ASSERTION FAILED: span >= 1 in WebCore::RenderTable::slowColElement

Set the value of span to 1 if the given number is too big or zero.
Merged from WebKit (patch by Zsolt Borbely).
https://bugs.webkit.org/show_bug.cgi?id=129148

R=
BUG=351280

Review URL: https://codereview.chromium.org/194593005

git-svn-id: svn://svn.chromium.org/blink/trunk@169692 bbb929c8-8fbe-4397-9dbb-9b2b20218538