update to 1.2.7

changes:
-fix some security problems (CVE-2010-4492, CVE-2010-4493, CVE-2011-0482,
 CVE-2010-4199, CVE-2010-4578)
-fix some crashes (which were partly patched in pkgsrc before)

7 files changed, 6 insertions, 167 deletions

diff --git a/www/webkit-gtk/Makefile b/www/webkit-gtk/Makefile
index 08cf25995f6..a9e7f3e0e52 100644
--- a/www/webkit-gtk/Makefile
+++ b/www/webkit-gtk/Makefile
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.35 2011/01/25 18:38:16 drochner Exp $
+# $NetBSD: Makefile,v 1.36 2011/02/10 18:26:35 drochner Exp $
 
-DISTNAME=	webkit-1.2.6
+DISTNAME=	webkit-1.2.7
 PKGNAME=	${DISTNAME:S/webkit/webkit-gtk/}
-PKGREVISION=	3
 CATEGORIES=	www
 MASTER_SITES=	http://www.webkitgtk.org/
 
diff --git a/www/webkit-gtk/distinfo b/www/webkit-gtk/distinfo
index 035a61d0017..46cb5414186 100644
--- a/www/webkit-gtk/distinfo
+++ b/www/webkit-gtk/distinfo
@@ -1,13 +1,8 @@
-$NetBSD: distinfo,v 1.26 2011/01/25 18:38:16 drochner Exp $
+$NetBSD: distinfo,v 1.27 2011/02/10 18:26:35 drochner Exp $
 
