Fix null pointer in LayoutTable::UpdateCollapsedOuterBorders().

Check for null BottomNonEmptySection even if TopNonEmptySection is not
null because of crbug.com/764525.

Bug: 764284
Change-Id: I4d45cbd3432722a8958ba647767d97b782c10512
Reviewed-on: https://chromium-review.googlesource.com/664303Reviewed-by: David Grogan <dgrogan@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501471}

third_party/WebKit/Source/core/layout/LayoutTable.cpp

@@ -1664,16 +1664,18 @@ void LayoutTable::UpdateCollapsedOuterBorders() const {
     }
   }
 
-  const auto* bottom_section = BottomNonEmptySection();
-  DCHECK(bottom_section);
   // The table's after outer border width is the maximum after outer border
   // widths of all cells in the last row. See the CSS 2.1 spec, section 17.6.2.
-  unsigned row = bottom_section->NumRows() - 1;
-  unsigned bottom_cols = bottom_section->NumCols(row);
-  for (unsigned col = 0; col < bottom_cols; ++col) {
-    if (const auto* cell = bottom_section->PrimaryCellAt(row, col)) {
-      collapsed_outer_border_after_ = std::max(
-          collapsed_outer_border_after_, cell->CollapsedOuterBorderAfter());
+  // TODO(crbug.com/764525): Because of the bug, bottom_section can be null when
+  // top_section is not null. See LayoutTableTest.OutOfOrderHeadAndBody.
+  if (const auto* bottom_section = BottomNonEmptySection()) {
+    unsigned row = bottom_section->NumRows() - 1;
+    unsigned bottom_cols = bottom_section->NumCols(row);
+    for (unsigned col = 0; col < bottom_cols; ++col) {
+      if (const auto* cell = bottom_section->PrimaryCellAt(row, col)) {
+        collapsed_outer_border_after_ = std::max(
+            collapsed_outer_border_after_, cell->CollapsedOuterBorderAfter());
+      }
     }
   }
 

third_party/WebKit/Source/core/layout/LayoutTableTest.cpp

@@ -233,6 +233,18 @@ TEST_F(LayoutTableTest, PaddingWithCollapsedBorder) {
   EXPECT_EQ(0, table->PaddingUnder());
 }
 
+TEST_F(LayoutTableTest, OutOfOrderHeadAndBody) {
+  // This should not crash.
+  SetBodyInnerHTML(
+      "<table style='border-collapse: collapse'>"
+      "  <tbody><tr><td>Body</td></tr></tbody>"
+      "  <thead></thead>"
+      "<table>");
+  // TODO(crbug.com/764525): Add tests for TopSection(), BottomSection(),
+  // TopNonEmptySection(), BottomNonEmptySection(), SectionAbove(),
+  // SectionBelow() for similar cases.
+}
+
 }  // anonymous namespace
 
 }  // namespace blink