perf issues with rowspan="0" on huge complex tables

karlcow · karlcow · commit f63c817dae24 · 2026-02-05T12:21:22.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=291405 rdar://146056348 Reviewed by Alan Baradlay. The HTML specification states that rowspan="0" should span all remaining rows in the current table row group (tbody, thead, or tfoot). In a previous patch, we made WebKit returns maxRowspan (65,534) instead of calculating the actual number of remaining rows. This caused severe performance issues during table grid construction. When RenderTableSection::addCell() processes a cell with rowspan="0", it calls ensureRows(insertionRow + rowSpan) to allocate grid space. With rowSpan returning 65,534, this created massive grid structures even for simple tables with just 2-3 rows. Example: - A table with 3 rows and 1 cell with rowspan="0" - Expected: ensureRows(0 + 3) = 3 rows - Actual (before fix): ensureRows(0 + 65534) = 65,534 rows - Result: 65,534 iterations instead of 3 (~21,845x slower) In more dramatic scenarios, it would crash Safari with tables with ~1000+ cells with rowspan="0", it means millions of iterations. This patch implements a two-layer approach: 1. DOM Layer (HTMLTableCellElement::rowSpan()): Return 0 for rowspan="0" instead of maxRowspan (65,534) This kind of go back to what was done before. 2. Rendering Layer (RenderTableCell::rowSpan()): When rowSpan from DOM is 0, calculate actual remaining rows using the DOM structure via calculateRowSpanForRowspanZero() During grid construction (recalcCells()), the DOM structure is complete but the render tree is being built incrementally. We must count rows from the DOM, not the render tree. This fix makes WebKit spec-compliant and matches Chrome/Firefox behavior. * LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-1-expected.txt: * LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-2-expected.txt: * LayoutTests/platform/glib/tables/mozilla/bugs/bug9879-1-expected.txt: * LayoutTests/platform/glib/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt: * LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-1-expected.txt: * LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-2-expected.txt: * LayoutTests/platform/ios/tables/mozilla/bugs/bug9879-1-expected.txt: * LayoutTests/platform/ios/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt: * LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-1-expected.txt: * LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-2-expected.txt: * LayoutTests/platform/mac/tables/mozilla/bugs/bug9879-1-expected.txt: * LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt: * Source/WebCore/html/HTMLTableCellElement.cpp: (WebCore::HTMLTableCellElement::rowSpan const): Return 0 for rowspan="0" instead of maxRowspan (65,534). * Source/WebCore/rendering/RenderTableCell.cpp: (WebCore::RenderTableCell::calculateRowSpanForRowspanZero const): (WebCore::RenderTableCell::calculateRowSpanForRowspanZero const): Added. Navigate DOM structure to calculate actual remaining rows in the table section. Uses sectionElement->numRows() which is stable during grid construction, unlike render tree traversal. * Source/WebCore/rendering/RenderTableCell.h: (WebCore::RenderTableCell::rowSpan const): Add calculateRowSpanForRowspanZero() helper function declaration. Modify inline rowSpan() to call helper when DOM returns 0. Canonical link: https://commits.webkit.org/306891@main
diff --git a/LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-1-expected.txt b/LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-1-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x600
         RenderTable {TABLE} at (0,0) size 784x38 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x28
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 373x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 373x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x18
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x22
diff --git a/LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-2-expected.txt b/LayoutTests/platform/glib/tables/mozilla/bugs/bug30332-2-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x222
         RenderTable {TABLE} at (0,0) size 784x38 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x28
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 373x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 373x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x18
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x22
diff --git a/LayoutTests/platform/glib/tables/mozilla/bugs/bug9879-1-expected.txt b/LayoutTests/platform/glib/tables/mozilla/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x348
       RenderTable {TABLE} at (0,0) size 156x52 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 154x50
           RenderTableRow {TR} at (0,2) size 154x22
-            RenderTableCell {TD} at (2,14) size 70x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,14) size 70x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,14) size 66x18
                 text run at (2,2) width 66: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 64x22 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x348
             RenderTableCell {TD} at (2,2) size 31x22 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 27x18
                 text run at (2,2) width 27: "auto"
-            RenderTableCell {TD} at (35,14) size 70x22 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,14) size 70x22 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,14) size 66x18
                 text run at (2,2) width 66: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 31x22 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/LayoutTests/platform/glib/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt b/LayoutTests/platform/glib/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x348
       RenderTable {TABLE} at (0,0) size 156x52 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 154x50
           RenderTableRow {TR} at (0,2) size 154x22
-            RenderTableCell {TD} at (2,14) size 70x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,14) size 70x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,14) size 66x18
                 text run at (2,2) width 66: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 64x22 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x348
             RenderTableCell {TD} at (2,2) size 31x22 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 27x18
                 text run at (2,2) width 27: "auto"
-            RenderTableCell {TD} at (35,14) size 70x22 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,14) size 70x22 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,14) size 66x18
                 text run at (2,2) width 66: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 31x22 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-1-expected.txt b/LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-1-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x600
