Merge 59950 - WebCore: Fix for <rdar://problem/8009118> Crash in WebCore::toA...

WebCore/ChangeLog

Index: WebCore/ChangeLog
===================================================================
--- WebCore/ChangeLog	(revision 48098)
+++ WebCore/ChangeLog	(working copy)
@@ -1,3 +1,20 @@
+2010-05-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 
+        while running MangleMe
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=39508
+
+        The math was slightly off here, and we wound up trying to access an 
+        array at index -1 in some cases. We need to decrement numberShadow 
+        rather than subtracting one from the result of the modulo 
+        operation.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabeticOrNumeric):
+
 2010-05-10  Alexey Proskuryakov  <ap@apple.com>
 
         Reviewed by Darin Adler.