chromium-browser (6.0.472.63~r59945-5+squeeze6) CVE-2011-2359.patch

--- a/src/third_party/WebKit/WebCore/rendering/RenderBlock.cpp
+++ b/src/third_party/WebKit/WebCore/rendering/RenderBlock.cpp
@@ -1720,7 +1720,8 @@ void RenderBlock::layoutBlockChildren(bo
                         break;
                 }
             }
-        }
+        } else if (parent())
+            parent()->dirtyLinesFromChangedChild(this);
     }
 
     int top = borderTop() + paddingTop();
--- a/src/third_party/WebKit/WebCore/rendering/RenderReplaced.cpp
+++ b/src/third_party/WebKit/WebCore/rendering/RenderReplaced.cpp
@@ -55,6 +55,14 @@ RenderReplaced::~RenderReplaced()
 {
 }
 
+void RenderReplaced::destroy()
+{
+    if (!documentBeingDestroyed() && parent())
+        parent()->dirtyLinesFromChangedChild(this);
+
+    RenderBox::destroy();
+}
+
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
--- a/src/third_party/WebKit/WebCore/rendering/RenderReplaced.h
+++ b/src/third_party/WebKit/WebCore/rendering/RenderReplaced.h
@@ -32,6 +32,8 @@ public:
     RenderReplaced(Node*, const IntSize& intrinsicSize);
     virtual ~RenderReplaced();
 
+    virtual void destroy();
+
 protected:
     virtual void layout();
 
--- a/src/third_party/WebKit/WebCore/rendering/RenderWidget.cpp
+++ b/src/third_party/WebKit/WebCore/rendering/RenderWidget.cpp
@@ -125,6 +125,10 @@ void RenderWidget::destroy()
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
     }
+
+    if (!documentBeingDestroyed() && parent()) 
+        parent()->dirtyLinesFromChangedChild(this);
+
     remove();
 
     if (m_hasCounterNodeMap)