WebKit merge 41660:41709 (WebKit side)....

third_party/WebKit/WebCore/page/AccessibilityTable.cpp

Index: third_party/WebKit/WebCore/page/AccessibilityTable.cpp
===================================================================
--- third_party/WebKit/WebCore/page/AccessibilityTable.cpp	(revision 11711)
+++ third_party/WebKit/WebCore/page/AccessibilityTable.cpp	(working copy)
@@ -386,11 +386,13 @@
     unsigned rowOffset = 0;
     while (tableSection) {
         
-        rowCount += tableSection->numRows();
+        unsigned numRows = tableSection->numRows();
         unsigned numCols = tableSection->numColumns();
         
-        if (row < rowCount && column < numCols) {
-            int sectionSpecificRow = row - rowOffset;
+        rowCount += numRows;
+        
+        unsigned sectionSpecificRow = row - rowOffset;            
+        if (row < rowCount && column < numCols && sectionSpecificRow < numRows) {
             cell = tableSection->cellAt(sectionSpecificRow, column).cell;
             
             // we didn't find the cell, which means there's spanning happening
@@ -422,9 +424,9 @@
         if (cell)
             break;
         
-        rowOffset += rowCount;
+        rowOffset += numRows;
         // we didn't find anything between the rows we should have
-        if (row < rowOffset)
+        if (row < rowCount)
             break;
         tableSection = table->sectionBelow(tableSection, true);        
     }