Merge 120257 - Padding and borders can cause integer overflow in block layouts

Source/WebCore/rendering/FixedTableLayout.cpp

 /*
  * Copyright (C) 2002 Lars Knoll (knoll@kde.org)
  *           (C) 2002 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License.
  *
@@ skipping 164 matching lines @@
                 usedWidth += fixedBorderBoxLogicalWidth * eSpan / span;
             }
             usedSpan += eSpan;
             ++currentColumn;
         }
     }
 
     return usedWidth;
 }
 
-// Use a very large value (in effect infinite). But not too large!
-// numeric_limits<int>::max() will too easily overflow widths.
-// Keep this in synch with BLOCK_MAX_WIDTH in RenderBlock.cpp
-#define TABLE_MAX_WIDTH 15000
-
 void FixedTableLayout::computePreferredLogicalWidths(LayoutUnit& minWidth, LayoutUnit& maxWidth)
 {
     // FIXME: This entire calculation is incorrect for both minwidth and maxwidth.
     
     // we might want to wait until we have all of the first row before
     // layouting for the first time.
 
     // only need to calculate the minimum width as the sum of the
     // cols/cells with a fixed width.
     //
@@ skipping 13 matching lines @@
             <table style="background-color:blue"><tr><td>
                 <table style="width:100%; background-color:green; table-layout:fixed"><tr><td>
                     Content
                 </td></tr></table>
             </td></tr></table>
         </td></tr></table>
     */ 
     // In this example, the two inner tables should be as large as the outer table. 
     // We can achieve this effect by making the maxwidth of fixed tables with percentage
     // widths be infinite.
-    if (m_table->document()->inQuirksMode() && m_table->style()->logicalWidth().isPercent() && maxWidth < TABLE_MAX_WIDTH)
-        maxWidth = TABLE_MAX_WIDTH;
+    if (m_table->document()->inQuirksMode() && m_table->style()->logicalWidth().isPercent() && maxWidth < tableMaxWidth)
+        maxWidth = tableMaxWidth;
 }
 
 void FixedTableLayout::layout()
 {
     int tableLogicalWidth = m_table->logicalWidth() - m_table->bordersPaddingAndSpacingInRowDirection();
     unsigned nEffCols = m_table->numEffCols();
     Vector<int> calcWidth(nEffCols, 0);
 
     unsigned numAuto = 0;
     unsigned autoSpan = 0;
@@ skipping 88 matching lines @@
     for (unsigned i = 0; i < nEffCols; i++) {
         m_table->columnPositions()[i] = pos;
         pos += calcWidth[i] + hspacing;
     }
     int colPositionsSize = m_table->columnPositions().size();
     if (colPositionsSize > 0)
         m_table->columnPositions()[colPositionsSize - 1] = pos;
 }
 
 } // namespace WebCore