Fix blink_perf.paint regression about tables

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

Index: third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
index 983c3269d84e5f4ad5eb2fdbfbbf8bf57effaefd..43c1a64c7183f1d57659d2474a13eeb23b4f2382 100644
--- a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
@@ -189,7 +189,9 @@ void TableSectionPainter::paintCollapsedSectionBorders(
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
-    for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
+    unsigned nCols = m_layoutTableSection.numCols(row);
+    for (unsigned c = std::min(dirtiedColumns.end(), nCols);
+         c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
       const LayoutTableCell* cell =
           m_layoutTableSection.primaryCellAt(row, col);
@@ -302,9 +304,9 @@ void TableSectionPainter::paintObject(const PaintInfo& paintInfo,
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
-      for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
-        if (c >= m_layoutTableSection.numCols(r))
-          break;
+      unsigned nCols = m_layoutTableSection.numCols(r);
+      for (unsigned c = dirtiedColumns.start();
+           c < nCols && c < dirtiedColumns.end(); c++) {
         const LayoutTableSection::CellStruct& current =
             m_layoutTableSection.cellAt(r, c);
         for (LayoutTableCell* cell : current.cells) {