Fix two srcset related bugs

Source/core/html/parser/HTMLSrcsetParser.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 33 matching lines @@
 template<typename CharType>
 inline bool isComma(CharType character)
 {
     return character == ',';
 }
 
 template<typename CharType>
 static bool parseDescriptors(const CharType* descriptorsStart, const CharType* descriptorsEnd, float& imgScaleFactor)
 {
     const CharType* position = descriptorsStart;
-    bool isValid = true;
-    bool isScaleFactorFound = false;
+    bool isValid = false;
+    bool isFoundScaleFactor = false;
+    bool isEmptyDescriptor = !(descriptorsEnd > descriptorsStart);
     while (position < descriptorsEnd) {
         // 13.1. Let descriptor list be the result of splitting unparsed descriptors on spaces.
         skipWhile<CharType, isHTMLSpace<CharType> >(position, descriptorsEnd);
         const CharType* currentDescriptorStart = position;
         skipWhile<CharType, isNotHTMLSpace<CharType> >(position, descriptorsEnd);
         const CharType* currentDescriptorEnd = position;
 
         ++position;
         ASSERT(currentDescriptorEnd > currentDescriptorStart);
         --currentDescriptorEnd;
         unsigned descriptorLength = currentDescriptorEnd - currentDescriptorStart;
         if (*currentDescriptorEnd == 'x') {
-            if (isScaleFactorFound)
+            if (isFoundScaleFactor)
                 return false;
             imgScaleFactor = charactersToFloat(currentDescriptorStart, descriptorLength, &isValid);
-            isScaleFactorFound = true;
+            isFoundScaleFactor = true;
         } else {
             continue;
         }
     }
-    return isValid;
+    return isEmptyDescriptor || isValid;
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/embedded-content-1.html#processing-the-image-candidates
 template<typename CharType>
 static void parseImageCandidatesFromSrcsetAttribute(const String& attribute, const CharType* attributeStart, unsigned length, Vector<ImageCandidate>& imageCandidates)
 {
     const CharType* position = attributeStart;
     const CharType* attributeEnd = position + length;
 
     while (position < attributeEnd) {
@@ skipping 44 matching lines @@
 }
 
 static ImageCandidate pickBestImageCandidate(float deviceScaleFactor, Vector<ImageCandidate>& imageCandidates)
 {
     if (imageCandidates.isEmpty())
         return ImageCandidate();
 
     std::stable_sort(imageCandidates.begin(), imageCandidates.end(), compareByScaleFactor);
 
     unsigned i;
-    for (i = 0; i < imageCandidates.size() - 1; ++i) {
+    for (i = 0; i < imageCandidates.size() - 1; ++i)
         if (imageCandidates[i].scaleFactor() >= deviceScaleFactor)
             break;
-    }
-    return imageCandidates[i];
+
+    float winningScaleFactor = imageCandidates[i].scaleFactor();
+    unsigned winner = i;
+    // 16. If an entry b in candidates has the same associated ... pixel density as an earlier entry a in candidates,
+    // then remove entry b
+    while ((i > 0) && (imageCandidates[--i].scaleFactor() == winningScaleFactor))
+        winner = i;
+
+    return imageCandidates[winner];
 }
 
 ImageCandidate bestFitSourceForSrcsetAttribute(float deviceScaleFactor, const String& srcsetAttribute)
 {
     Vector<ImageCandidate> imageCandidates;
 
     parseImageCandidatesFromSrcsetAttribute(srcsetAttribute, imageCandidates);
 
     return pickBestImageCandidate(deviceScaleFactor, imageCandidates);
 }
@@ skipping 24 matching lines @@
     Vector<ImageCandidate> imageCandidates;
     imageCandidates.append(srcsetImageCandidate);
 
     if (!srcAttribute.isEmpty())
         imageCandidates.append(ImageCandidate(srcAttribute, 0, srcAttribute.length(), 1.0));
 
     return pickBestImageCandidate(deviceScaleFactor, imageCandidates).toString();
 }
 
 }