"vertical split a cell" works error when the row contains "colpan>1" cells

[tengshengbo]

Follow this simple steps:

1. create a table with 3 rows, 3 columns.
2. merge the first two cells in the first row.
3. veritical split the last cell(the cell after the merged cell) in the first row.

The table structure becomes messy after the third step.
The bug is in "tabletools/plugin.js", cellInRow function. Developer should avoid adding duplicate cells, similar with "cellInCol".

[tengshengbo]

My fix for this:

	function cellInRow( tableMap, rowIndex, cell )
	{
		var oRow = tableMap[ rowIndex ];
		if ( typeof cell == 'undefined' ){
			var oRowtemp = [];
			for ( var c = 0; c < oRow.length; c++ )
			{
				oRowtemp.push( oRow[ c ] );
				if ( oRow[ c ].colSpan > 1 )
					c += oRow[ c ].colSpan - 1;
			}
			return oRowtemp;
		}
			

		for ( var c = 0 ; oRow && c < oRow.length ; c++ )
		{
			if ( cell.is && oRow[c] == cell.$ )
				return c;
			else if ( c == cell )
				return new CKEDITOR.dom.element( oRow[ c ] );
		}
		return cell.is ? -1 : null;
	}

[Jakub Ś]

Issue reproducible in all browsers from CKEditor 3.0.

The same broken table structure is produced it TC presented in #2568 and #8177. Perhaps all of those bugs use the same invalid code and they can be fixed with one patch.

[Jakub Ś]

This ticket has also been reported on our support channel.

---

There are two possible sources of this problem. When you start with this table:

<table border="1" cellpadding="1" cellspacing="1" style="width:500px">
	<tbody>
		<tr>
			<td>11</td>
			<td>12</td>
			<td>13</td>
		</tr>
		<tr>
			<td>21</td>
			<td>22</td>
			<td>23</td>
		</tr>
		<tr>
			<td>31</td>
			<td>32</td>
			<td>33</td>
		</tr>
	</tbody>
</table>

and Merge cell 11 Right, you will get rowspan="1" assigned to cell 1112. This assignment is really not necessary and is the first source of the problem.

<table border="1" cellpadding="1" cellspacing="1" style="width:500px">
	<tbody>
		<tr>
			<td colspan="2" rowspan="1">1112</td>
			<td>13</td>
		</tr>
		<tr>
			<td>21</td>
			<td>22</td>
			<td>23</td>
		</tr>
		<tr>
			<td>31</td>
			<td>32</td>
			<td>33</td>
		</tr>
	</tbody>
</table>

When you split vertically cell 13, new row is created and 2 is blindly added to rowspan value of cell 1112. This is another possible source of the problem.

<table border="1" cellpadding="1" cellspacing="1" style="width:500px">
	<tbody>
		<tr>
			<td colspan="2" rowspan="3">1112</td>
			<td>13</td>
		</tr>
		<tr>
			<td>&nbsp;</td>
		</tr>
		<tr>
			<td>21</td>
			<td>22</td>
			<td>23</td>
		</tr>
		<tr>
			<td>31</td>
			<td>32</td>
			<td>33</td>
		</tr>
	</tbody>
</table>

Either there should be no rowspan assignment when merging cells or rowspan value should be analysed when cell is split.