Fix srcset selection bug when 'w' and src are present

Source/core/html/parser/HTMLSrcsetParser.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 146 matching lines @@
     }
 
     std::stable_sort(imageCandidates.begin(), imageCandidates.end(), compareByScaleFactor);
 
     unsigned i;
     for (i = 0; i < imageCandidates.size() - 1; ++i) {
         if ((imageCandidates[i].scaleFactor() >= deviceScaleFactor) && (!ignoreSrc || !imageCandidates[i].srcOrigin()))
             break;
     }
 
+    if (imageCandidates[i].srcOrigin() && ignoreSrc)
+        --i;

[eseidel, 2014/04/23 20:55:27]

And i is never 0 here? can't fall off the end of the array?

     float winningScaleFactor = imageCandidates[i].scaleFactor();
+
     unsigned winner = i;
     // 16. If an entry b in candidates has the same associated ... pixel density as an earlier entry a in candidates,
     // then remove entry b
     while ((i > 0) && (imageCandidates[--i].scaleFactor() == winningScaleFactor))
         winner = i;
 
     return imageCandidates[winner];
 }
 
 ImageCandidate bestFitSourceForSrcsetAttribute(float deviceScaleFactor, unsigned sourceSize, const String& srcsetAttribute)
@@ skipping 37 matching lines @@
     Vector<ImageCandidate> imageCandidates;
     imageCandidates.append(srcsetImageCandidate);
 
     if (!srcAttribute.isEmpty())
         imageCandidates.append(ImageCandidate(srcAttribute, 0, srcAttribute.length(), defaultResult, ImageCandidate::SrcOrigin));
 
     return pickBestImageCandidate(deviceScaleFactor, sourceSize, imageCandidates).toString();
 }
 
 }