Fix blink_perf.paint regression about tables

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

Index: third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index 6fb6a84f70109352033db6532ea9af73bd3d2a83..2b4e940043b833c2dba2885e7106195d5b30ea02 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -258,9 +258,9 @@ void LayoutTableSection::addCell(LayoutTableCell* cell, LayoutTableRow* row) {
   // <TR><TD>1 <TD rowspan="2">2 <TD>3 <TD>4
   // <TR><TD colspan="2">5
   // </TABLE>
-  while (m_cCol < numCols(insertionRow) &&
-         (cellAt(insertionRow, m_cCol).hasCells() ||
-          cellAt(insertionRow, m_cCol).inColSpan))
+  unsigned nCols = numCols(insertionRow);
+  while (m_cCol < nCols && (cellAt(insertionRow, m_cCol).hasCells() ||
+                            cellAt(insertionRow, m_cCol).inColSpan))
     m_cCol++;
 
   updateLogicalHeightForCell(m_grid[insertionRow], cell);
@@ -272,9 +272,10 @@ void LayoutTableSection::addCell(LayoutTableCell* cell, LayoutTableRow* row) {
   unsigned col = m_cCol;
   // tell the cell where it is
   bool inColSpan = false;
+  unsigned colSize = columns.size();
   while (cSpan) {
     unsigned currentSpan;
-    if (m_cCol >= columns.size()) {
+    if (m_cCol >= colSize) {
       table()->appendEffectiveColumn(cSpan);
       currentSpan = cSpan;
     } else {
@@ -1152,7 +1153,8 @@ void LayoutTableSection::layoutRows() {
   for (unsigned r = 0; r < totalRows; r++) {
     LayoutTableRow* rowLayoutObject = m_grid[r].rowLayoutObject;
 
-    for (unsigned c = 0; c < numCols(r); c++) {
+    unsigned nCols = numCols(r);
+    for (unsigned c = 0; c < nCols; c++) {
       CellStruct& cs = cellAt(r, c);
       LayoutTableCell* cell = cs.primaryCell();
 
@@ -1272,12 +1274,15 @@ void LayoutTableSection::computeOverflowFromCells(unsigned totalRows,
 #endif
   // Now that our height has been determined, add in overflow from cells.
   for (unsigned r = 0; r < totalRows; r++) {
-    for (unsigned c = 0; c < numCols(r); c++) {
+    unsigned nCols = numCols(r);
+    unsigned nextRowCells = r < totalRows - 1 ? numCols(r + 1) : 0;
+    for (unsigned c = 0; c < nCols; c++) {
       CellStruct& cs = cellAt(r, c);
       LayoutTableCell* cell = cs.primaryCell();
       if (!cell || cs.inColSpan)
         continue;
-      if (r < totalRows - 1 && cell == primaryCellAt(r + 1, c))
+      if (r < totalRows - 1 && c < nextRowCells &&
+          cell == primaryCellAt(r + 1, c))
         continue;
       addOverflowFromChild(cell);
 #if ENABLE(ASSERT)
@@ -1313,7 +1318,8 @@ bool LayoutTableSection::recalcChildOverflowAfterStyleChange() {
       continue;
     rowLayouter->clearChildNeedsOverflowRecalcAfterStyleChange();
     bool rowChildrenOverflowChanged = false;
-    for (unsigned c = 0; c < numCols(r); c++) {
+    unsigned nCols = numCols(r);
+    for (unsigned c = 0; c < nCols; c++) {
       CellStruct& cs = cellAt(r, c);
       LayoutTableCell* cell = cs.primaryCell();
       if (!cell || cs.inColSpan || !cell->needsOverflowRecalcAfterStyleChange())
@@ -1366,7 +1372,8 @@ int LayoutTableSection::calcBlockDirectionOuterBorder(
 
   bool allHidden = true;
   unsigned r = side == BorderBefore ? 0 : m_grid.size() - 1;
-  for (unsigned c = 0; c < numCols(r); c++) {
+  unsigned nCols = numCols(r);
+  for (unsigned c = 0; c < nCols; c++) {
     const CellStruct& current = cellAt(r, c);
     if (current.inColSpan || !current.hasCells())
       continue;
@@ -1687,7 +1694,8 @@ unsigned LayoutTableSection::numEffectiveColumns() const {
   unsigned result = 0;
 
   for (unsigned r = 0; r < m_grid.size(); ++r) {
-    for (unsigned c = result; c < numCols(r); ++c) {
+    unsigned nCols = numCols(r);
+    for (unsigned c = result; c < nCols; ++c) {
       const CellStruct& cell = cellAt(r, c);
       if (cell.hasCells() || cell.inColSpan)
         result = c;
@@ -1805,11 +1813,9 @@ bool LayoutTableSection::nodeAtPoint(HitTestResult& result,
 
   // Now iterate over the spanned rows and columns.
   for (unsigned hitRow = rowSpan.start(); hitRow < rowSpan.end(); ++hitRow) {
-    for (unsigned hitColumn = columnSpan.start(); hitColumn < columnSpan.end();
-         ++hitColumn) {
-      if (hitColumn >= numCols(hitRow))
-        break;
-
+    unsigned nCols = numCols(hitRow);
+    for (unsigned hitColumn = columnSpan.start();
+         hitColumn < nCols && hitColumn < columnSpan.end(); ++hitColumn) {
       CellStruct& current = cellAt(hitRow, hitColumn);
 
       // If the cell is empty, there's nothing to do