-SHA1 (webkit-1.2.6.tar.gz) = 0dcfbf7cedda400567f2e081b12987b9d82b33eb
-RMD160 (webkit-1.2.6.tar.gz) = 84d7101c84f2735744f08b5e8ed684ccf05a59dd
-Size (webkit-1.2.6.tar.gz) = 6613589 bytes
+SHA1 (webkit-1.2.7.tar.gz) = e9afc573d2459794c3749ba404f2187f9dcc9ed3
+RMD160 (webkit-1.2.7.tar.gz) = f36b3ae05693e0eeb4d1936ceee52b6fe1517e57
+Size (webkit-1.2.7.tar.gz) = 6615990 bytes
 SHA1 (patch-ab) = 48e493e98451b2a86c4af0b8308831ce5db8c841
 SHA1 (patch-ad) = a5edd3fbff91488d220a3bfeb506865883c912cb
 SHA1 (patch-af) = 971258e19192d058c4ca580abcbeb3b02f3bf6ce
-SHA1 (patch-ba) = 4de4994b4e27db0243cca5a2cf409495c3fd382f
-SHA1 (patch-bb) = 7199554b39664df9a6310106f7a03d632731105a
-SHA1 (patch-bc) = 2d5057e1caa48e9592c7185c160912d1ef4a8f4f
-SHA1 (patch-bd) = aaca4c45c4d313f3d92b599842272d0e61fb24c2
-SHA1 (patch-be) = a90f18d4954ba3abf46a30c9792d6c48f83f6e60
diff --git a/www/webkit-gtk/patches/patch-ba b/www/webkit-gtk/patches/patch-ba
deleted file mode 100644
index 8da66bef3cf..00000000000
--- a/www/webkit-gtk/patches/patch-ba
+++ /dev/null
@@ -1,31 +0,0 @@
-$NetBSD: patch-ba,v 1.1 2011/01/08 14:24:11 drochner Exp $
-
---- WebCore/svg/animation/SMILTimeContainer.cpp.orig	2010-09-10 13:20:33.000000000 +0000
-+++ WebCore/svg/animation/SMILTimeContainer.cpp
-@@ -254,7 +254,7 @@ void SMILTimeContainer::updateAnimations
-     sortByPriority(toAnimate, elapsed);
-     
-     // Calculate animation contributions.
--    typedef HashMap<ElementAttributePair, SVGSMILElement*> ResultElementMap;
-+    typedef HashMap<ElementAttributePair, RefPtr<SVGSMILElement> > ResultElementMap;
-     ResultElementMap resultsElements;
-     for (unsigned n = 0; n < toAnimate.size(); ++n) {
-         SVGSMILElement* animation = toAnimate[n];
-@@ -273,7 +273,7 @@ void SMILTimeContainer::updateAnimations
-         
-         // Results are accumulated to the first animation that animates a particular element/attribute pair.
-         ElementAttributePair key(targetElement, attributeName); 
--        SVGSMILElement* resultElement = resultsElements.get(key);
-+        SVGSMILElement* resultElement = resultsElements.get(key).get();
-         if (!resultElement) {
-             resultElement = animation;
-             resultElement->resetToBaseValue(baseValueFor(key));
-@@ -296,7 +296,7 @@ void SMILTimeContainer::updateAnimations
-     Vector<SVGSMILElement*> animationsToApply;
-     ResultElementMap::iterator end = resultsElements.end();
-     for (ResultElementMap::iterator it = resultsElements.begin(); it != end; ++it)
--        animationsToApply.append(it->second);
-+        animationsToApply.append(it->second.get());
- 
-     // Sort <animateTranform> to be the last one to be applied. <animate> may change transform attribute as
-     // well (directly or indirectly by modifying <use> x/y) and this way transforms combine properly.
diff --git a/www/webkit-gtk/patches/patch-bb b/www/webkit-gtk/patches/patch-bb
deleted file mode 100644
index 457a088721f..00000000000
--- a/www/webkit-gtk/patches/patch-bb
+++ /dev/null
@@ -1,21 +0,0 @@
-$NetBSD: patch-bb,v 1.1 2011/01/08 14:24:11 drochner Exp $
-
---- WebCore/page/EventHandler.cpp.orig	2010-09-10 13:20:33.000000000 +0000
-+++ WebCore/page/EventHandler.cpp
-@@ -549,13 +549,13 @@ void EventHandler::updateSelectionForMou
-     if (!targetNode)
-         return;
- 
-+    if (!canMouseDragExtendSelect(targetNode))
-+	return;
-+
-     RenderObject* targetRenderer = targetNode->renderer();
-     if (!targetRenderer)
-         return;
-         
--    if (!canMouseDragExtendSelect(targetNode))
--        return;
--
-     VisiblePosition targetPosition(targetRenderer->positionForPoint(localPoint));
- 
-     // Don't modify the selection if we're not on a node.
diff --git a/www/webkit-gtk/patches/patch-bc b/www/webkit-gtk/patches/patch-bc
deleted file mode 100644
index e05768086bd..00000000000
--- a/www/webkit-gtk/patches/patch-bc
+++ /dev/null
@@ -1,18 +0,0 @@
-$NetBSD: patch-bc,v 1.1 2011/01/25 18:38:16 drochner Exp $
-
---- WebCore/page/FrameView.cpp.orig	2010-09-28 21:02:14.000000000 +0000
-+++ WebCore/page/FrameView.cpp
-@@ -972,8 +972,11 @@ bool FrameView::scrollToAnchor(const Str
-             if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
-                 RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
-                 if (viewElement.get()) {
--                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
--                    svg->inheritViewAttributes(viewElement.get());
-+		    SVGElement* element = SVGLocatable::nearestViewportElement(viewElement.get());
-+		    if (element->hasTagName(SVGNames::svgTag)) {
-+			RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(element);
