commit 1a32ccc4759d47d48ddf8aab596d1b2178943406
Author: Andrea Iacovitti <aiacovitti@libero.it>
Date:   Sat Jul 23 10:52:57 2011 +0200

    Fix infinite loop that can happen in some cases where colspan=0 or rowspan=0
    because accessing empty structures. Tracking for not empty qmap by using
    additional flag is redundant and buggy in this case.
    BUG: 205348
    (cherry picked from commit 543c2751da42c1664171685e25fbce594024d9cd)

diff --git a/khtml/rendering/render_table.cpp b/khtml/rendering/render_table.cpp
index ac703ef..5b07714 100644
--- a/khtml/rendering/render_table.cpp
+++ b/khtml/rendering/render_table.cpp
@@ -1027,7 +1027,6 @@ FindSelectionResult RenderTable::checkSelectionPoint( int _x, int _y, int _tx, i
 
 RenderTableSection::RenderTableSection(DOM::NodeImpl* node)
     : RenderBox(node)
-    , containsSpansZero(false)
 {
     // init RenderObject attributes
     setInline(false);   // our object is not Inline
@@ -1170,7 +1169,7 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
 		if ( !cRowHeight.isPercent() ||
 		     (cRowHeight.isPercent() && cRowHeight.rawValue() < height.rawValue() ) )
 		    grid[cRow].height = height;
-		     break;
+		break;
 	    case Fixed:
 		if ( cRowHeight.type() < Percent ||
 		     ( cRowHeight.isFixed() && cRowHeight.value() < height.value() ) )
@@ -1213,7 +1212,7 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
 
     //check whether we need to update any of the cells with span = 0
     QList< int > columnsToAvoid;
-    if( containsSpansZero ) {
+    if( !cellsWithColSpanZero.isEmpty() ) {
         //Update any column which its last span update was in a previous column
         int lowestCol = cellsWithColSpanZero.lowerBound( 0 ).key();
         if( lowestCol < cCol ) {
@@ -1240,6 +1239,9 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
                 lowestCol = cellsWithColSpanZero.lowerBound( 0 ).key();
             }
         }
+    }
+
+    if( !cellsWithRowSpanZero.isEmpty() ) {
         if( cellsWithRowSpanZero.contains( cRow ) ) {
             //No need to check if we have enough columns, we already found the first cell 
             //when rowspan="0", and as such, we've already inserted it
@@ -1280,7 +1282,7 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
 
             const int finalSpan = colgroup->span() - alreadyUsedSpan;
             cell->setColSpan( finalSpan );
-            
+
             //We know exactly the cSpan so we can handle the cell as a normal cell
             //unless, of course, the rowspan is also 0
             cSpan = finalSpan;
@@ -1295,7 +1297,6 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
             cell->setColSpan( finalSpan );
 
             cellsWithColSpanZero.insertMulti( cCol + finalSpan - 1, cell );
-            containsSpansZero = true;
         }
     }
 
@@ -1306,7 +1307,6 @@ void RenderTableSection::addCell( RenderTableCell *cell, RenderTableRow *row )
 
         //mark it to be inserted in next row
         cellsWithRowSpanZero.insertMulti( cRow + 1, cell );
-        containsSpansZero = true;
     }
 
     while ( cSpan ) {
diff --git a/khtml/rendering/render_table.h b/khtml/rendering/render_table.h
index a5c1a0e..4048175 100644
--- a/khtml/rendering/render_table.h
+++ b/khtml/rendering/render_table.h
@@ -278,8 +278,6 @@ public:
     QMap< int, RenderTableCell* > cellsWithColSpanZero;
     //QMap< nextRowToInsert, cell >
     QMap< int, RenderTableCell* > cellsWithRowSpanZero;
-    //True if any of the cells has a span of 0
-    bool containsSpansZero;
 
     int cRow;
     int cCol;