Fix blink_perf.paint regression about tables

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

Index: third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
index 983c3269d84e5f4ad5eb2fdbfbbf8bf57effaefd..d3961fe90b64086374d70a3defb612b45e6a04e4 100644
--- a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp
@@ -26,11 +26,15 @@ inline const LayoutTableCell* TableSectionPainter::primaryCellToPaint(
   DCHECK(row >= dirtiedRows.start() && row < dirtiedRows.end());
   DCHECK(column >= dirtiedColumns.start() && column < dirtiedColumns.end());
 
+  if (column >= m_layoutTableSection.numCols(row))
+    return nullptr;
+
   const LayoutTableCell* cell = m_layoutTableSection.primaryCellAt(row, column);
   if (!cell)
     return nullptr;
   // We have painted (row, column) when painting (row - 1, column).
   if (row > dirtiedRows.start() &&
+      column < m_layoutTableSection.numCols(row - 1) &&
       m_layoutTableSection.primaryCellAt(row - 1, column) == cell)
     return nullptr;
   // We have painted (row, column) when painting (row, column -1).
@@ -189,11 +193,16 @@ void TableSectionPainter::paintCollapsedSectionBorders(
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
+    unsigned nCols = m_layoutTableSection.numCols(row);
+    unsigned prevRowCols =
+        row > dirtiedRows.start() ? m_layoutTableSection.numCols(row - 1) : 0;
     for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
+      if (col >= nCols)
+        break;

[mstensho (USE GERRIT), 2017/01/20 10:02:04]

Did you mean "continue;"? We're walking backwards in the vector here.

In that case, it would probably be better to initialize |c| as
std::min(dirtiedColumns.end(), std::max(nCols - 1, 0)) or something like that
instead.

[a.suchit, 2017/01/23 06:35:32]

Yes, It should be continue. Thanks
Done.

       const LayoutTableCell* cell =
           m_layoutTableSection.primaryCellAt(row, col);
-      if (!cell || (row > dirtiedRows.start() &&
+      if (!cell || (row > dirtiedRows.start() && col < prevRowCols &&
                     m_layoutTableSection.primaryCellAt(row - 1, col) == cell) ||
           (col > dirtiedColumns.start() &&
            m_layoutTableSection.primaryCellAt(row, col - 1) == cell))
@@ -302,9 +311,9 @@ void TableSectionPainter::paintObject(const PaintInfo& paintInfo,
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
-      for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
-        if (c >= m_layoutTableSection.numCols(r))
-          break;
+      unsigned nCols = m_layoutTableSection.numCols(r);
+      for (unsigned c = dirtiedColumns.start();
+           c < nCols && c < dirtiedColumns.end(); c++) {
         const LayoutTableSection::CellStruct& current =
             m_layoutTableSection.cellAt(r, c);
         for (LayoutTableCell* cell : current.cells) {