add patches from upstream, mostly fixing pointer handling isses

which can lead to crashes and possibly code injection
(cve-2010-4205, cve-2011-0471, cve-2011-0473, cve-2011-0478,
 cve-2011-0981, cve-2011-0982)
bump PKGREV

19 files changed, 433 insertions, 3 deletions

diff --git a/www/webkit-gtk/Makefile b/www/webkit-gtk/Makefile
index c27236c6801..3a8bc13c602 100644
--- a/www/webkit-gtk/Makefile
+++ b/www/webkit-gtk/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.39 2011/04/13 16:19:14 drochner Exp $
+# $NetBSD: Makefile,v 1.40 2011/04/14 18:11:45 drochner Exp $
 
 DISTNAME=	webkit-1.2.7
 PKGNAME=	${DISTNAME:S/webkit/webkit-gtk/}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	www
 MASTER_SITES=	http://www.webkitgtk.org/
 
diff --git a/www/webkit-gtk/distinfo b/www/webkit-gtk/distinfo
index 1139f68e1d4..d7d5b84ae79 100644
--- a/www/webkit-gtk/distinfo
+++ b/www/webkit-gtk/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.33 2011/04/13 16:19:14 drochner Exp $
+$NetBSD: distinfo,v 1.34 2011/04/14 18:11:45 drochner Exp $
 
 SHA1 (webkit-1.2.7.tar.gz) = e9afc573d2459794c3749ba404f2187f9dcc9ed3
 RMD160 (webkit-1.2.7.tar.gz) = f36b3ae05693e0eeb4d1936ceee52b6fe1517e57
@@ -12,3 +12,20 @@ SHA1 (patch-ba) = 6caffef625e9c04e971fbbd0763b4f9c834491e3
 SHA1 (patch-bb) = 5e59576629e9ecfbbe576c3d0afe047bda449291
 SHA1 (patch-bc) = 0d6d3e2e2f5b2d199aaa94084f9d5a96b39c2708
 SHA1 (patch-bd) = 2e105ade29ff04cdcb5385d19aee467090b6765a
+SHA1 (patch-ca) = c3a8367582064a66d9b30486449d80571062c950
+SHA1 (patch-cb) = 1d106ae16375e7812078bdcacaed1c18ba75c5f1
+SHA1 (patch-cc) = d552f68d28a8ac6e3af795e99dd7f90617a57f5c
+SHA1 (patch-cd) = 1d7664fef8a9158ba71d49cd771d6b55e685b29e
+SHA1 (patch-ce) = 36c174a7a085fdfedd3dc8e06363bda3ba4aa96e
+SHA1 (patch-cf) = d011ace602c71a3063d6d2db70260b87142a6b20
+SHA1 (patch-cg) = 463f851254e78ae51496706f0c139fd39ebb761e
+SHA1 (patch-ch) = 856a4788273ed0ed8f7151634313d6898696490a
+SHA1 (patch-ci) = d0bc0a61725d319e985606ca751affe5a0c9b0ea
+SHA1 (patch-cj) = bc1a1ce7e9d32c074817abde9dffe646a6c19d78
+SHA1 (patch-ck) = 675cb023883b2afeaa850cb5bd087cc37d241ca7
+SHA1 (patch-cl) = 4188b727b9517a6d34fbc33ec1509f491abafb68
+SHA1 (patch-cm) = 66ee43d6fb56a850467a29f998e40cebd50ef8c0
+SHA1 (patch-cn) = 33167472bd2a34756aa120939fbce048cf58d95c
+SHA1 (patch-co) = 194f0ae8d262cffb790a420970d3f63342ebfd05
+SHA1 (patch-cp) = 6e25f5c3b05ce77f2c16d400e010dafb5124256e
+SHA1 (patch-cq) = 5258c761ab68183af8762232f5e53a9a7c63c52a
diff --git a/www/webkit-gtk/patches/patch-ca b/www/webkit-gtk/patches/patch-ca
new file mode 100644
index 00000000000..b2014e2545d
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ca
@@ -0,0 +1,22 @@
+$NetBSD: patch-ca,v 1.3 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/css/CSSCanvasValue.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/css/CSSCanvasValue.cpp
