update to 1.2.6

This release has essentially security fixes, covering the following
CVEs:
 CVE-2010-4198 CVE-2010-4197 CVE-2010-4204 CVE-2010-4206
 CVE-2010-1791 CVE-2010-3812 CVE-2010-3813
(plus 2 patches from upstream which fix crashes)

4 files changed, 60 insertions, 7 deletions

diff --git a/www/webkit-gtk/Makefile b/www/webkit-gtk/Makefile
index 90ca2ec0a20..c89993adf5c 100644
--- a/www/webkit-gtk/Makefile
+++ b/www/webkit-gtk/Makefile
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.31 2010/12/23 11:44:59 dsainty Exp $
+# $NetBSD: Makefile,v 1.32 2011/01/08 14:24:10 drochner Exp $
 
-DISTNAME=	webkit-1.2.5
+DISTNAME=	webkit-1.2.6
 PKGNAME=	${DISTNAME:S/webkit/webkit-gtk/}
-PKGREVISION=	2
 CATEGORIES=	www
 MASTER_SITES=	http://www.webkitgtk.org/
 
diff --git a/www/webkit-gtk/distinfo b/www/webkit-gtk/distinfo
index c5d89419905..68fd02494b4 100644
--- a/www/webkit-gtk/distinfo
+++ b/www/webkit-gtk/distinfo
@@ -1,7 +1,9 @@
-$NetBSD: distinfo,v 1.21 2010/10/16 13:46:29 adam Exp $
+$NetBSD: distinfo,v 1.22 2011/01/08 14:24:10 drochner Exp $
 
-SHA1 (webkit-1.2.5.tar.gz) = 2cd50e62a0c94bba8cc8a8466ea16fac1f9fc1ce
-RMD160 (webkit-1.2.5.tar.gz) = 7510af4c5d15c06adf984a090a9e9550f5ea7147
-Size (webkit-1.2.5.tar.gz) = 6727977 bytes
+SHA1 (webkit-1.2.6.tar.gz) = 0dcfbf7cedda400567f2e081b12987b9d82b33eb
+RMD160 (webkit-1.2.6.tar.gz) = 84d7101c84f2735744f08b5e8ed684ccf05a59dd
+Size (webkit-1.2.6.tar.gz) = 6613589 bytes
 SHA1 (patch-ad) = a5edd3fbff91488d220a3bfeb506865883c912cb
 SHA1 (patch-af) = 971258e19192d058c4ca580abcbeb3b02f3bf6ce
+SHA1 (patch-ba) = 4de4994b4e27db0243cca5a2cf409495c3fd382f
+SHA1 (patch-bb) = 7199554b39664df9a6310106f7a03d632731105a
diff --git a/www/webkit-gtk/patches/patch-ba b/www/webkit-gtk/patches/patch-ba
new file mode 100644
index 00000000000..8da66bef3cf
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-ba
@@ -0,0 +1,31 @@
+$NetBSD: patch-ba,v 1.1 2011/01/08 14:24:11 drochner Exp $
+
+--- WebCore/svg/animation/SMILTimeContainer.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/svg/animation/SMILTimeContainer.cpp
+@@ -254,7 +254,7 @@ void SMILTimeContainer::updateAnimations
+     sortByPriority(toAnimate, elapsed);
+     
+     // Calculate animation contributions.
+-    typedef HashMap<ElementAttributePair, SVGSMILElement*> ResultElementMap;
++    typedef HashMap<ElementAttributePair, RefPtr<SVGSMILElement> > ResultElementMap;
+     ResultElementMap resultsElements;
+     for (unsigned n = 0; n < toAnimate.size(); ++n) {
+         SVGSMILElement* animation = toAnimate[n];
+@@ -273,7 +273,7 @@ void SMILTimeContainer::updateAnimations
+         
+         // Results are accumulated to the first animation that animates a particular element/attribute pair.
+         ElementAttributePair key(targetElement, attributeName); 
+-        SVGSMILElement* resultElement = resultsElements.get(key);
++        SVGSMILElement* resultElement = resultsElements.get(key).get();
+         if (!resultElement) {
+             resultElement = animation;
+             resultElement->resetToBaseValue(baseValueFor(key));
+@@ -296,7 +296,7 @@ void SMILTimeContainer::updateAnimations
+     Vector<SVGSMILElement*> animationsToApply;
+     ResultElementMap::iterator end = resultsElements.end();
+     for (ResultElementMap::iterator it = resultsElements.begin(); it != end; ++it)
+-        animationsToApply.append(it->second);
++        animationsToApply.append(it->second.get());
+ 
+     // Sort <animateTranform> to be the last one to be applied. <animate> may change transform attribute as
+     // well (directly or indirectly by modifying <use> x/y) and this way transforms combine properly.
diff --git a/www/webkit-gtk/patches/patch-bb b/www/webkit-gtk/patches/patch-bb
new file mode 100644
index 00000000000..457a088721f
--- /dev/null
+++ b/www/webkit-gtk/patches/patch-bb
@@ -0,0 +1,21 @@
+$NetBSD: patch-bb,v 1.1 2011/01/08 14:24:11 drochner Exp $
+
+--- WebCore/page/EventHandler.cpp.orig	2010-09-10 13:20:33.000000000 +0000
++++ WebCore/page/EventHandler.cpp
+@@ -549,13 +549,13 @@ void EventHandler::updateSelectionForMou
+     if (!targetNode)
+         return;
+ 
++    if (!canMouseDragExtendSelect(targetNode))
++	return;
++
+     RenderObject* targetRenderer = targetNode->renderer();
+     if (!targetRenderer)
+         return;
+         
+-    if (!canMouseDragExtendSelect(targetNode))
+-        return;
+-
+     VisiblePosition targetPosition(targetRenderer->positionForPoint(localPoint));
+ 
+     // Don't modify the selection if we're not on a node.