WebKit merge 41660:41709 (WebKit side)....

third_party/WebKit/WebCore/page/AccessibilityTable.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 368 matching lines @@
     RenderTable* table = static_cast<RenderTable*>(m_renderer);
     RenderTableSection* tableSection = table->header();
     if (!tableSection)
         tableSection = table->firstBody();
     
     RenderTableCell* cell = 0;
     unsigned rowCount = 0;
     unsigned rowOffset = 0;
     while (tableSection) {
         
-        rowCount += tableSection->numRows();
+        unsigned numRows = tableSection->numRows();
         unsigned numCols = tableSection->numColumns();
         
-        if (row < rowCount && column < numCols) {
-            int sectionSpecificRow = row - rowOffset;
+        rowCount += numRows;
+        
+        unsigned sectionSpecificRow = row - rowOffset;            
+        if (row < rowCount && column < numCols && sectionSpecificRow < numRows) {
             cell = tableSection->cellAt(sectionSpecificRow, column).cell;
             
             // we didn't find the cell, which means there's spanning happening
             // search backwards to find the spanning cell
             if (!cell) {
                 
                 // first try rows
                 for (int testRow = sectionSpecificRow-1; testRow >= 0; --testRow) {
                     cell = tableSection->cellAt(testRow, column).cell;
                     // cell overlapped. use this one
@@ skipping 11 matching lines @@
                             break;
                         cell = 0;
                     }
                 }
             }
         }
         
         if (cell)
             break;
         
-        rowOffset += rowCount;
+        rowOffset += numRows;
         // we didn't find anything between the rows we should have
-        if (row < rowOffset)
+        if (row < rowCount)
             break;
         tableSection = table->sectionBelow(tableSection, true);        
     }
     
     if (!cell)
         return 0;
     
     AccessibilityObject* cellObject = axObjectCache()->getOrCreate(cell);
     ASSERT(cellObject->isTableCell());
     
@@ skipping 42 matching lines @@
 
 bool AccessibilityTable::isDataTable() const
 {
     if (!m_renderer)
         return false;
     
     return m_isAccessibilityTable;
 }
 
 } // namespace WebCore