+@@ -34,7 +34,7 @@ namespace WebCore {
+ CSSCanvasValue::~CSSCanvasValue()
+ {
+     if (m_element)
+-        m_element->setObserver(0);
++        m_element->removeObserver(this);
+ }
+ 
+ String CSSCanvasValue::cssText() const
+@@ -79,7 +79,7 @@ HTMLCanvasElement* CSSCanvasValue::eleme
+         m_element = document->getCSSCanvasElement(m_name);
+         if (!m_element)
+             return 0;
+-        m_element->setObserver(this);
++        m_element->addObserver(this);
+     }
+     return m_element;
+ }
diff --git a/www/webkit-gtk/patches/patch-cb b/www/webkit-gtk/patches/patch-cb
new file mode 100644
index 00000000000..dc9c9d59f83
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cb
@@ -0,0 +1,32 @@
+$NetBSD: patch-cb,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/css/CSSFontFaceSource.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/css/CSSFontFaceSource.cpp
+@@ -75,6 +75,18 @@ void CSSFontFaceSource::pruneTable()
+     m_fontDataTable.clear();
+ }
+ 
++#if ENABLE(SVG_FONTS)
++SVGFontFaceElement* CSSFontFaceSource::svgFontFaceElement() const
++{
++    return m_svgFontFaceElement.get();
++}
++
++void CSSFontFaceSource::setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement> element) 
++{ 
++    m_svgFontFaceElement = element;
++}
++#endif
++
+ bool CSSFontFaceSource::isLoaded() const
+ {
+     if (m_font)
+@@ -168,7 +180,7 @@ SimpleFontData* CSSFontFaceSource::getFo
+ #if ENABLE(SVG_FONTS)
+             // In-Document SVG Fonts
+             if (m_svgFontFaceElement) {
+-                SVGFontData* svgFontData = new SVGFontData(m_svgFontFaceElement);
++                SVGFontData* svgFontData = new SVGFontData(m_svgFontFaceElement.get());
+                 fontData.set(new SimpleFontData(FontPlatformData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic), true, false, svgFontData));
+             }
+ #endif
diff --git a/www/webkit-gtk/patches/patch-cc b/www/webkit-gtk/patches/patch-cc
new file mode 100644
index 00000000000..fd2e70ca6cb
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cc
@@ -0,0 +1,24 @@
+$NetBSD: patch-cc,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/css/CSSFontFaceSource.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/css/CSSFontFaceSource.h
+@@ -62,8 +62,8 @@ public:
+     void pruneTable();
+ 
+ #if ENABLE(SVG_FONTS)
+-    SVGFontFaceElement* svgFontFaceElement() const { return m_svgFontFaceElement; }
+-    void setSVGFontFaceElement(SVGFontFaceElement* element) { m_svgFontFaceElement = element; }
++    SVGFontFaceElement* svgFontFaceElement() const;
++    void setSVGFontFaceElement(PassRefPtr<SVGFontFaceElement>);
+ #endif
+ 
+ private:
+@@ -73,7 +73,7 @@ private:
+     HashMap<unsigned, SimpleFontData*> m_fontDataTable; // The hash key is composed of size synthetic styles.
