Merge 59950 - WebCore: Fix for <rdar://problem/8009118> Crash in WebCore::toA...

WebCore/rendering/RenderListMarker.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  * Copyright (C) 2010 Daniel Bates (dbates@intudata.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 83 matching lines @@
         ASSERT(number > 0);
         --numberShadow;
     } else if (number < 0) {
         numberShadow = -number;
         isNegativeNumber = true;
     }
     letters[lettersSize - 1] = sequence[numberShadow % sequenceSize];
     int length = 1;
 
     if (type == AlphabeticSequence) {
-        while ((numberShadow /= sequenceSize) > 0)
-            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1];
+        while ((numberShadow /= sequenceSize) > 0) {
+            --numberShadow;
+            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
+        }
     } else {
         while ((numberShadow /= sequenceSize) > 0)
             letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
     }
     if (isNegativeNumber)
         letters[lettersSize - ++length] = hyphenMinus;
 
     ASSERT(length <= lettersSize);
     return String(&letters[lettersSize - length], length);
 }
@@ skipping 1395 matching lines @@
             
     if (clipToVisibleContent)
         computeRectForRepaint(repaintContainer, rect);
     else
         rect = localToContainerQuad(FloatRect(rect), repaintContainer).enclosingBoundingBox();
     
     return rect;
 }
 
 } // namespace WebCore