCore:

Test: tables/colspan-with-large-value-crash.html

* rendering/RenderTableCell.h:
(WebCore::RenderTableCell::setCol):

LayoutTests:

* tables/colspan-with-large-value-crash-expected.txt: Added.
* tables/colspan-with-large-value-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198506 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/tables/colspan-with-large-value-crash-expected.txt [new file with mode: 0644]
LayoutTests/tables/colspan-with-large-value-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderTableCell.h