+ 
+ #if ENABLE(SVG_FONTS)
+-    SVGFontFaceElement* m_svgFontFaceElement;
++    RefPtr<SVGFontFaceElement> m_svgFontFaceElement;
+     RefPtr<SVGFontElement> m_externalSVGFontElement;
+ #endif
+ };
diff --git a/www/webkit-gtk/patches/patch-cd b/www/webkit-gtk/patches/patch-cd
new file mode 100644
index 00000000000..a404ec71b4d
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cd
@@ -0,0 +1,23 @@
+$NetBSD: patch-cd,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/dom/Document.cpp.orig	2011-04-14 10:45:05.000000000 +0000
++++ WebCore/dom/Document.cpp
+@@ -2870,6 +2870,18 @@ void Document::detachNodeIterator(NodeIt
+     m_nodeIterators.remove(ni);
+ }
+ 
++void Document::moveNodeIteratorsToNewDocument(Node* node, Document* newDocument)
++{
++    HashSet<NodeIterator*> nodeIteratorsList = m_nodeIterators;
++    HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = nodeIteratorsList.end();
++    for (HashSet<NodeIterator*>::const_iterator it = nodeIteratorsList.begin(); it != nodeIteratorsEnd; ++it) {
++        if ((*it)->root() == node) {
++            detachNodeIterator(*it);
++            newDocument->attachNodeIterator(*it);
++        }
++    }
++}
++
+ void Document::nodeChildrenChanged(ContainerNode* container)
+ {
+     if (!disableRangeMutation(page())) {
diff --git a/www/webkit-gtk/patches/patch-ce b/www/webkit-gtk/patches/patch-ce
new file mode 100644
index 00000000000..277a4aae952
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ce
@@ -0,0 +1,12 @@
+$NetBSD: patch-ce,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/dom/Document.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/dom/Document.h
+@@ -606,6 +606,7 @@ public:
+ 
+     void attachNodeIterator(NodeIterator*);
+     void detachNodeIterator(NodeIterator*);
++    void moveNodeIteratorsToNewDocument(Node*, Document*);
+ 
+     void attachRange(Range*);
+     void detachRange(Range*);
diff --git a/www/webkit-gtk/patches/patch-cf b/www/webkit-gtk/patches/patch-cf
new file mode 100644
index 00000000000..024025cf2c6
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cf
@@ -0,0 +1,16 @@
+$NetBSD: patch-cf,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/dom/Node.cpp.orig	2010-09-28 21:45:32.000000000 +0000
++++ WebCore/dom/Node.cpp
+@@ -522,8 +522,10 @@ void Node::setDocument(Document* documen
+         document->addNodeListCache();
+     }
+ 
+-    if (m_document)
++    if (m_document) {
++        m_document->moveNodeIteratorsToNewDocument(this, document);
+         m_document->selfOnlyDeref();
++    }
+ 
+     m_document = document;
+ 
diff --git a/www/webkit-gtk/patches/patch-cg b/www/webkit-gtk/patches/patch-cg
new file mode 100644
index 00000000000..89cc9e27993
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cg
@@ -0,0 +1,67 @@
+$NetBSD: patch-cg,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/html/HTMLCanvasElement.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/html/HTMLCanvasElement.cpp
+@@ -67,7 +67,6 @@ const float HTMLCanvasElement::MaxCanvas
+ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc)
+     : HTMLElement(tagName, doc)
+     , m_size(defaultWidth, defaultHeight)
+-    , m_observer(0)
+     , m_originClean(true)
+     , m_ignoreReset(false)
+     , m_createdImageBuffer(false)
+@@ -77,8 +76,9 @@ HTMLCanvasElement::HTMLCanvasElement(con
+ 
+ HTMLCanvasElement::~HTMLCanvasElement()
+ {
+-    if (m_observer)
+-        m_observer->canvasDestroyed(this);
++    HashSet<CanvasObserver*>::iterator end = m_observers.end();
++    for (HashSet<CanvasObserver*>::iterator it = m_observers.begin(); it != end; ++it)
++        (*it)->canvasDestroyed(this);
+ }
+ 
+ #if ENABLE(DASHBOARD_SUPPORT)
+@@ -123,6 +123,16 @@ RenderObject* HTMLCanvasElement::createR
+     return HTMLElement::createRenderer(arena, style);
+ }
+ 
++void HTMLCanvasElement::addObserver(CanvasObserver* observer)
++{