         RenderTable {TABLE} at (0,0) size 784x40 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x30
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 375x24 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 375x24 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x20
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x24
diff --git a/LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-2-expected.txt b/LayoutTests/platform/ios/tables/mozilla/bugs/bug30332-2-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x240
         RenderTable {TABLE} at (0,0) size 784x40 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x30
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 375x24 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 375x24 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x20
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x24
diff --git a/LayoutTests/platform/ios/tables/mozilla/bugs/bug9879-1-expected.txt b/LayoutTests/platform/ios/tables/mozilla/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x376
       RenderTable {TABLE} at (0,0) size 158x56 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 156x54
           RenderTableRow {TR} at (0,2) size 156x24
-            RenderTableCell {TD} at (2,15) size 71x24 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,15) size 71x24 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,15) size 67x20
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 66x24 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x376
             RenderTableCell {TD} at (2,2) size 32x24 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 28x20
                 text run at (2,2) width 28: "auto"
-            RenderTableCell {TD} at (35,15) size 71x24 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,15) size 71x24 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,15) size 67x20
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 33x24 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/LayoutTests/platform/ios/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt b/LayoutTests/platform/ios/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x376
       RenderTable {TABLE} at (0,0) size 158x56 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 156x54
           RenderTableRow {TR} at (0,2) size 156x24
-            RenderTableCell {TD} at (2,15) size 71x24 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,15) size 71x24 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,15) size 67x20
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 66x24 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x376
             RenderTableCell {TD} at (2,2) size 32x24 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 28x20
                 text run at (2,2) width 28: "auto"
-            RenderTableCell {TD} at (35,15) size 71x24 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,15) size 71x24 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,15) size 67x20
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 33x24 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-1-expected.txt b/LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-1-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x600
         RenderTable {TABLE} at (0,0) size 784x38 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x28
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 375x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 375x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x18
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x22
diff --git a/LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-2-expected.txt b/LayoutTests/platform/mac/tables/mozilla/bugs/bug30332-2-expected.txt
@@ -12,7 +12,7 @@ layer at (0,0) size 800x222
         RenderTable {TABLE} at (0,0) size 784x38 [border: (5px outset #000000)]
           RenderTableSection {TBODY} at (5,5) size 774x28
             RenderTableRow {TR} at (0,2) size 774x0
-              RenderTableCell {TD} at (2,3) size 375x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+              RenderTableCell {TD} at (2,3) size 375x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
                 RenderText {#text} at (2,3) size 27x18
                   text run at (2,2) width 27: "One"
             RenderTableRow {TR} at (0,4) size 774x22
diff --git a/LayoutTests/platform/mac/tables/mozilla/bugs/bug9879-1-expected.txt b/LayoutTests/platform/mac/tables/mozilla/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x348
       RenderTable {TABLE} at (0,0) size 158x52 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 156x50
           RenderTableRow {TR} at (0,2) size 156x22
-            RenderTableCell {TD} at (2,14) size 71x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,14) size 71x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,14) size 67x18
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 66x22 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x348
             RenderTableCell {TD} at (2,2) size 32x22 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 28x18
                 text run at (2,2) width 28: "auto"
-            RenderTableCell {TD} at (35,14) size 71x22 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,14) size 71x22 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,14) size 67x18
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 33x22 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt b/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug9879-1-expected.txt
@@ -6,7 +6,7 @@ layer at (0,0) size 800x348
       RenderTable {TABLE} at (0,0) size 158x52 [border: (1px outset #000000)]
         RenderTableSection {TBODY} at (1,1) size 156x50
           RenderTableRow {TR} at (0,2) size 156x22
-            RenderTableCell {TD} at (2,14) size 71x22 [border: (1px inset #000000)] [r=0 c=0 rs=65534 cs=1]
+            RenderTableCell {TD} at (2,14) size 71x22 [border: (1px inset #000000)] [r=0 c=0 rs=2 cs=1]
               RenderText {#text} at (2,14) size 67x18
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (74,2) size 66x22 [border: (1px inset #000000)] [r=0 c=1 rs=1 cs=1]
@@ -81,7 +81,7 @@ layer at (0,0) size 800x348
             RenderTableCell {TD} at (2,2) size 32x22 [border: (1px inset #000000)] [r=0 c=0 rs=1 cs=1]
               RenderText {#text} at (2,2) size 28x18
                 text run at (2,2) width 28: "auto"
-            RenderTableCell {TD} at (35,14) size 71x22 [border: (1px inset #000000)] [r=0 c=1 rs=65534 cs=1]
+            RenderTableCell {TD} at (35,14) size 71x22 [border: (1px inset #000000)] [r=0 c=1 rs=2 cs=1]
               RenderText {#text} at (2,14) size 67x18
                 text run at (2,2) width 67: "rowspan 0"
             RenderTableCell {TD} at (107,2) size 33x22 [border: (1px inset #000000)] [r=0 c=2 rs=1 cs=1]
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -62,14 +62,10 @@ unsigned HTMLTableCellElement::colSpan() const
 