-+			svg->inheritViewAttributes(viewElement.get());
-+		    }
-                 }
-             }
-         }
diff --git a/www/webkit-gtk/patches/patch-bd b/www/webkit-gtk/patches/patch-bd
deleted file mode 100644
index 6bd779c27b1..00000000000
--- a/www/webkit-gtk/patches/patch-bd
+++ /dev/null
@@ -1,58 +0,0 @@
-$NetBSD: patch-bd,v 1.1 2011/01/25 18:38:16 drochner Exp $
-
---- WebCore/editing/ReplaceSelectionCommand.cpp.orig	2010-09-10 13:20:33.000000000 +0000
-+++ WebCore/editing/ReplaceSelectionCommand.cpp
-@@ -51,11 +51,14 @@
- #include "markup.h"
- #include "visible_units.h"
- #include <wtf/StdLibExtras.h>
-+#include <wtf/Vector.h> 
- 
- namespace WebCore {
- 
- using namespace HTMLNames;
- 
-+typedef Vector<RefPtr<Node> > NodeVector; 
-+
- enum EFragmentType { EmptyFragment, SingleTextNodeFragment, TreeFragment };
- 
- // --- ReplacementFragment helper class
-@@ -707,7 +710,13 @@ void ReplaceSelectionCommand::handleStyl
- void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMutableStyleDeclaration* parentStyle)
- {
-     ASSERT(parentNode->hasTagName(spanTag));
--    for (Node* childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) {
-+        NodeVector childNodes; 
-+        for (RefPtr<Node> childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) 
-+        childNodes.append(childNode); 
-+
-+for (NodeVector::const_iterator it = childNodes.begin(); it != childNodes.end(); it++) { 
-+        Node* childNode = it->get(); 
-+
-         if (childNode->isTextNode() || !isBlock(childNode) || childNode->hasTagName(preTag)) {
-             // In this case, put a span tag around the child node.
-             RefPtr<Node> newSpan = parentNode->cloneNode(false);
-@@ -867,7 +876,11 @@ void ReplaceSelectionCommand::doApply()
-     
-     // Inserting content could cause whitespace to collapse, e.g. inserting <div>foo</div> into hello^ world.
-     prepareWhitespaceAtPositionForSplit(insertionPos);
--    
-+   
-+    // If the downstream node has been removed there's no point in continuing. 
-+    if (!insertionPos.downstream().node()) 
-+        return; 
-+ 
-     // NOTE: This would be an incorrect usage of downstream() if downstream() were changed to mean the last position after 
-     // p that maps to the same visible position as p (since in the case where a br is at the end of a block and collapsed 
-     // away, there are positions after the br which map to the same visible position as [br, 0]).  
-@@ -945,8 +958,8 @@ void ReplaceSelectionCommand::doApply()
-     bool plainTextFragment = isPlainTextMarkup(refNode.get());
- 
-     while (node) {
--        Node* next = node->nextSibling();
--        fragment.removeNode(node);
-+        RefPtr<Node> next = node->nextSibling(); 
-+        fragment.removeNode(node.get());  
-         insertNodeAfterAndUpdateNodesInserted(node, refNode.get());
- 
-         // Mutation events (bug 22634) may have already removed the inserted content
diff --git a/www/webkit-gtk/patches/patch-be b/www/webkit-gtk/patches/patch-be
deleted file mode 100644
index c62c0f021ed..00000000000
--- a/www/webkit-gtk/patches/patch-be
+++ /dev/null
@@ -1,27 +0,0 @@
-$NetBSD: patch-be,v 1.1 2011/01/25 18:38:16 drochner Exp $
-
---- JavaScriptCore/interpreter/Interpreter.cpp.orig	2010-12-28 12:24:33.000000000 +0000
-+++ JavaScriptCore/interpreter/Interpreter.cpp
-@@ -3465,17 +3465,17 @@ skip_id_custom_self:
-                 goto vm_throw;
-             }
-             ASSERT(!callFrame->callee()->isHostFunction());
--            uint32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
--            uint32_t inplaceArgs = min(argCount, expectedParams);
--            uint32_t i = 0;
-+	    int32_t expectedParams = callFrame->callee()->jsExecutable()->parameterCount();
-+	    int32_t inplaceArgs = min(static_cast<int32_t> (argCount), expectedParams);
-+	    int32_t i = 0;
-             Register* argStore = callFrame->registers() + argsOffset;
- 
-             // First step is to copy the "expected" parameters from their normal location relative to the callframe
-             for (; i < inplaceArgs; i++)
-                 argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
-             // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
--            for (; i < argCount; i++)
--                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
-+            for (; i < static_cast<int32_t> (argCount); i++)
-+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - static_cast<int32_t> (argCount) - 1];
-         } else if (!arguments.isUndefinedOrNull()) {
-             if (!arguments.isObject()) {
-                 exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());