++    m_observers.add(observer);
++}
++
++void HTMLCanvasElement::removeObserver(CanvasObserver* observer)
++{
++    m_observers.remove(observer);
++}
++
+ void HTMLCanvasElement::setHeight(int value)
+ {
+     setAttribute(heightAttr, String::number(value));
+@@ -206,9 +216,10 @@ void HTMLCanvasElement::willDraw(const F
+         m_dirtyRect.unite(r);
+         ro->repaintRectangle(enclosingIntRect(m_dirtyRect));
+     }
+-    
+-    if (m_observer)
+-        m_observer->canvasChanged(this, rect);
++
++    HashSet<CanvasObserver*>::iterator end = m_observers.end();
++    for (HashSet<CanvasObserver*>::iterator it = m_observers.begin(); it != end; ++it)
++        (*it)->canvasChanged(this, rect);
+ }
+ 
+ void HTMLCanvasElement::reset()
+@@ -247,8 +258,9 @@ void HTMLCanvasElement::reset()
+         }
+     }
+ 
+-    if (m_observer)
+-        m_observer->canvasResized(this);
++    HashSet<CanvasObserver*>::iterator end = m_observers.end();
++    for (HashSet<CanvasObserver*>::iterator it = m_observers.begin(); it != end; ++it)
++        (*it)->canvasResized(this);
+ }
+ 
+ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
diff --git a/www/webkit-gtk/patches/patch-ch b/www/webkit-gtk/patches/patch-ch
new file mode 100644
index 00000000000..c81b9a20269
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ch
@@ -0,0 +1,23 @@
+$NetBSD: patch-ch,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/html/HTMLCanvasElement.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/html/HTMLCanvasElement.h
+@@ -99,7 +99,8 @@ public:
+     void setOriginTainted() { m_originClean = false; } 
+     bool originClean() const { return m_originClean; }
+ 
+-    void setObserver(CanvasObserver* observer) { m_observer = observer; }
++    void addObserver(CanvasObserver* observer);
++    void removeObserver(CanvasObserver* observer);
+ 
+     AffineTransform baseTransform() const;
+ 
+@@ -127,7 +128,7 @@ private:
+ 
+     OwnPtr<CanvasRenderingContext> m_context;
+     IntSize m_size;    
+-    CanvasObserver* m_observer;
++    HashSet<CanvasObserver*> m_observers;
+ 
+     bool m_originClean;
+     bool m_ignoreReset;
diff --git a/www/webkit-gtk/patches/patch-ci b/www/webkit-gtk/patches/patch-ci
new file mode 100644
index 00000000000..af7e494ffb7
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ci
@@ -0,0 +1,15 @@
+$NetBSD: patch-ci,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/inspector/InspectorDOMStorageResource.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/inspector/InspectorDOMStorageResource.cpp
+@@ -101,7 +101,9 @@ void InspectorDOMStorageResource::startR
+ void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* event)
+ {
+     ASSERT(m_frontend);
+-    ASSERT(eventNames().storageEvent == event->type());
++    if (event->type() != eventNames().storageEvent || !event->isStorageEvent())
++        return;
++
+     StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
+     Storage* storage = storageEvent->storageArea();
+     ExceptionCode ec = 0;
diff --git a/www/webkit-gtk/patches/patch-cj b/www/webkit-gtk/patches/patch-cj
new file mode 100644
index 00000000000..f90198cd002
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cj
@@ -0,0 +1,13 @@
+$NetBSD: patch-cj,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/loader/ImageDocument.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/loader/ImageDocument.cpp
+@@ -368,7 +368,7 @@ void ImageEventListener::handleEvent(Scr
+ {
+     if (event->type() == eventNames().resizeEvent)
+         m_doc->windowSizeChanged();
+-    else if (event->type() == eventNames().clickEvent) {
++    else if (event->type() == eventNames().clickEvent && event->isMouseEvent()) {
+         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+         m_doc->imageClicked(mouseEvent->x(), mouseEvent->y());
+     }
diff --git a/www/webkit-gtk/patches/patch-ck b/www/webkit-gtk/patches/patch-ck
