Merge 53291 - WebCore: Fix for crash with gradient on table cell. Pass the c...

Merge 53291 - WebCore: Fix for crash with gradient on table cell.  Pass the correct
background object down to
RenderBoxModelObject::paintFillLayerExtended().  This also allowed a
rework of the fix to bug 18445 by passing the correct RenderObject
from RenderBox::paintRootBoxDecorations() down to
RenderBoxModelObject::paintFillLayerExtended().
https://bugs.webkit.org/show_bug.cgi?id=28426

Reviewed by mitz@webkit.org.

Covered by new layout test:  LayoutTests/fast/gradients/crashontr.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::paintFillLayers):
(WebCore::RenderBox::paintFillLayer):
* rendering/RenderBox.h:
Plumb through the correct background RenderObject.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
Use the passedin background RenderObject (if present) when painting background images.  Remove the previous fix for bug 18445.
* rendering/RenderBoxModelObject.h:
Plumb through the correct background RenderObject.
* rendering/RenderTableCell.cpp:
Pass in the correct backgroundObject to paintFillLayers().

(WebCore::RenderTableCell::paintBackgroundsBehindCell):

LayoutTests: New layout test added to exercise fix for bug
http://bugs.webkit.org/show_bug.cgi?id=28426 

Reviewed by mitz@webkit.org.

* fast/gradients/crashontrexpected.txt: Added.
* fast/gradients/crashontr.html: Added.



TBR=senorblanco@chromium.org

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=37128

[Stephen White, 2010-01-26 19:18:14]

LGTM