Merge 120257 - Padding and borders can cause integer overflow in block layouts

Source/WebCore/rendering/AutoTableLayout.cpp

 /*
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2006, 2008, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License.
  *
@@ skipping 233 matching lines @@
                 float logicalWidth = static_cast<float>(m_layoutStruct[i].effectiveMaxLogicalWidth) * 100 / max(percent, epsilon);
                 maxPercent = max(logicalWidth,  maxPercent);
                 remainingPercent -= percent;
             } else
                 maxNonPercent += m_layoutStruct[i].effectiveMaxLogicalWidth;
         }
     }
 
     if (scaleColumns) {
         maxNonPercent = maxNonPercent * 100 / max(remainingPercent, epsilon);
-        maxWidth = max<int>(maxWidth, static_cast<int>(min(maxNonPercent, MAX_LAYOUT_UNIT / 2.0f)));
-        maxWidth = max<int>(maxWidth, static_cast<int>(min(maxPercent, MAX_LAYOUT_UNIT / 2.0f)));
+        maxWidth = max<int>(maxWidth, static_cast<int>(min(maxNonPercent, static_cast<float>(tableMaxWidth))));
+        maxWidth = max<int>(maxWidth, static_cast<int>(min(maxPercent, static_cast<float>(tableMaxWidth))));
     }
 
     maxWidth = max<int>(maxWidth, spanMaxLogicalWidth);
 
     int bordersPaddingAndSpacing = m_table->bordersPaddingAndSpacingInRowDirection();
     minWidth += bordersPaddingAndSpacing;
     maxWidth += bordersPaddingAndSpacing;
 
     Length tableLogicalWidth = m_table->style()->logicalWidth();
     if (tableLogicalWidth.isFixed() && tableLogicalWidth.isPositive()) {
         minWidth = max<int>(minWidth, tableLogicalWidth.value());
         maxWidth = minWidth;
     } else if (!remainingPercent && maxNonPercent) {
         // if there was no remaining percent, maxWidth is invalid
-        maxWidth = MAX_LAYOUT_UNIT;
+        maxWidth = tableMaxWidth;
     }
 
     Length tableLogicalMinWidth = m_table->style()->logicalMinWidth();
     if (tableLogicalMinWidth.isFixed() && tableLogicalMinWidth.isPositive()) {
         minWidth = max<int>(minWidth, tableLogicalMinWidth.value());
         maxWidth = max<int>(minWidth, maxWidth);
     }
 }
 
 /*
@@ skipping 493 matching lines @@
 
     int pos = 0;
     for (size_t i = 0; i < nEffCols; ++i) {
         m_table->columnPositions()[i] = pos;
         pos += m_layoutStruct[i].computedLogicalWidth + m_table->hBorderSpacing();
     }
     m_table->columnPositions()[m_table->columnPositions().size() - 1] = pos;
 }
 
 }