[SCM] WebKit Debian packaging branch, webkit-1.1, updated. upstream/1.1.22-985-g3c00f00

[eric at webkit.org]

The following commit has been merged in the webkit-1.1 branch:
commit 81d89ff4f34458bb4538f81c5f286f305cd2d98b
Author: eric at webkit.org <eric at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Mar 3 02:37:14 2010 +0000

    2010-03-02  Evan Stade  <estade at chromium.org>
    
            Reviewed by David Levin.
    
            https://bugs.webkit.org/show_bug.cgi?id=35261
            [skia] crash when attempting to render certain SVGs with Skia
    
            This test passes if it doesn't crash.
    
            * svg/custom/tiling-regular-hexagonal-crash-expected.txt: Added.
            * svg/custom/tiling-regular-hexagonal-crash.svg: Added.
    2010-03-02  Evan Stade  <estade at chromium.org>
    
            Reviewed by David Levin.
    
            https://bugs.webkit.org/show_bug.cgi?id=35261
            [skia] crash when attempting to render certain SVGs
    
            This fixes the crash, but the SVG still doesn't render properly.
    
            Test: svg/custom/tiling-regular-hexagonal-crash.svg
    
            * platform/graphics/skia/ImageSkia.cpp:
            (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
            the copy fails; instead return a blank bitmap. The caller doesn't
            check for 0 before dereferencing.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55447 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 858c7d5..2f5f6a4 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-03-02  Evan Stade  <estade at chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs with Skia
+
+        This test passes if it doesn't crash.
+
+        * svg/custom/tiling-regular-hexagonal-crash-expected.txt: Added.
+        * svg/custom/tiling-regular-hexagonal-crash.svg: Added.
+
 2010-03-02  Arno Renevier  <arno at renevier.net>
 
         Reviewed by Gustavo Noronha Silva.
diff --git a/LayoutTests/svg/custom/tiling-regular-hexagonal-crash-expected.txt b/LayoutTests/svg/custom/tiling-regular-hexagonal-crash-expected.txt
new file mode 100644
index 0000000..81a1459
--- /dev/null
+++ b/LayoutTests/svg/custom/tiling-regular-hexagonal-crash-expected.txt
@@ -0,0 +1,2 @@
+PASS - didn't crash, bug 36231
+
diff --git a/LayoutTests/svg/custom/tiling-regular-hexagonal-crash.svg b/LayoutTests/svg/custom/tiling-regular-hexagonal-crash.svg
new file mode 100644
index 0000000..7d6f08d
--- /dev/null
+++ b/LayoutTests/svg/custom/tiling-regular-hexagonal-crash.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg id="Tiling_Regular_6_3_Hexagonal" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="400">
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  // Prevent insertion of any content into the document.
+  document.documentElement.addEventListener("DOMNodeInserted", function() {
+    var insertedNode = event.target;
+    insertedNode.parentNode.removeChild(insertedNode);
+  }, true);
+</script>
+
+<defs>
+   <polygon id="Hexagon" stroke="#000000" stroke-width="4" points="0,0 52,0 78,45 52,90 0,90 -26,45"/>
+
+   <g id="Hex_Group">
+      <use xlink:href="#Hexagon" transform="translate(-26)"/>
+      <use xlink:href="#Hexagon" transform="translate(130)"/>
+      <use xlink:href="#Hexagon" transform="translate(52, -135)"/>
+      <text x="10" y="30">PASS - didn't crash, bug 36231</text>
+   </g>
+   
+   <pattern id="Hex_Pattern" patternUnits="userSpaceOnUse" patternTransform="translate(4, 20) scale(0.5)" width="156" height=" 270">
+      <use xlink:href="#Hex_Group" fill="#99BBDD" transform="translate(0, 90) scale(1, -1)"/>
+      <use xlink:href="#Hex_Group" fill="#BB99DD" transform="translate(0, 90)"/>
+      <use xlink:href="#Hex_Group" fill="#DD99BB" transform="translate(0, 180)"/>
+      <use xlink:href="#Hexagon" fill="#BB99DD" transform="translate(52, 225)"/>
+   </pattern>
+   
+</defs>
+
+<rect x="2" y="2" height="394" width="394" stroke="#000000" stroke-width="2" fill="url(#Hex_Pattern)"/>
+
+</svg>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index aaa534b..8af6e27 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-03-02  Evan Stade  <estade at chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35261
+        [skia] crash when attempting to render certain SVGs
+
+        This fixes the crash, but the SVG still doesn't render properly.
+
+        Test: svg/custom/tiling-regular-hexagonal-crash.svg
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImageSingleFrameSkia::create): don't return 0 when
+        the copy fails; instead return a blank bitmap. The caller doesn't
+        check for 0 before dereferencing.
+
 2010-03-02  Arno Renevier  <arno at renevier.net>
 
         Reviewed by Gustavo Noronha Silva.
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index ba9f824..b1bfbdd 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -457,8 +457,7 @@ void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
 PassRefPtr<BitmapImageSingleFrameSkia> BitmapImageSingleFrameSkia::create(const SkBitmap& bitmap)
 {
     RefPtr<BitmapImageSingleFrameSkia> image(adoptRef(new BitmapImageSingleFrameSkia()));
-    if (!bitmap.copyTo(&image->m_nativeImage, bitmap.config()))
-        return 0;
+    bitmap.copyTo(&image->m_nativeImage, bitmap.config());
     return image.release();
 }
 

-- 
WebKit Debian packaging