The span of a table-column or table-column-group should never be 0.
We used to set span to 0 if the element type wasn't COL/COLGROUP and computed
style had been set and display type was table-column-group. This seems to stem
from a merge from some LABYRINTH_KDE_3_MERGE branch back in March 2002. Not
sure if it made sense back then, but it certainly doesn't now.
BUG=493352
R=jchaffraix@chromium.org,leviw@chromium.org
Review URL: https://codereview.chromium.org/1146183005
git-svn-id: svn://svn.chromium.org/blink/trunk@196166 bbb929c8-8fbe-4397-9dbb-9b2b20218538
diff --git a/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group-expected.txt b/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group-expected.txt
new file mode 100644
index 0000000..d8b71875
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group-expected.txt
@@ -0,0 +1,3 @@
+Test that displaying an OUTPUT element as table-column-group doesn't crash.
+
+PASS if no crash or assertion failure.
diff --git a/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group.html b/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group.html
new file mode 100644
index 0000000..28c9e062
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/table/crash-output-element-as-column-group.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<p>Test that displaying an OUTPUT element as table-column-group doesn't crash.</p>
+<div style="display:table-cell;">PASS if no crash or assertion failure.</div>
+<output style="display:table-column-group;"></output>
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableCol.cpp b/third_party/WebKit/Source/core/layout/LayoutTableCol.cpp
index 37c07f4d..73cf46dd 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableCol.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableCol.cpp
@@ -78,7 +78,7 @@
HTMLTableColElement& tc = toHTMLTableColElement(*n);
m_span = tc.span();
} else {
- m_span = !(style() && style()->display() == TABLE_COLUMN_GROUP);
+ m_span = 1;
}
if (m_span != oldSpan && style() && parent())
setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(LayoutInvalidationReason::AttributeChanged);
