Made varied number of cells in each row based on row's requirement.

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/TableSectionPainter.h"
 
 #include "core/layout/LayoutTableCell.h"
 #include "core/layout/LayoutTableCol.h"
 #include "core/layout/LayoutTableRow.h"
 #include "core/paint/BoxClipper.h"
@@ skipping 173 matching lines @@
 
   if (dirtiedColumns.start() >= dirtiedColumns.end())
     return;
 
   // Collapsed borders are painted from the bottom right to the top left so that
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
     for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
-      const LayoutTableSection::CellStruct& current =
-          m_layoutTableSection.cellAt(row, col);
-      const LayoutTableCell* cell = current.primaryCell();
+      const LayoutTableCell* cell =
+          m_layoutTableSection.primaryCellAt(row, col);
       if (!cell || (row > dirtiedRows.start() &&
                     m_layoutTableSection.primaryCellAt(row - 1, col) == cell) ||
           (col > dirtiedColumns.start() &&
            m_layoutTableSection.primaryCellAt(row, col - 1) == cell))
         continue;
       LayoutPoint cellPoint = m_layoutTableSection.flipForWritingModeForChild(
           cell, adjustedPaintOffset);
       TableCellPainter(*cell).paintCollapsedBorders(paintInfo, cellPoint,
                                                     currentBorderValue);
     }
@@ skipping 91 matching lines @@
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       const LayoutTableRow* row = m_layoutTableSection.rowLayoutObjectAt(r);
       // TODO(crbug.com/577282): This painting order is inconsistent with other
       // outlines.
       if (row && !row->hasSelfPaintingLayer() &&
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
       for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
         const LayoutTableSection::CellStruct& current =
             m_layoutTableSection.cellAt(r, c);

[mstensho (USE GERRIT), 2017/01/03 15:18:41]

Aren't we forgetting to check that 'c' is within bounds here?

[a.suchit, 2017/01/04 10:35:18]

Done.

         for (LayoutTableCell* cell : current.cells) {
           if (overflowingCells.contains(cell))
             continue;
           if (cell->rowSpan() > 1 || cell->colSpan() > 1) {
             if (!spanningCells.add(cell).isNewEntry)
               continue;
           }
           cells.append(cell);
         }
       }
@@ skipping 85 matching lines @@
                                      m_layoutTableSection.styleRef());
   } else {
     // TODO(wangxianzhu): Calculate the inset shadow bounds by insetting
     // paintRect by half widths of collapsed borders.
     BoxPainter::paintInsetBoxShadow(paintInfo, paintRect,
                                     m_layoutTableSection.styleRef());
   }
 }
 
 }  // namespace blink