new file mode 100644
index 00000000000..5ffeb239f78
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ck
@@ -0,0 +1,25 @@
+$NetBSD: patch-ck,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/page/animation/AnimationController.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/page/animation/AnimationController.cpp
+@@ -138,16 +138,16 @@ void AnimationControllerPrivate::updateS
+     RefPtr<Frame> protector = m_frame;
+ 
+     // fire all the events
+-    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
+-    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
++    Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
++    m_eventsToDispatch.clear();
++    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = eventsToDispatch.end();
++    for (Vector<EventToDispatch>::const_iterator it = eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
+         if (it->eventType == eventNames().webkitTransitionEndEvent)
+             it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
+         else
+             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
+     }
+     
+-    m_eventsToDispatch.clear();
+-    
+     // call setChanged on all the elements
+     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
+     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
diff --git a/www/webkit-gtk/patches/patch-cl b/www/webkit-gtk/patches/patch-cl
new file mode 100644
index 00000000000..1347bea888d
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cl
@@ -0,0 +1,14 @@
+$NetBSD: patch-cl,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGElementInstance.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/SVGElementInstance.cpp
+@@ -103,7 +103,8 @@ void SVGElementInstance::invalidateAllIn
+     const HashSet<SVGElementInstance*>::const_iterator end = set.end();
+     for (HashSet<SVGElementInstance*>::const_iterator it = set.begin(); it != end; ++it) {
+         ASSERT((*it)->correspondingElement() == element);
+-        (*it)->correspondingUseElement()->invalidateShadowTree();
++        if (SVGUseElement* element = (*it)->correspondingUseElement())
++            element->invalidateShadowTree();
+     }
+ }
+ 
diff --git a/www/webkit-gtk/patches/patch-cm b/www/webkit-gtk/patches/patch-cm
new file mode 100644
index 00000000000..fc4c835cde9
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cm
@@ -0,0 +1,12 @@
+$NetBSD: patch-cm,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGElementInstance.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/SVGElementInstance.h
+@@ -57,6 +57,7 @@ namespace WebCore {
+         SVGElement* correspondingElement() const { return m_element.get(); }
+         SVGUseElement* correspondingUseElement() const { return m_useElement; }
+         SVGElement* shadowTreeElement() const { return m_shadowTreeElement.get(); }
++        void clearUseElement() { m_useElement = 0; }
+ 
+         SVGElementInstance* parentNode() const { return parent(); }
+         PassRefPtr<SVGElementInstanceList> childNodes();
diff --git a/www/webkit-gtk/patches/patch-cn b/www/webkit-gtk/patches/patch-cn
new file mode 100644
index 00000000000..2c976f7f113
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cn
@@ -0,0 +1,16 @@
+$NetBSD: patch-cn,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGFontFaceElement.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/SVGFontFaceElement.cpp
+@@ -262,6 +262,11 @@ String SVGFontFaceElement::fontFamily() 
+     return m_styleDeclaration->getPropertyValue(CSSPropertyFontFamily);
+ }
+ 
++SVGFontElement* SVGFontFaceElement::associatedFontElement() const
++{
++    return m_fontElement.get();
++}
++
+ void SVGFontFaceElement::rebuildFontFace()
+ {
+     ASSERT(inDocument());
diff --git a/www/webkit-gtk/patches/patch-co b/www/webkit-gtk/patches/patch-co
new file mode 100644
index 00000000000..d2b3ca8bbd1
