Fix blink_perf.paint regression about tables

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/TableSectionPainter.h"
 
 #include "core/layout/LayoutTableCell.h"
 #include "core/layout/LayoutTableCol.h"
 #include "core/layout/LayoutTableRow.h"
 #include "core/paint/BoxClipper.h"
@@ skipping 171 matching lines @@
   CellSpan dirtiedColumns =
       m_layoutTableSection.dirtiedEffectiveColumns(tableAlignedRect);
 
   if (dirtiedColumns.start() >= dirtiedColumns.end())
     return;
 
   // Collapsed borders are painted from the bottom right to the top left so that
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
-    for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
+    unsigned nCols = m_layoutTableSection.numCols(row);
+    for (unsigned c = std::min(dirtiedColumns.end(), nCols);
+         c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
       const LayoutTableCell* cell =
           m_layoutTableSection.primaryCellAt(row, col);
       if (!cell || (row > dirtiedRows.start() &&
                     m_layoutTableSection.primaryCellAt(row - 1, col) == cell) ||
           (col > dirtiedColumns.start() &&
            m_layoutTableSection.primaryCellAt(row, col - 1) == cell))
         continue;
       LayoutPoint cellPoint = m_layoutTableSection.flipForWritingModeForChild(
           cell, adjustedPaintOffset);
@@ skipping 92 matching lines @@
 
     HashSet<LayoutTableCell*> spanningCells;
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       const LayoutTableRow* row = m_layoutTableSection.rowLayoutObjectAt(r);
       // TODO(crbug.com/577282): This painting order is inconsistent with other
       // outlines.
       if (row && !row->hasSelfPaintingLayer() &&
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
-      for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
-        if (c >= m_layoutTableSection.numCols(r))
-          break;
+      unsigned nCols = m_layoutTableSection.numCols(r);
+      for (unsigned c = dirtiedColumns.start();
+           c < nCols && c < dirtiedColumns.end(); c++) {
         const LayoutTableSection::CellStruct& current =
             m_layoutTableSection.cellAt(r, c);
         for (LayoutTableCell* cell : current.cells) {
           if (overflowingCells.contains(cell))
             continue;
           if (cell->rowSpan() > 1 || cell->colSpan() > 1) {
             if (!spanningCells.add(cell).isNewEntry)
               continue;
           }
           cells.push_back(cell);
@@ skipping 87 matching lines @@
                                      m_layoutTableSection.styleRef());
   } else {
     // TODO(wangxianzhu): Calculate the inset shadow bounds by insetting
     // paintRect by half widths of collapsed borders.
     BoxPainter::paintInsetBoxShadow(paintInfo, paintRect,
                                     m_layoutTableSection.styleRef());
   }
 }
 
 }  // namespace blink