Merge 105542 - Crash in RenderTable::borderBefore

Source/WebCore/rendering/RenderTable.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 908 matching lines @@
 }
 
 void RenderTable::recalcBordersInRowDirection()
 {
     m_borderStart = calcBorderStart();
     m_borderEnd = calcBorderEnd();
 }
 
 LayoutUnit RenderTable::borderBefore() const
 {
-    if (collapseBorders())
+    if (collapseBorders()) {
+        recalcSectionsIfNeeded();
         return outerBorderBefore();
+    }
     return RenderBlock::borderBefore();
 }
 
 LayoutUnit RenderTable::borderAfter() const
 {
-    if (collapseBorders())
+    if (collapseBorders()) {
+        recalcSectionsIfNeeded();
         return outerBorderAfter();
+    }
     return RenderBlock::borderAfter();
 }
 
 LayoutUnit RenderTable::outerBorderBefore() const
 {
     if (!collapseBorders())
         return 0;
     LayoutUnit borderWidth = 0;
     if (RenderTableSection* topSection = this->topSection()) {
         borderWidth = topSection->outerBorderBefore();
@@ skipping 276 matching lines @@
     if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && boundsRect.intersects(result.rectForPoint(pointInContainer))) {
         updateHitTestResult(result, flipForWritingMode(pointInContainer - toLayoutSize(adjustedLocation)));
         if (!result.addNodeToRectBasedTestResult(node(), pointInContainer, boundsRect))
             return true;
     }
 
     return false;
 }
 
 }