Check for buffer under/over run in table cell painting

Source/core/layout/LayoutTableSection.cpp

Index: Source/core/layout/LayoutTableSection.cpp
diff --git a/Source/core/layout/LayoutTableSection.cpp b/Source/core/layout/LayoutTableSection.cpp
index 6519b756dd9f3d8cae1dc7186db6267237737bb8..59e0380ae56df4bdb5d2c0dff42ca5a17cbd6d1c 100644
--- a/Source/core/layout/LayoutTableSection.cpp
+++ b/Source/core/layout/LayoutTableSection.cpp
@@ -1297,13 +1297,21 @@ CellSpan LayoutTableSection::dirtiedRows(const LayoutRect& damageRect) const
 
     CellSpan coveredRows = spannedRows(damageRect);
 
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last row even if they are not spanned themselves.
-    if (coveredRows.start() >= m_rowPos.size() - 1 && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last row even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredRows.start() < m_rowPos.size());
+    if (coveredRows.start() == m_rowPos.size() - 1
+        && m_rowPos[m_rowPos.size() - 1] + table()->outerBorderAfter() >= damageRect.y())
         coveredRows.decreaseStart();
 
-    if (!coveredRows.end() && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
+    if (!coveredRows.end()
+        && m_rowPos[0] - table()->outerBorderBefore() <= damageRect.maxY())
         coveredRows.increaseEnd();
 
+    RELEASE_ASSERT(coveredRows.start() >= 0 && coveredRows.start() <= m_grid.size());
+    RELEASE_ASSERT(coveredRows.end() >= 0 && coveredRows.end() <= m_grid.size());
+    RELEASE_ASSERT(coveredRows.start() <= coveredRows.end());
+
     return coveredRows;
 }
 
@@ -1315,13 +1323,21 @@ CellSpan LayoutTableSection::dirtiedColumns(const LayoutRect& damageRect) const
     CellSpan coveredColumns = spannedColumns(damageRect);
 
     const Vector<int>& columnPos = table()->columnPositions();
-    // To issue paint invalidations for the border we might need to paint invalidate the first or last column even if they are not spanned themselves.
-    if (coveredColumns.start() >= columnPos.size() - 1 && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
+    // To issue paint invalidations for the border we might need to paint invalidate the first
+    // or last column even if they are not spanned themselves.
+    RELEASE_ASSERT(coveredColumns.start() < columnPos.size());
+    if (coveredColumns.start() == columnPos.size() - 1
+        && columnPos[columnPos.size() - 1] + table()->outerBorderEnd() >= damageRect.x())
         coveredColumns.decreaseStart();
 
-    if (!coveredColumns.end() && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
+    if (!coveredColumns.end()
+        && columnPos[0] - table()->outerBorderStart() <= damageRect.maxX())
         coveredColumns.increaseEnd();
 
+    RELEASE_ASSERT(coveredColumns.start() >= 0 && coveredColumns.start() <= table()->numEffCols());
+    RELEASE_ASSERT(coveredColumns.end() >= 0 && coveredColumns.end() <= table()->numEffCols());
+    RELEASE_ASSERT(coveredColumns.start() <= coveredColumns.end());

[Julien - ping for review, 2015/06/08 15:23:47]

This code is repeated twice so I think it ought to be shared.

I would put it into CellSpace::ensureConsistency() as we could add it to
increaseStart / increaseEnd later if we want to.

+
     return coveredColumns;
 }