WebCore::RenderTableCell::setCol should put a cap on the column value.

WebCore::RenderTableCell::setCol should put a cap on the column value.
https://bugs.webkit.org/show_bug.cgi?id=155642
<rdar://problem/15895201>

Reviewed by Simon Fraser.

This patch ensures that we don't crash when the column number is large enough.
see webkit.org/b/71135 for more information.

Source/WebCore:

Test: tables/colspan-with-large-value-crash.html

* rendering/RenderTableCell.h:
(WebCore::RenderTableCell::setCol):

LayoutTests:

* tables/colspan-with-large-value-crash-expected.txt: Added.
* tables/colspan-with-large-value-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198506 268f45cc-cd09-0410-ab3c-d52691b4dbfc