Check for buffer under/over run in table cell painting

Source/core/layout/LayoutTableSection.h

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 38 matching lines @@
         , m_end(end)
     {
     }
 
     unsigned start() const { return m_start; }
     unsigned end() const { return m_end; }
 
     void decreaseStart() { --m_start; }
     void increaseEnd() { ++m_end; }
 
+    void ensureConsistency(const unsigned);
+
 private:
     unsigned m_start;
     unsigned m_end;
 };
 
 class LayoutTableCell;
 class LayoutTableRow;
 
 class CORE_EXPORT LayoutTableSection final : public LayoutBox {
 public:
@@ skipping 245 matching lines @@
     // It is held at LayoutTableSection level to spare memory consumption by table cells.
     using CellsCollapsedBordersMap = HashMap<pair<const LayoutTableCell*, int>, CollapsedBorderValue>;
     CellsCollapsedBordersMap m_cellsCollapsedBorders;
 };
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutTableSection, isTableSection());
 
 } // namespace blink
 
 #endif // LayoutTableSection_h