Fix spanning cell painting background from wrong row

third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/TableSectionPainter.h"
 
 #include "core/layout/LayoutTableCell.h"
 #include "core/layout/LayoutTableCol.h"
 #include "core/layout/LayoutTableRow.h"
 #include "core/paint/BoxClipper.h"
 #include "core/paint/BoxPainter.h"
 #include "core/paint/LayoutObjectDrawingRecorder.h"
 #include "core/paint/ObjectPainter.h"
 #include "core/paint/PaintInfo.h"
 #include "core/paint/TableCellPainter.h"
 #include "core/paint/TableRowPainter.h"
 #include <algorithm>
 
 namespace blink {
 
-inline const LayoutTableCell* TableSectionPainter::primaryCellToPaint(
-    unsigned row,
-    unsigned column,
-    const CellSpan& dirtiedRows,
-    const CellSpan& dirtiedColumns) const {
-  DCHECK(row >= dirtiedRows.start() && row < dirtiedRows.end());
-  DCHECK(column >= dirtiedColumns.start() && column < dirtiedColumns.end());
-
-  const LayoutTableCell* cell = m_layoutTableSection.primaryCellAt(row, column);
-  if (!cell)
-    return nullptr;
-  // We have painted (row, column) when painting (row - 1, column).
-  if (row > dirtiedRows.start() &&
-      m_layoutTableSection.primaryCellAt(row - 1, column) == cell)
-    return nullptr;
-  // We have painted (row, column) when painting (row, column -1).
-  if (column > dirtiedColumns.start() &&
-      m_layoutTableSection.primaryCellAt(row, column - 1) == cell)
-    return nullptr;
-  return cell;
-}
-
 void TableSectionPainter::paintRepeatingHeaderGroup(
     const PaintInfo& paintInfo,
     const LayoutPoint& paintOffset,
     const CollapsedBorderValue& currentBorderValue,
     ItemToPaint itemToPaint) {
   if (!m_layoutTableSection.isRepeatingHeaderGroup())
     return;
 
   LayoutTable* table = m_layoutTableSection.table();
   LayoutPoint paginationOffset = paintOffset;
@@ skipping 133 matching lines @@
     return;
 
   // Collapsed borders are painted from the bottom right to the top left so that
   // precedence due to cell position is respected.
   for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
     unsigned row = r - 1;
     unsigned nCols = m_layoutTableSection.numCols(row);
     for (unsigned c = std::min(dirtiedColumns.end(), nCols);
          c > dirtiedColumns.start(); c--) {
       unsigned col = c - 1;
-      const LayoutTableCell* cell =
-          m_layoutTableSection.primaryCellAt(row, col);
-      if (!cell || (row > dirtiedRows.start() &&
-                    m_layoutTableSection.primaryCellAt(row - 1, col) == cell) ||
-          (col > dirtiedColumns.start() &&
-           m_layoutTableSection.primaryCellAt(row, col - 1) == cell))
-        continue;
-      LayoutPoint cellPoint = m_layoutTableSection.flipForWritingModeForChild(
-          cell, adjustedPaintOffset);
-      TableCellPainter(*cell).paintCollapsedBorders(paintInfo, cellPoint,
-                                                    currentBorderValue);
+      if (const LayoutTableCell* cell =
+              m_layoutTableSection.originatingCellAt(row, col)) {
+        LayoutPoint cellPoint = m_layoutTableSection.flipForWritingModeForChild(
+            cell, adjustedPaintOffset);
+        TableCellPainter(*cell).paintCollapsedBorders(paintInfo, cellPoint,
+                                                      currentBorderValue);
+      }
     }
   }
 }
 
 void TableSectionPainter::paintObject(const PaintInfo& paintInfo,
                                       const LayoutPoint& paintOffset) {
   LayoutRect localVisualRect = LayoutRect(paintInfo.cullRect().m_rect);
   localVisualRect.moveBy(-paintOffset);
 
