Fix srcset selection bug when 'w' and src are present

Source/core/html/parser/HTMLSrcsetParser.cpp

Index: Source/core/html/parser/HTMLSrcsetParser.cpp
diff --git a/Source/core/html/parser/HTMLSrcsetParser.cpp b/Source/core/html/parser/HTMLSrcsetParser.cpp
index eec44809b23097c7faf8eb94c62c4a2969a58f2b..971e77ee3f68dfa0fcd4441271f3365919f87da4 100644
--- a/Source/core/html/parser/HTMLSrcsetParser.cpp
+++ b/Source/core/html/parser/HTMLSrcsetParser.cpp
@@ -164,7 +164,10 @@ static ImageCandidate pickBestImageCandidate(float deviceScaleFactor, unsigned s
             break;
     }
 
+    if (imageCandidates[i].srcOrigin() && ignoreSrc)
+        --i;

[eseidel, 2014/04/23 20:55:27]

And i is never 0 here? can't fall off the end of the array?

     float winningScaleFactor = imageCandidates[i].scaleFactor();
+
     unsigned winner = i;
     // 16. If an entry b in candidates has the same associated ... pixel density as an earlier entry a in candidates,
     // then remove entry b