Don't assume every cell in a row has a column

third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BackgroundImageGeometry.h"
 
 #include "core/frame/FrameView.h"
 #include "core/layout/LayoutBox.h"
 #include "core/layout/LayoutBoxModelObject.h"
 #include "core/layout/LayoutTableCell.h"
@@ skipping 314 matching lines @@
 
 static void expandToTableColumnGroup(const LayoutTableCell& cell,
                                      const LayoutTableCol& columnGroup,
                                      LayoutUnit& value,
                                      ColumnGroupDirection columnDirection) {
   auto siblingCell = columnDirection == ColumnGroupStart
                          ? &LayoutTableCell::previousCell
                          : &LayoutTableCell::nextCell;
   for (const auto* sibling = (cell.*siblingCell)(); sibling;
        sibling = (sibling->*siblingCell)()) {
-    if (cell.table()
+    LayoutTableCol* innermostCol =
+        cell.table()
             ->colElementAtAbsoluteColumn(sibling->absoluteColumnIndex())
-            .innermostColOrColGroup()
-            ->enclosingColumnGroup() != columnGroup)
+            .innermostColOrColGroup();
+    if (!innermostCol || innermostCol->enclosingColumnGroup() != columnGroup)
       break;
     value += sibling->size().width();
   }
 }
 
 LayoutPoint BackgroundImageGeometry::getOffsetForCell(
     const LayoutTableCell& cell,
     const LayoutBox& positioningBox) {
   LayoutSize borderSpacing = LayoutSize(cell.table()->hBorderSpacing(),
                                         cell.table()->vBorderSpacing());
@@ skipping 289 matching lines @@
     useFixedAttachment(paintRect.location());
 
   // Clip the final output rect to the paint rect
   m_destRect.intersect(paintRect);
 
   // Snap as-yet unsnapped values.
   setDestRect(LayoutRect(pixelSnappedIntRect(m_destRect)));
 }
 
 }  // namespace blink