Check for buffer under/over run in table cell painting

Source/core/layout/LayoutTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 60 matching lines @@
             if (cRowLogicalHeight.type() < Percent
                 || (cRowLogicalHeight.isFixed() && cRowLogicalHeight.value() < logicalHeight.value()))
                 row.logicalHeight = logicalHeight;
             break;
         default:
             break;
         }
     }
 }
 
+void CellSpan::ensureConsistency(const unsigned maximumSpanSize)
+{
+    RELEASE_ASSERT(m_start >= 0 && m_start <= maximumSpanSize);
+    RELEASE_ASSERT(m_end >= 0 && m_end <= maximumSpanSize);
+    RELEASE_ASSERT(m_start <= m_end);
+}
+
 LayoutTableSection::LayoutTableSection(Element* element)
     : LayoutBox(element)
     , m_cCol(0)
     , m_cRow(0)
     , m_outerBorderStart(0)
     , m_outerBorderEnd(0)
     , m_outerBorderBefore(0)
     , m_outerBorderAfter(0)
     , m_needsCellRecalc(false)
     , m_forceSlowPaintPathWithOverflowingCell(false)
@@ skipping 1199 matching lines @@
     return tableAlignedRect;
 }
 
 CellSpan LayoutTableSection::dirtiedRows(const LayoutRect& damageRect) const
 {
     if (m_forceSlowPaintPathWithOverflowingCell)
         return fullTableRowSpan();
 
     CellSpan coveredRows = spannedRows(damageRect);
 
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last row even if they are not spanned themselves.
-    if (coveredRows.start() >= m_rowPos.size() - 1 && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last row even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredRows.start() < m_rowPos.size());
+    if (coveredRows.start() == m_rowPos.size() - 1
+        && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
         coveredRows.decreaseStart();
 
-    if (!coveredRows.end() && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
+    if (!coveredRows.end()
+        && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
         coveredRows.increaseEnd();
 
+    coveredRows.ensureConsistency(m_grid.size());
+
     return coveredRows;
 }
 
 CellSpan LayoutTableSection::dirtiedColumns(const LayoutRect& damageRect) const
 {
     if (m_forceSlowPaintPathWithOverflowingCell)
         return fullTableColumnSpan();
 
     CellSpan coveredColumns = spannedColumns(damageRect);
 
     const Vector<int>& columnPos = table()->columnPositions();
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last column even if they are not spanned themselves.
-    if (coveredColumns.start() >= columnPos.size() - 1 && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last column even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredColumns.start() < columnPos.size());
+    if (coveredColumns.start() == columnPos.size() - 1
+        && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
         coveredColumns.decreaseStart();
 
-    if (!coveredColumns.end() && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
+    if (!coveredColumns.end()
+        && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
         coveredColumns.increaseEnd();
 
+    coveredColumns.ensureConsistency(table()->numEffCols());
+
     return coveredColumns;
 }
 
 CellSpan LayoutTableSection::spannedRows(const LayoutRect& flippedRect) const
 {
     // Find the first row that starts after rect top.
     unsigned nextRow = std::upper_bound(m_rowPos.begin(), m_rowPos.end(), flippedRect.y()) - m_rowPos.begin();
 
     if (nextRow == m_rowPos.size())
         return CellSpan(m_rowPos.size() - 1, m_rowPos.size() - 1); // After all rows.
@@ skipping 293 matching lines @@
     // FIXME: The table's direction should determine our row's direction, not the section's (see bug 96691).
     if (!style()->isLeftToRightDirection())
         cellLocation.setX(table()->columnPositions()[table()->numEffCols()] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + horizontalBorderSpacing);
     else
         cellLocation.setX(table()->columnPositions()[effectiveColumn] + horizontalBorderSpacing);
 
     cell->setLogicalLocation(cellLocation);
 }
 
 } // namespace blink