1 files changed, 73 insertions, 0 deletions
diff --git a/www/seamonkey/files/patch-bug975397 b/www/seamonkey/files/patch-bug975397
new file mode 100644
index 000000000000..69e87cef0dc3
--- /dev/null
+++ b/www/seamonkey/files/patch-bug975397
@@ -0,0 +1,73 @@
+commit 2fe45fb
+Author: L. David Baron <dbaron@dbaron.org>
+Date:   Wed Apr 2 22:56:19 2014 -0700
+
+    Bug 975397 - Call TrackImage when constructing a new nsStyleBorder.  r=heycam
+    
+    I confirmed that the crashtest crashes in the harness without the patch.
+    
+    --HG--
+    rename : layout/reftests/backgrounds/blue-32x32.png => layout/style/crashtests/blue-32x32.png
+---
+ layout/base/nsCSSRendering.cpp                         |   9 +++++++++
+ layout/style/crashtests/blue-32x32.png                 | Bin 0 -> 110 bytes
+ layout/style/crashtests/border-image-visited-link.html |  10 ++++++++++
+ layout/style/crashtests/crashtests.list                |   1 +
+ 4 files changed, 20 insertions(+)
+
+diff --git layout/base/nsCSSRendering.cpp layout/base/nsCSSRendering.cpp
+index d91309b..2d8bb46 100644
+--- mozilla/layout/base/nsCSSRendering.cpp
++++ mozilla/layout/base/nsCSSRendering.cpp
+@@ -419,6 +419,10 @@ nsCSSRendering::PaintBorder(nsPresContext* aPresContext,
+   }
+ 
+   nsStyleBorder newStyleBorder(*styleBorder);
++  // We could do something fancy to avoid the TrackImage/UntrackImage
++  // work, but it doesn't seem worth it.  (We need to call TrackImage
++  // since we're not going through nsRuleNode::ComputeBorderData.)
++  newStyleBorder.TrackImage(aPresContext);
+ 
+   NS_FOR_CSS_SIDES(side) {
+     newStyleBorder.SetBorderColor(side,
+@@ -428,6 +432,11 @@ nsCSSRendering::PaintBorder(nsPresContext* aPresContext,
+   PaintBorderWithStyleBorder(aPresContext, aRenderingContext, aForFrame,
+                              aDirtyRect, aBorderArea, newStyleBorder,
+                              aStyleContext, aSkipSides);
++
++  // We could do something fancy to avoid the TrackImage/UntrackImage
++  // work, but it doesn't seem worth it.  (We need to call UntrackImage
++  // since we're not going through nsStyleBorder::Destroy.)
++  newStyleBorder.UntrackImage(aPresContext);
+ }
+ 
+ void
+diff --git layout/style/crashtests/blue-32x32.png layout/style/crashtests/blue-32x32.png
+new file mode 100644
+index 0000000..deefd19
+Binary files /dev/null and layout/style/crashtests/blue-32x32.png differ
+diff --git layout/style/crashtests/border-image-visited-link.html layout/style/crashtests/border-image-visited-link.html
+new file mode 100644
+index 0000000..b6e3ae5
+--- /dev/null
++++ mozilla/layout/style/crashtests/border-image-visited-link.html
+@@ -0,0 +1,10 @@
++<!DOCTYPE HTML>
++<title>border-image on link with visited styles</title>
++<style>
++
++:link { color: blue }
++:visited { color: purple }
++:link, :visited { border: medium solid; border-image: url(blue-32x32.png) 4 4 4 4; }
++
++</style>
++<a href="http://example.com/">test</a>
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index e414f28..acd709c3 100644
+--- mozilla/layout/style/crashtests/crashtests.list
++++ mozilla/layout/style/crashtests/crashtests.list
+@@ -102,3 +102,4 @@ load 930270-1.html
+ load 930270-2.html
+ load 945048-1.html
+ load 989965-1.html
++load border-image-visited-link.html