Branch name: chromium-browser/chromium-browser.sid
Branch location : bzr+ssh://bzr.debian.org/bzr/pkg-chromium/chromium-browser/chromium-browser.sid
Browse location: http://bzr.debian.org/loggerhead/pkg-chromium
Revision No: 695
Revision Id: iuculano at debian.org-20110114104809-0a8svt797hwvyp0p
Committer: Giuseppe Iuculano <iuculano at debian.org>
Message : High Stale pointer with CSS + cursors. Credit to Jan Tošovský.
--------------------------------------------------------
** Added :
- debian/patches/66748.patch
** Modified :
- debian/changelog
- debian/patches/66560.patch
- debian/patches/series
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2011-01-14 10:00:37 +0000
+++ b/debian/changelog 2011-01-14 10:48:09 +0000
@@ -3,8 +3,9 @@
* Backported security patches from stable:
- High Bad pointer handling in node iteration. Credit to Sergey Glazunov.
- High Stale pointer with CSS + canvas. Credit to Sergey Glazunov.
+ - High Stale pointer with CSS + cursors. Credit to Jan Tošovský.
- -- Giuseppe Iuculano <iuculano at debian.org> Fri, 14 Jan 2011 10:59:47 +0100
+ -- Giuseppe Iuculano <iuculano at debian.org> Fri, 14 Jan 2011 11:47:25 +0100
chromium-browser (6.0.472.63~r59945-4) unstable; urgency=high
=== modified file 'debian/patches/66560.patch'
--- a/debian/patches/66560.patch 2011-01-14 10:00:37 +0000
+++ b/debian/patches/66560.patch 2011-01-14 10:48:09 +0000
@@ -9,17 +9,16 @@
}
String CSSCanvasValue::cssText() const
-@@ -62,8 +62,7 @@ void CSSCanvasValue::canvasResized(HTMLC
- void CSSCanvasValue::canvasDestroyed(HTMLCanvasElement* element)
+@@ -63,7 +63,7 @@ void CSSCanvasValue::canvasDestroyed(HTM
{
ASSERT(element == m_element);
-- if (element == m_element)
+ if (element == m_element)
- m_element = 0;
-+ m_element = 0;
++ m_element = 0;
}
IntSize CSSCanvasValue::fixedSize(const RenderObject* renderer)
-@@ -79,7 +78,7 @@ HTMLCanvasElement* CSSCanvasValue::eleme
+@@ -79,7 +79,7 @@ HTMLCanvasElement* CSSCanvasValue::eleme
m_element = document->getCSSCanvasElement(m_name);
if (!m_element)
return 0;
=== added file 'debian/patches/66748.patch'
--- a/debian/patches/66748.patch 1970-01-01 00:00:00 +0000
+++ b/debian/patches/66748.patch 2011-01-14 10:48:09 +0000
@@ -0,0 +1,33 @@
+--- a/src/third_party/WebKit/WebCore/css/CSSCursorImageValue.cpp
++++ b/src/third_party/WebKit/WebCore/css/CSSCursorImageValue.cpp
+@@ -70,7 +70,7 @@ CSSCursorImageValue::~CSSCursorImageValu
+
+ for (; it != end; ++it) {
+ SVGElement* referencedElement = *it;
+- referencedElement->cursorElementRemoved();
++ referencedElement->cursorImageValueRemoved();
+ if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(url, referencedElement->document()))
+ cursorElement->removeClient(referencedElement);
+ }
+--- a/src/third_party/WebKit/WebCore/svg/SVGElement.cpp
++++ b/src/third_party/WebKit/WebCore/svg/SVGElement.cpp
+@@ -207,7 +207,7 @@ void SVGElement::setCursorImageValue(CSS
+ rareData->setCursorImageValue(cursorImageValue);
+ }
+
+-void SVGElement::cursorImageElementRemoved()
++void SVGElement::cursorImageValueRemoved()
+ {
+ ASSERT(hasRareSVGData());
+ rareSVGData()->setCursorImageValue(0);
+--- a/src/third_party/WebKit/WebCore/svg/SVGElement.h
++++ b/src/third_party/WebKit/WebCore/svg/SVGElement.h
+@@ -79,7 +79,7 @@ namespace WebCore {
+ void setCursorElement(SVGCursorElement*);
+ void cursorElementRemoved();
+ void setCursorImageValue(CSSCursorImageValue*);
+- void cursorImageElementRemoved();
++ void cursorImageValueRemoved();
+
+ virtual void updateAnimatedSVGAttribute(const QualifiedName&) const;
+
=== modified file 'debian/patches/series'
--- a/debian/patches/series 2011-01-14 10:00:37 +0000
+++ b/debian/patches/series 2011-01-14 10:48:09 +0000
@@ -43,3 +43,4 @@
64959.patch
65764.patch
66560.patch
+66748.patch