[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[rolandsteiner at chromium.org]

The following commit has been merged in the debian/experimental branch:
commit 75715e3e5a4b147bc0e020bb32b99cd7442a7098
Author: rolandsteiner at chromium.org <rolandsteiner at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Nov 5 09:42:42 2010 +0000

    2010-11-05  Roland Steiner  <rolandsteiner at chromium.org>
    
            Reviewed by Dirk Schulze.
    
            Bug 48979 - [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac
            https://bugs.webkit.org/show_bug.cgi?id=48979
    
            Remove Chromium expectation entry.
    
            * platform/chromium/test_expectations.txt:
    2010-11-05  Roland Steiner  <rolandsteiner at chromium.org>
    
            Reviewed by Dirk Schulze.
    
            Bug 48979 - [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac
            https://bugs.webkit.org/show_bug.cgi?id=48979
    
            Function removeItemValuesAndWrappers(): Move code out of 'if' statement so that
            'wrappers' and 'values' stay synced.
    
            test: svg/dom/baseVal-animVal-crash.html doesn't ASSERT
    
            * svg/properties/SVGListProperty.h:
            (WebCore::SVGListProperty::removeItemValuesAndWrappers):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@71399 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3285c4a..0ebf155 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-11-05  Roland Steiner  <rolandsteiner at chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Bug 48979 - [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48979
+
+        Remove Chromium expectation entry.
+
+        * platform/chromium/test_expectations.txt:
+
 2010-11-05  Fumitoshi Ukai  <ukai at chromium.org>
 
         Unreviewed, updating Chromium expectations.
diff --git a/LayoutTests/platform/chromium/test_expectations.txt b/LayoutTests/platform/chromium/test_expectations.txt
index 75a99a7..ac241bc 100644
--- a/LayoutTests/platform/chromium/test_expectations.txt
+++ b/LayoutTests/platform/chromium/test_expectations.txt
@@ -3389,9 +3389,6 @@ BUG61824 : canvas/philip/tests/2d.pattern.image.string.html = TEXT
 // Test added in WK r71288 crashes on Windows and Linux
 BUG48973 WIN LINUX : editing/style/iframe-onload-crash.html = CRASH
 
-// started to ASSERT somewhere between WebKit r71224 and r71305
-BUG48979 WIN MAC DEBUG : svg/dom/baseVal-animVal-crash.html = CRASH
-
 // Added in r71317
 BUG61978 WIN MAC : svg/animations/animate-path-nested-transforms.html = CRASH PASS
 
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 25f135b..97d783d 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2010-11-05  Roland Steiner  <rolandsteiner at chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        Bug 48979 - [Chromium] SVGListPropertyTearOff.h: function commitChange ASSERTs on Win & Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48979
+
+        Function removeItemValuesAndWrappers(): Move code out of 'if' statement so that
+        'wrappers' and 'values' stay synced.
+
+        test: svg/dom/baseVal-animVal-crash.html doesn't ASSERT
+
+        * svg/properties/SVGListProperty.h:
+        (WebCore::SVGListProperty::removeItemValuesAndWrappers):
+
 2010-11-05  John Reck  <jreck at google.com>
 
         Reviewed by Nikolas Zimmermann.
diff --git a/WebCore/svg/properties/SVGListProperty.h b/WebCore/svg/properties/SVGListProperty.h
index 8cdbfd0..7edc0f1 100644
--- a/WebCore/svg/properties/SVGListProperty.h
+++ b/WebCore/svg/properties/SVGListProperty.h
@@ -337,11 +337,10 @@ public:
 
         // Detach the existing wrapper.
         RefPtr<ListItemTearOff>& oldItem = wrappers.at(index);
-        if (oldItem) {
+        if (oldItem)
             oldItem->detachWrapper();
-            wrappers.remove(index);
-        }
 
+        wrappers.remove(index);
         values.remove(index);
 
         commitChange();

-- 
WebKit Debian packaging