[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

[simon.fraser at apple.com]

The following commit has been merged in the webkit-1.2 branch:
commit 234582889deaf2033bebca1bfe16678ad4980e04
Author: simon.fraser at apple.com <simon.fraser at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Nov 25 00:24:57 2009 +0000

    2009-11-24  Simon Fraser  <simon.fraser at apple.com>
    
            Reviewed by Oliver Hunt.
    
            SVGUseElement::toClipPath can crash
            <rdar://problem/7385270>
    
            Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
            actually initialize it.
    
            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::toClipPath):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51366 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 49c00a8..d01ebf0 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -66,6 +66,19 @@
 
 2009-11-24  Simon Fraser  <simon.fraser at apple.com>
 
+        Reviewed by Oliver Hunt.
+
+        SVGUseElement::toClipPath can crash
+        <rdar://problem/7385270>
+
+        Null-test m_shadowTreeRootElement again, because the call to buildPendingResource() may not
+        actually initialize it.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+
+2009-11-24  Simon Fraser  <simon.fraser at apple.com>
+
         Windows build fix.
 
         * page/win/FrameCGWin.cpp:
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 699479f..a566992 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -444,6 +444,9 @@ Path SVGUseElement::toClipPath() const
     if (!m_shadowTreeRootElement)
         const_cast<SVGUseElement*>(this)->buildPendingResource();
 
+    if (!m_shadowTreeRootElement)
+        return Path();
+
     Node* n = m_shadowTreeRootElement->firstChild();
     if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
         if (!isDirectReference(n))

-- 
WebKit Debian packaging