[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.1.15-1-40151-g37bb677

[darin]

The following commit has been merged in the debian/unstable branch:
commit 925e84a953bd6c0d2c138bca834e1e48e73237db
Author: darin <darin at 268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Mar 21 22:09:04 2003 +0000

            Reviewed by John.
    
            - fixed 3203212 -- nil-deref in khtml::CachedImage::isErrorImage at turbotax.com
    
            * khtml/xml/dom_docimpl.cpp: (DocumentImpl::removeImage): Remove all occurrences
            of the image from the list. We don't try to prevent multiple occurrences from getting
            in there. Also use removeRef instead of remove, for speed.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@3895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2003-10-25 b/WebCore/ChangeLog-2003-10-25
index a0ab98e..68e05c1 100644
--- a/WebCore/ChangeLog-2003-10-25
+++ b/WebCore/ChangeLog-2003-10-25
@@ -2,6 +2,16 @@
 
         Reviewed by John.
 
+        - fixed 3203212 -- nil-deref in khtml::CachedImage::isErrorImage at turbotax.com
+
+        * khtml/xml/dom_docimpl.cpp: (DocumentImpl::removeImage): Remove all occurrences
+        of the image from the list. We don't try to prevent multiple occurrences from getting
+        in there. Also use removeRef instead of remove, for speed.
+
+2003-03-21  Darin Adler  <darin at apple.com>
+
+        Reviewed by John.
+
         - fixed 3204660 -- EUC decoding not used for japanese yahoo page
 
         * khtml/misc/decoder.cpp: (Decoder::decode):
diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index a0ab98e..68e05c1 100644
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -2,6 +2,16 @@
 
         Reviewed by John.
 
+        - fixed 3203212 -- nil-deref in khtml::CachedImage::isErrorImage at turbotax.com
+
+        * khtml/xml/dom_docimpl.cpp: (DocumentImpl::removeImage): Remove all occurrences
+        of the image from the list. We don't try to prevent multiple occurrences from getting
+        in there. Also use removeRef instead of remove, for speed.
+
+2003-03-21  Darin Adler  <darin at apple.com>
+
+        Reviewed by John.
+
         - fixed 3204660 -- EUC decoding not used for japanese yahoo page
 
         * khtml/misc/decoder.cpp: (Decoder::decode):
diff --git a/WebCore/khtml/xml/dom_docimpl.cpp b/WebCore/khtml/xml/dom_docimpl.cpp
index 676e8dd..1b93e62 100644
--- a/WebCore/khtml/xml/dom_docimpl.cpp
+++ b/WebCore/khtml/xml/dom_docimpl.cpp
@@ -2170,8 +2170,10 @@ void DocumentImpl::dispatchImageLoadEventSoon(RenderImage *image)
 
 void DocumentImpl::removeImage(RenderImage *image)
 {
-    m_imageLoadEventDispatchSoonList.remove(image);
-    m_imageLoadEventDispatchingList.remove(image);
+    // Remove instances of this image from both lists.
+    // Use loops because we allow multiple instances to get into the lists.
+    while (m_imageLoadEventDispatchSoonList.removeRef(image)) { }
+    while (m_imageLoadEventDispatchingList.removeRef(image)) { }
     if (m_imageLoadEventDispatchSoonList.isEmpty() && m_imageLoadEventTimer) {
         killTimer(m_imageLoadEventTimer);
         m_imageLoadEventTimer = 0;

-- 
WebKit Debian packaging