[Pkg-chromium-commit] chromium-browser/chromium-browser.squeeze: 709 * Backported security patches from stable:

[Giuseppe Iuculano]

Branch name: chromium-browser/chromium-browser.squeeze
Branch location : bzr+ssh://bzr.debian.org/bzr/pkg-chromium/chromium-browser/chromium-browser.squeeze
Browse location: http://bzr.debian.org/loggerhead/pkg-chromium
Revision No: 709
Revision Id: iuculano at debian.org-20110211143605-jw2rcqwc21wdgdac
Committer: Giuseppe Iuculano <iuculano at debian.org>
Message : * Backported security patches from stable:
  - High Stale pointer in animation event handling. Credit to Rik Cabanier.


--------------------------------------------------------
  ** Added :
        - debian/patches/67234.patch

  ** Modified :
        - debian/changelog
        - debian/patches/series

-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog	2011-02-07 18:40:36 +0000
+++ b/debian/changelog	2011-02-11 14:36:05 +0000
@@ -1,3 +1,10 @@
+chromium-browser (6.0.472.63~r59945-5+squeeze2) stable-security; urgency=low
+
+  * Backported security patches from stable:
+    - High Stale pointer in animation event handling. Credit to Rik Cabanier.
+
+ -- Giuseppe Iuculano <iuculano at debian.org>  Fri, 11 Feb 2011 15:34:37 +0100
+
 chromium-browser (6.0.472.63~r59945-5+squeeze1) stable-security; urgency=high
 
   * Backported security patches from stable:

=== added file 'debian/patches/67234.patch'
--- a/debian/patches/67234.patch	1970-01-01 00:00:00 +0000
+++ b/debian/patches/67234.patch	2011-02-11 14:36:05 +0000
@@ -0,0 +1,23 @@
+--- a/src/third_party/WebKit/WebCore/page/animation/AnimationController.cpp
++++ b/src/third_party/WebKit/WebCore/page/animation/AnimationController.cpp
+@@ -145,16 +145,16 @@ void AnimationControllerPrivate::fireEve
+     bool updateStyle = !m_eventsToDispatch.isEmpty() || !m_nodeChangesToDispatch.isEmpty();
+     
+     // fire all the events
+-    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
+-    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
++    Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
++    m_eventsToDispatch.clear();
++    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = eventsToDispatch.end();
++    for (Vector<EventToDispatch>::const_iterator it = eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
+         if (it->eventType == eventNames().webkitTransitionEndEvent)
+             it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
+         else
+             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
+     }
+     
+-    m_eventsToDispatch.clear();
+-    
+     // call setChanged on all the elements
+     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
+     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)

=== modified file 'debian/patches/series'
--- a/debian/patches/series	2011-02-06 12:07:09 +0000
+++ b/debian/patches/series	2011-02-11 14:36:05 +0000
@@ -52,3 +52,4 @@
 55831.patch
 59081.patch
 68244.patch
+67234.patch