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-co
@@ -0,0 +1,22 @@
+$NetBSD: patch-co,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGFontFaceElement.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/SVGFontFaceElement.h
+@@ -54,7 +54,7 @@ namespace WebCore {
+         int descent() const;
+         String fontFamily() const;
+ 
+-        SVGFontElement* associatedFontElement() const { return m_fontElement; }
++        SVGFontElement* associatedFontElement() const;
+         void rebuildFontFace();
+         void removeFromMappedElementSheet();
+ 
+@@ -62,7 +62,7 @@ namespace WebCore {
+         RefPtr<CSSFontFaceRule> m_fontFaceRule;
+         RefPtr<CSSMutableStyleDeclaration> m_styleDeclaration;
+ 
+-        SVGFontElement* m_fontElement;
++        RefPtr<SVGFontElement> m_fontElement;
+     };
+ 
+ } // namespace WebCore
diff --git a/www/webkit-gtk/patches/patch-cp b/www/webkit-gtk/patches/patch-cp
new file mode 100644
index 00000000000..e9a6d1d2052
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cp
@@ -0,0 +1,65 @@
+$NetBSD: patch-cp,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGUseElement.cpp.orig	2011-02-07 17:29:58.000000000 +0000
++++ WebCore/svg/SVGUseElement.cpp
+@@ -128,7 +128,7 @@ void SVGUseElement::insertedIntoDocument
+ 
+ void SVGUseElement::removedFromDocument()
+ {
+-    m_targetElementInstance = 0;
++    detachInstance();
+     SVGElement::removedFromDocument();
+ }
+ 
+@@ -455,8 +455,7 @@ void SVGUseElement::buildShadowAndInstan
+     if (targetElement && targetElement->isSVGElement())
+         target = static_cast<SVGElement*>(targetElement);
+ 
+-    if (m_targetElementInstance)
+-        m_targetElementInstance = 0;
++    detachInstance();
+ 
+     // Do not allow self-referencing.
+     // 'target' may be null, if it's a non SVG namespaced element.
+@@ -482,7 +481,7 @@ void SVGUseElement::buildShadowAndInstan
+     // SVG specification does not say a word about <use> & cycles. My view on this is: just ignore it!
+     // Non-appearing <use> content is easier to debug, then half-appearing content.
+     if (foundProblem) {
+-        m_targetElementInstance = 0;
++        detachInstance();
+         return;
+     }
+ 
+@@ -515,7 +514,7 @@ void SVGUseElement::buildShadowAndInstan
+     // Do NOT leave an inconsistent instance tree around, instead destruct it.
+     if (!m_targetElementInstance->shadowTreeElement()) {
+         shadowRoot->removeAllChildren();
+-        m_targetElementInstance = 0;
++        detachInstance();
+         return;
+     }
+ 
+@@ -551,6 +550,14 @@ void SVGUseElement::buildShadowAndInstan
+     updateContainerSizes();
+ }
+ 
++void SVGUseElement::detachInstance()
++{
++    if (!m_targetElementInstance)
++        return;
++    m_targetElementInstance->clearUseElement();
++    m_targetElementInstance = 0;
++}
++
+ RenderObject* SVGUseElement::createRenderer(RenderArena* arena, RenderStyle*)
+ {
+     return new (arena) RenderSVGShadowTreeRootContainer(this);
+@@ -572,7 +579,7 @@ void SVGUseElement::attach()
+ 
+ void SVGUseElement::detach()
+ {
+-    m_targetElementInstance = 0;
++    detachInstance();
+     SVGStyledTransformableElement::detach();
+ }
+ 
diff --git a/www/webkit-gtk/patches/patch-cq b/www/webkit-gtk/patches/patch-cq
new file mode 100644
index 00000000000..fc17865829b
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-cq
@@ -0,0 +1,12 @@
+$NetBSD: patch-cq,v 1.1 2011/04/14 18:11:45 drochner Exp $
+
+--- WebCore/svg/SVGUseElement.h.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/SVGUseElement.h
+@@ -71,6 +71,7 @@ namespace WebCore {
+         friend class RenderSVGShadowTreeRootContainer;
+         bool isPendingResource() const { return m_isPendingResource; }
+         void buildShadowAndInstanceTree(SVGShadowTreeRootElement*);
++        void detachInstance();
+ 
+     private:
+         virtual bool hasRelativeValues() const;