[Pkg-chromium-commit] chromium-browser/chromium-browser.squeeze: 728 [73746] High Stale pointer with SVG cursors. Credit to Sergey Glazunov.

[Giuseppe Iuculano]

Branch name: chromium-browser/chromium-browser.squeeze
Branch location : bzr+ssh://bzr.debian.org/bzr/pkg-chromium/chromium-browser/chromium-browser.squeeze
Browse location: http://bzr.debian.org/loggerhead/pkg-chromium
Revision No: 728
Revision Id: iuculano at debian.org-20110306194026-ot23q9fcww54ak68
Committer: Giuseppe Iuculano <iuculano at debian.org>
Message : [73746] High Stale pointer with SVG cursors. Credit to Sergey Glazunov.


--------------------------------------------------------
  ** Added :
        - debian/patches/73746.patch

  ** Modified :
        - debian/changelog
        - debian/patches/series

-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog	2011-03-06 19:23:41 +0000
+++ b/debian/changelog	2011-03-06 19:40:26 +0000
@@ -22,8 +22,9 @@
     - [70336] Medium Cross-origin error message leak with workers.
       Credit to Daniel Divricean.
     - [72028] High Stale pointer in table painting. Credit to Martin Barbella.
+    - [73746] High Stale pointer with SVG cursors. Credit to Sergey Glazunov.
 
- -- Giuseppe Iuculano <iuculano at debian.org>  Sun, 06 Mar 2011 20:22:48 +0100
+ -- Giuseppe Iuculano <iuculano at debian.org>  Sun, 06 Mar 2011 20:39:33 +0100
 
 chromium-browser (6.0.472.63~r59945-5+squeeze2) stable-security; urgency=high
 

=== added file 'debian/patches/73746.patch'
--- a/debian/patches/73746.patch	1970-01-01 00:00:00 +0000
+++ b/debian/patches/73746.patch	2011-03-06 19:40:26 +0000
@@ -0,0 +1,16 @@
+--- a/src/third_party/WebKit/WebCore/svg/SVGCursorElement.cpp
++++ b/src/third_party/WebKit/WebCore/svg/SVGCursorElement.cpp
+@@ -73,8 +73,11 @@ void SVGCursorElement::addClient(SVGElem
+ 
+ void SVGCursorElement::removeClient(SVGElement* element)
+ {
+-    m_clients.remove(element);
+-    element->cursorElementRemoved();
++    HashSet<SVGElement*>::iterator it = m_clients.find(element);
++    if (it != m_clients.end()) {
++        m_clients.remove(it);
++        element->cursorElementRemoved();
++    }
+ }
+ 
+ void SVGCursorElement::removeReferencedElement(SVGElement* element)

=== modified file 'debian/patches/series'
--- a/debian/patches/series	2011-03-06 19:23:41 +0000
+++ b/debian/patches/series	2011-03-06 19:40:26 +0000
@@ -70,3 +70,4 @@
 70027.patch
 70336.patch
 72028.patch
+73746.patch