Fix blink_perf.paint regression about tables

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/TableSectionPainter.h"
 
 #include "core/layout/LayoutTableCell.h"
 #include "core/layout/LayoutTableCol.h"
 #include "core/layout/LayoutTableRow.h"
 #include "core/paint/BoxClipper.h"
 #include "core/paint/BoxPainter.h"
 #include "core/paint/LayoutObjectDrawingRecorder.h"
 #include "core/paint/ObjectPainter.h"
 #include "core/paint/PaintInfo.h"
 #include "core/paint/TableCellPainter.h"
 #include "core/paint/TableRowPainter.h"
 #include <algorithm>
 
 namespace blink {
 
 inline const LayoutTableCell* TableSectionPainter::primaryCellToPaint(
     unsigned row,
     unsigned column,
     const CellSpan& dirtiedRows,
     const CellSpan& dirtiedColumns) const {
   DCHECK(row >= dirtiedRows.start() && row < dirtiedRows.end());
   DCHECK(column >= dirtiedColumns.start() && column < dirtiedColumns.end());
 
+  if (column >= m_layoutTableSection.numCols(row))
+    return nullptr;
+
   const LayoutTableCell* cell = m_layoutTableSection.primaryCellAt(row, column);
   if (!cell)
     return nullptr;
   // We have painted (row, column) when painting (row - 1, column).
   if (row > dirtiedRows.start() &&
+      column < m_layoutTableSection.numCols(row - 1) &&
       m_layoutTableSection.primaryCellAt(row - 1, column) == cell)
     return nullptr;
   // We have painted (row, column) when painting (row, column -1).
   if (column > dirtiedColumns.start() &&
       m_layoutTableSection.primaryCellAt(row, column - 1) == cell)
     return nullptr;
   return cell;
 }
 
 void TableSectionPainter::paintRepeatingHeaderGroup(
@@ skipping 138 matching lines @@
   CellSpan dirtiedColumns =
       m_layoutTableSection.dirtiedEffectiveColumns(tableAlignedRect);
 
   if (dirtiedColumns.start() >= dirtiedColumns.end())
     return;
 
   // Collapsed borders are painted from the bottom right to the top left so that
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
+    unsigned nCols = m_layoutTableSection.numCols(row);
+    unsigned prevRowCols =
+        row > dirtiedRows.start() ? m_layoutTableSection.numCols(row - 1) : 0;
     for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
+      if (col >= nCols)
+        break;

[mstensho (USE GERRIT), 2017/01/20 10:02:04]

Did you mean "continue;"? We're walking backwards in the vector here.

In that case, it would probably be better to initialize |c| as
std::min(dirtiedColumns.end(), std::max(nCols - 1, 0)) or something like that
instead.

[a.suchit, 2017/01/23 06:35:32]

Yes, It should be continue. Thanks
Done.

       const LayoutTableCell* cell =
           m_layoutTableSection.primaryCellAt(row, col);
-      if (!cell || (row > dirtiedRows.start() &&
+      if (!cell || (row > dirtiedRows.start() && col < prevRowCols &&
                     m_layoutTableSection.primaryCellAt(row - 1, col) == cell) ||
           (col > dirtiedColumns.start() &&
            m_layoutTableSection.primaryCellAt(row, col - 1) == cell))
         continue;
       LayoutPoint cellPoint = m_layoutTableSection.flipForWritingModeForChild(
           cell, adjustedPaintOffset);
       TableCellPainter(*cell).paintCollapsedBorders(paintInfo, cellPoint,
                                                     currentBorderValue);
     }
   }
@@ skipping 88 matching lines @@
 
     HashSet<LayoutTableCell*> spanningCells;
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       const LayoutTableRow* row = m_layoutTableSection.rowLayoutObjectAt(r);
       // TODO(crbug.com/577282): This painting order is inconsistent with other
       // outlines.
       if (row && !row->hasSelfPaintingLayer() &&
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
-      for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
-        if (c >= m_layoutTableSection.numCols(r))
-          break;
+      unsigned nCols = m_layoutTableSection.numCols(r);
+      for (unsigned c = dirtiedColumns.start();
+           c < nCols && c < dirtiedColumns.end(); c++) {
         const LayoutTableSection::CellStruct& current =
             m_layoutTableSection.cellAt(r, c);
         for (LayoutTableCell* cell : current.cells) {
           if (overflowingCells.contains(cell))
             continue;
           if (cell->rowSpan() > 1 || cell->colSpan() > 1) {
             if (!spanningCells.add(cell).isNewEntry)
               continue;
           }
           cells.push_back(cell);
@@ skipping 87 matching lines @@
                                      m_layoutTableSection.styleRef());
   } else {
     // TODO(wangxianzhu): Calculate the inset shadow bounds by insetting
     // paintRect by half widths of collapsed borders.
     BoxPainter::paintInsetBoxShadow(paintInfo, paintRect,
                                     m_layoutTableSection.styleRef());
   }
 }
 
 }  // namespace blink