Index: third_party/WebKit/Source/core/paint/TableSectionPainter.cpp |
diff --git a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp |
index 983c3269d84e5f4ad5eb2fdbfbbf8bf57effaefd..d3961fe90b64086374d70a3defb612b45e6a04e4 100644 |
--- a/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp |
+++ b/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp |
@@ -26,11 +26,15 @@ inline const LayoutTableCell* TableSectionPainter::primaryCellToPaint( |
DCHECK(row >= dirtiedRows.start() && row < dirtiedRows.end()); |
DCHECK(column >= dirtiedColumns.start() && column < dirtiedColumns.end()); |
+ if (column >= m_layoutTableSection.numCols(row)) |
+ return nullptr; |
+ |
const LayoutTableCell* cell = m_layoutTableSection.primaryCellAt(row, column); |
if (!cell) |
return nullptr; |
// We have painted (row, column) when painting (row - 1, column). |
if (row > dirtiedRows.start() && |
+ column < m_layoutTableSection.numCols(row - 1) && |
m_layoutTableSection.primaryCellAt(row - 1, column) == cell) |
return nullptr; |
// We have painted (row, column) when painting (row, column -1). |
@@ -189,11 +193,16 @@ void TableSectionPainter::paintCollapsedSectionBorders( |
// precedence due to cell position is respected. |
for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) { |
unsigned row = r - 1; |
+ unsigned nCols = m_layoutTableSection.numCols(row); |
+ unsigned prevRowCols = |
+ row > dirtiedRows.start() ? m_layoutTableSection.numCols(row - 1) : 0; |
for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) { |
unsigned col = c - 1; |
+ if (col >= nCols) |
+ break; |
mstensho (USE GERRIT)
2017/01/20 10:02:04
Did you mean "continue;"? We're walking backwards
a.suchit
2017/01/23 06:35:32
Yes, It should be continue. Thanks
Done.
|
const LayoutTableCell* cell = |
m_layoutTableSection.primaryCellAt(row, col); |
- if (!cell || (row > dirtiedRows.start() && |
+ if (!cell || (row > dirtiedRows.start() && col < prevRowCols && |
m_layoutTableSection.primaryCellAt(row - 1, col) == cell) || |
(col > dirtiedColumns.start() && |
m_layoutTableSection.primaryCellAt(row, col - 1) == cell)) |
@@ -302,9 +311,9 @@ void TableSectionPainter::paintObject(const PaintInfo& paintInfo, |
shouldPaintSelfOutline(paintInfoForDescendants.phase)) |
TableRowPainter(*row).paintOutline(paintInfoForDescendants, |
paintOffset); |
- for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) { |
- if (c >= m_layoutTableSection.numCols(r)) |
- break; |
+ unsigned nCols = m_layoutTableSection.numCols(r); |
+ for (unsigned c = dirtiedColumns.start(); |
+ c < nCols && c < dirtiedColumns.end(); c++) { |
const LayoutTableSection::CellStruct& current = |
m_layoutTableSection.cellAt(r, c); |
for (LayoutTableCell* cell : current.cells) { |