 unsigned HTMLTableCellElement::rowSpan() const
 {
-    unsigned rowSpanValue = rowSpanForBindings();
-    // when rowspan=0, the HTML spec says it should apply to the full remaining rows.
-    // In https://html.spec.whatwg.org/multipage/tables.html#attr-tdth-rowspan
-    // > For this attribute, the value zero means that the cell is
-    // > to span all the remaining rows in the row group.
-    if (!rowSpanValue)
-        return maxRowspan;
-    return std::max(1u, rowSpanValue);
+    // When rowspan="0", return 0 to signal "span all remaining rows"
+    // The rendering layer (RenderTableCell::rowSpan) will calculate the actual count
+    // Per HTML spec: https://html.spec.whatwg.org/multipage/tables.html#attr-tdth-rowspan
+    return rowSpanForBindings();
 }
 
 unsigned HTMLTableCellElement::rowSpanForBindings() const
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -35,6 +35,8 @@
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableRowElement.h"
+#include "HTMLTableSectionElement.h"
 #include "LayoutScope.h"
 #include "PaintInfo.h"
 #include "RenderBoxInlines.h"
@@ -150,6 +152,28 @@ unsigned RenderTableCell::parseRowSpanFromDOM() const
     return 1;
 }
 
+unsigned RenderTableCell::calculateRowSpanForRowspanZero() const
+{
+    // Handle rowspan="0" which means "span all remaining rows in the row group"
+    // Per HTML spec: https://html.spec.whatwg.org/multipage/tables.html#attr-tdth-rowspan
+    //
+    // We use the DOM to count total rows because during grid construction (recalcCells),
+    // the DOM structure is complete even though the grid is still being built.
+
+    if (CheckedPtr renderSection = this->section()) {
+        if (RefPtr sectionElement = dynamicDowncast<HTMLTableSectionElement>(renderSection->element())) {
+            unsigned totalRows = sectionElement->numRows();
+            unsigned currentRow = this->rowIndex();
+
+            if (currentRow < totalRows)
+                return totalRows - currentRow;
+        }
+    }
+
+    // Fallback: couldn't get section or DOM count
+    return 1;
+}
+
 void RenderTableCell::updateColAndRowSpanFlags()
 {
     // The vast majority of table cells do not have a colspan or rowspan,
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
@@ -24,6 +24,7 @@
 
 #pragma once
 
+#include "HTMLTableCellElement.h"
 #include "RenderBlockFlow.h"
 #include "RenderTableRow.h"
 #include "RenderTableSection.h"
@@ -203,6 +204,7 @@ class RenderTableCell final : public RenderBlockFlow {
 
     unsigned parseRowSpanFromDOM() const;
     unsigned parseColSpanFromDOM() const;
+    unsigned calculateRowSpanForRowspanZero() const;
 
     void nextSibling() const = delete;
     void previousSibling() const = delete;
@@ -245,7 +247,15 @@ inline unsigned RenderTableCell::rowSpan() const
 {
     if (!m_hasRowSpan)
         return 1;
-    return parseRowSpanFromDOM();
+
+    unsigned span = parseRowSpanFromDOM();
+
+    // Handle rowspan="0" which means "span all remaining rows in the row group"
+    // Per HTML spec: https://html.spec.whatwg.org/multipage/tables.html#attr-tdth-rowspan
+    if (!span)
+        span = calculateRowSpanForRowspanZero();
+
+    return std::min(span, maxRowIndex);
 }
 
 inline void RenderTableCell::setCol(unsigned column)
