Fix blink_perf.paint regression about tables

third_party/WebKit/Source/modules/accessibility/AXTableColumn.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 64 matching lines @@
 
   LayoutTable* table = toLayoutTable(layoutObject);
   LayoutTableSection* tableSection = table->topSection();
   for (; tableSection;
        tableSection = table->sectionBelow(tableSection, SkipEmptySections)) {
     unsigned numCols = tableSection->numEffectiveColumns();
     if (m_columnIndex >= numCols)
       continue;
     unsigned numRows = tableSection->numRows();
     for (unsigned r = 0; r < numRows; r++) {
+      if (m_columnIndex >= tableSection->numCols(r))
+        continue;
       LayoutTableCell* layoutCell =
           tableSection->primaryCellAt(r, m_columnIndex);
       if (!layoutCell)
         continue;
 
       AXObject* cell = axObjectCache().getOrCreate(layoutCell->node());
       if (!cell || !cell->isTableCell() || headers.contains(cell))
         continue;
 
       if (toAXTableCell(cell)->scanToDecideHeaderRole() == ColumnHeaderRole)
@@ skipping 43 matching lines @@
 
     // make sure the last one isn't the same as this one (rowspan cells)
     if (m_children.size() > 0 && m_children.back() == cell)
       continue;
 
     m_children.push_back(cell);
   }
 }
 
 }  // namespace blink