Check for buffer under/over run in table cell painting

Source/core/layout/LayoutTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1279 matching lines @@
     return tableAlignedRect;
 }
 
 CellSpan LayoutTableSection::dirtiedRows(const LayoutRect& damageRect) const
 {
     if (m_forceSlowPaintPathWithOverflowingCell)
         return fullTableRowSpan();
 
     CellSpan coveredRows = spannedRows(damageRect);
 
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last row even if they are not spanned themselves.
-    if (coveredRows.start() >= m_rowPos.size() - 1 && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last row even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredRows.start() < m_rowPos.size());
+    if (coveredRows.start() == m_rowPos.size() - 1
+        && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
         coveredRows.decreaseStart();
 
-    if (!coveredRows.end() && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
+    if (!coveredRows.end()
+        && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
         coveredRows.increaseEnd();
 
+    RELEASE_ASSERT(coveredRows.start() >= 0 && coveredRows.start() <= m_grid.size());
+    RELEASE_ASSERT(coveredRows.end() >= 0 && coveredRows.end() <= m_grid.size());
+    RELEASE_ASSERT(coveredRows.start() <= coveredRows.end());
+
     return coveredRows;
 }
 
 CellSpan LayoutTableSection::dirtiedColumns(const LayoutRect& damageRect) const
 {
     if (m_forceSlowPaintPathWithOverflowingCell)
         return fullTableColumnSpan();
 
     CellSpan coveredColumns = spannedColumns(damageRect);
 
     const Vector<int>& columnPos = table()->columnPositions();
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last column even if they are not spanned themselves.
-    if (coveredColumns.start() >= columnPos.size() - 1 && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last column even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredColumns.start() < columnPos.size());
+    if (coveredColumns.start() == columnPos.size() - 1
+        && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
         coveredColumns.decreaseStart();
 
-    if (!coveredColumns.end() && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
+    if (!coveredColumns.end()
+        && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
         coveredColumns.increaseEnd();
 
+    RELEASE_ASSERT(coveredColumns.start() >= 0 && coveredColumns.start() <= table()->numEffCols());
+    RELEASE_ASSERT(coveredColumns.end() >= 0 && coveredColumns.end() <= table()->numEffCols());
+    RELEASE_ASSERT(coveredColumns.start() <= coveredColumns.end());

[Julien - ping for review, 2015/06/08 15:23:47]

This code is repeated twice so I think it ought to be shared.

I would put it into CellSpace::ensureConsistency() as we could add it to
increaseStart / increaseEnd later if we want to.

+
     return coveredColumns;
 }
 
 CellSpan LayoutTableSection::spannedRows(const LayoutRect& flippedRect) const
 {
     // Find the first row that starts after rect top.
     unsigned nextRow = std::upper_bound(m_rowPos.begin(), m_rowPos.end(), flippedRect.y()) - m_rowPos.begin();
 
     if (nextRow == m_rowPos.size())
         return CellSpan(m_rowPos.size() - 1, m_rowPos.size() - 1); // After all rows.
@@ skipping 293 matching lines @@
     // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
 }
 
 } // namespace blink