[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.20-204-g221d8e8

[eric at webkit.org]

The following commit has been merged in the webkit-1.1 branch:
commit e8f1849bd158e341fb716244bfb63174f315272e
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Feb 3 05:22:13 2010 +0000

    2010-02-02  Kent Tamura  <tkent at chromium.org>
    
            Reviewed by Darin Adler.
    
            rangeOverflow/rangeUnderflow support for type=datetime, datetime-local,
            month, time and week
            https://bugs.webkit.org/show_bug.cgi?id=34483
    
            Add tests for datetime, datetime-local, month, time and week, and
            merge existing tests into one test file.
    
            * fast/forms/ValidityState-rangeOverflow-date-expected.txt: Removed.
            * fast/forms/ValidityState-rangeOverflow-date.html: Removed.
            * fast/forms/ValidityState-rangeOverflow-expected.txt: Added.
            * fast/forms/ValidityState-rangeOverflow-number-expected.txt: Removed.
            * fast/forms/ValidityState-rangeOverflow-number.html: Removed.
            * fast/forms/ValidityState-rangeOverflow-range-expected.txt: Removed.
            * fast/forms/ValidityState-rangeOverflow-range.html: Removed.
            * fast/forms/ValidityState-rangeOverflow.html: Added.
            * fast/forms/ValidityState-rangeUnderflow-date-expected.txt: Removed.
            * fast/forms/ValidityState-rangeUnderflow-date.html: Removed.
            * fast/forms/ValidityState-rangeUnderflow-expected.txt: Added.
            * fast/forms/ValidityState-rangeUnderflow-number-expected.txt: Removed.
            * fast/forms/ValidityState-rangeUnderflow-number.html: Removed.
            * fast/forms/ValidityState-rangeUnderflow-range-expected.txt: Removed.
            * fast/forms/ValidityState-rangeUnderflow-range.html: Removed.
            * fast/forms/ValidityState-rangeUnderflow.html: Added.
            * fast/forms/script-tests/ValidityState-rangeOverflow-date.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeOverflow-number.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeOverflow-range.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeOverflow.js: Added.
            * fast/forms/script-tests/ValidityState-rangeUnderflow-date.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeUnderflow-number.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeUnderflow-range.js: Removed.
            * fast/forms/script-tests/ValidityState-rangeUnderflow.js: Added.
    2010-02-02  James Robinson  <jamesr at chromium.org>
    
            Reviewed by Dmitry Titov.
    
            Add a null check for image, which might be NULL if tileSize is empty
            https://bugs.webkit.org/show_bug.cgi?id=34510
    
            Test: fast/gradients/crash-on-1px-border.html
    
            * rendering/RenderBoxModelObject.cpp:
            (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54272 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 915442c..53f0efb 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -34,8 +34,16 @@
         * fast/forms/script-tests/ValidityState-rangeUnderflow-range.js: Removed.
         * fast/forms/script-tests/ValidityState-rangeUnderflow.js: Added.
 
-2010-02-02  Fumitoshi Ukai  <ukai at chromium.org>
+2010-02-02  James Robinson  <jamesr at chromium.org>
 
+        Reviewed by Dmitry Titov.
+
+        Test that the combination of border-bottom:1px; and -webkit-gradient(linear) doesn't crash
+        https://bugs.webkit.org/show_bug.cgi?id=34510
+
+        * fast/gradients/crash-on-1px-border.html: Added.
+
+2010-02-02  Fumitoshi Ukai  <ukai at chromium.org> 
         Reviewed by Alexey Proskuryakov.
 
         WebSocket wrapper can be collected even if events are pending
diff --git a/LayoutTests/fast/gradients/crash-on-1px-border-expected.txt b/LayoutTests/fast/gradients/crash-on-1px-border-expected.txt
new file mode 100644
index 0000000..0ccb964
--- /dev/null
+++ b/LayoutTests/fast/gradients/crash-on-1px-border-expected.txt
@@ -0,0 +1,3 @@
+Linear gradient with 1px border-bottom. Should not crash
+
+
diff --git a/LayoutTests/fast/gradients/crash-on-1px-border.html b/LayoutTests/fast/gradients/crash-on-1px-border.html
new file mode 100644
index 0000000..a63c049
--- /dev/null
+++ b/LayoutTests/fast/gradients/crash-on-1px-border.html
@@ -0,0 +1,15 @@
+<head>
+<style>
+.thin {
+  border-bottom: 1px solid;
+  background: -webkit-gradient(linear, 0% 100%, 0% 100%, from(red), to(blue))
+}
+</style>
+<script>
+if (window.layoutTestController)
+  window.layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<h1>Linear gradient with 1px border-bottom. Should not crash</h1>
+<div class="thin"></div>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ec91bed..fed205d 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-02-02  James Robinson  <jamesr at chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add a null check for image, which might be NULL if tileSize is empty
+        https://bugs.webkit.org/show_bug.cgi?id=34510
+
+        Test: fast/gradients/crash-on-1px-border.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality):
+
 2010-02-02  Kent Tamura  <tkent at chromium.org>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index f2cd9bd..a68c930 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -118,7 +118,7 @@ bool RenderBoxModelScaleObserver::shouldPaintBackgroundAtLowQuality(GraphicsCont
 {
     // If the image is not a bitmap image, then none of this is relevant and we just paint at high
     // quality.
-    if (!image->isBitmapImage())
+    if (!image || !image->isBitmapImage())
         return false;
 
     // Make sure to use the unzoomed image size, since if a full page zoom is in effect, the image

-- 
WebKit Debian packaging