LayoutTests:

LayoutTests:

        Reviewed by Maciej.

        - another large rowspan test case

        * fast/table/large-rowspan-crash-expected.txt: Added.
        * fast/table/large-rowspan-crash.html: Added.

WebCore:

        Reviewed by Maciej.

        - fix http://bugzilla.opendarwin.org/show_bug.cgi?id=9806
          <rdar://problem/4622622>
          REGRESSION: Large rowspan causes WebKit to call abort()

        Test: fast/table/large-rowspan-crash.html

        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::ensureRows):
        Use sizeof(RowStruct) instead of sizeof(int).
        Clearly we'll need something better to solve this completely.
        I expect another smaller, but still huge, value will still cause a problem.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@15390 268f45cc-cd09-0410-ab3c-d52691b4dbfc