   LayoutRect tableAlignedRect =
       m_layoutTableSection.logicalRectForWritingModeAndDirection(
           localVisualRect);
 
   CellSpan dirtiedRows = m_layoutTableSection.dirtiedRows(tableAlignedRect);
   CellSpan dirtiedColumns =
       m_layoutTableSection.dirtiedEffectiveColumns(tableAlignedRect);
 
   if (dirtiedColumns.start() >= dirtiedColumns.end())
     return;
 
   PaintInfo paintInfoForDescendants = paintInfo.forDescendants();
 
   if (shouldPaintSelfBlockBackground(paintInfo.phase)) {
     paintBoxShadow(paintInfo, paintOffset, Normal);
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
         if (const LayoutTableCell* cell =
-                primaryCellToPaint(r, c, dirtiedRows, dirtiedColumns))
+                m_layoutTableSection.originatingCellAt(r, c)) {
           paintBackgroundsBehindCell(*cell, paintInfoForDescendants,
                                      paintOffset);
+        }
       }
     }
     paintBoxShadow(paintInfo, paintOffset, Inset);
   }
 
   if (paintInfo.phase == PaintPhaseSelfBlockBackgroundOnly)
     return;
 
   if (shouldPaintDescendantBlockBackgrounds(paintInfo.phase)) {
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       const LayoutTableRow* row = m_layoutTableSection.rowLayoutObjectAt(r);
       // If a row has a layer, we'll paint row background in TableRowPainter.
       if (!row || row->hasSelfPaintingLayer())
         continue;
 
       TableRowPainter rowPainter(*row);
       rowPainter.paintBoxShadow(paintInfoForDescendants, paintOffset, Normal);
       if (row->styleRef().hasBackground()) {
         for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end();
              c++) {
           if (const LayoutTableCell* cell =
-                  primaryCellToPaint(r, c, dirtiedRows, dirtiedColumns))
+                  m_layoutTableSection.originatingCellAt(r, c)) {
             rowPainter.paintBackgroundBehindCell(*cell, paintInfoForDescendants,
                                                  paintOffset);
+          }
         }
       }
       rowPainter.paintBoxShadow(paintInfoForDescendants, paintOffset, Inset);
     }
   }
 
   const HashSet<LayoutTableCell*>& overflowingCells =
       m_layoutTableSection.overflowingCells();
   if (!m_layoutTableSection.hasMultipleCellLevels() &&
       overflowingCells.isEmpty()) {
     for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
       const LayoutTableRow* row = m_layoutTableSection.rowLayoutObjectAt(r);
       // TODO(crbug.com/577282): This painting order is inconsistent with other
       // outlines.
       if (row && !row->hasSelfPaintingLayer() &&
           shouldPaintSelfOutline(paintInfoForDescendants.phase))
         TableRowPainter(*row).paintOutline(paintInfoForDescendants,
                                            paintOffset);
       for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
         if (const LayoutTableCell* cell =
-                primaryCellToPaint(r, c, dirtiedRows, dirtiedColumns))
+                m_layoutTableSection.originatingCellAt(r, c))
           paintCell(*cell, paintInfoForDescendants, paintOffset);
       }
     }
   } else {
     // The overflowing cells should be scarce to avoid adding a lot of cells to
     // the HashSet.
     DCHECK(overflowingCells.size() <
            m_layoutTableSection.numRows() *
                m_layoutTableSection.table()->effectiveColumns().size() *
                gMaxAllowedOverflowingCellRatioForFastPaintPath);
@@ skipping 115 matching lines @@
                                      m_layoutTableSection.styleRef());
   } else {
     // TODO(wangxianzhu): Calculate the inset shadow bounds by insetting
     // paintRect by half widths of collapsed borders.
     BoxPainter::paintInsetBoxShadow(paintInfo, paintRect,
                                     m_layoutTableSection.styleRef());
   }
 }
 
 }  // namespace blink