Merge lp:~ari-tczew/ubuntu/natty/webkit/lp-691104 into lp:ubuntu/natty/webkit

[Artur Rona]

I prepared a merge with Debian unstable, but there is a FTBFS. More information on bug report.

[Robert Ancell (robert-ancell)]

Merge is on wrong branch, packaging is here:
lp:~ubuntu-desktop/webkit/ubuntu

Note that the branch has been updated.

review: Needs Resubmitting

[Artur Rona (ari-tczew)]

> Merge is on wrong branch, packaging is here:
> lp:~ubuntu-desktop/webkit/ubuntu
>
> Note that the branch has been updated.

I don't like when someone signs my work as its...

Unmerged revisions

22. By Artur Rona on 2010-12-16

  [ Artur Rona ]
  * Merge from debian unstable. Remaining changes: (LP: #691104)
    - debian/control: Drop Build-Depends on gir-repository-dev since
      we don't have this package in archive.
    - debian/patches/ubuntu-gir-version.patch: Use the 1.2 gobject
      introspection abi.

  [ David Stansby ]
  * debian/patches/typo_webkitwebsettings.patch: Fix typo. (LP: #552718)

=== modified file 'debian/changelog'
--- debian/changelog	2010-10-21 13:40:42 +0000
+++ debian/changelog	2010-12-16 18:14:15 +0000
@@ -1,3 +1,55 @@
+webkit (1.2.5-2.1ubuntu1) natty; urgency=low
+
+  [ Artur Rona ]
+  * Merge from debian unstable.  Remaining changes: (LP: #691104)
+    - debian/control: Drop Build-Depends on gir-repository-dev since
+      we don't have this package in archive.
+    - debian/patches/ubuntu-gir-version.patch: Use the 1.2 gobject
+      introspection abi.
+
+  [ David Stansby ]
+  * debian/patches/typo_webkitwebsettings.patch: Fix typo. (LP: #552718)
+
+ -- Artur Rona <[e-mail]>  Thu, 16 Dec 2010 15:02:49 +0100
+
+webkit (1.2.5-2.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Add patch 05-fix-jit-on-kfreebsd-i386.patch by Petr Salinger and 
+    Michael Dorrington: Fixes Javascript JIT crashing on kfreebsd-i386
+    (closes: #598956).
+
+ -- gregor herrmann <[e-mail]>  Wed, 10 Nov 2010 23:28:55 +0100
+
+webkit (1.2.5-2) unstable; urgency=high
+
+  * Unapply 02-pool-fixup-and-sparc-support.patch and
+    04-spoof-user-agent-to-google.patch in git.  This prevents the
+    creation of an unwanted debian-changes patch.
+
+ -- Michael Gilbert <[e-mail]>  Mon, 18 Oct 2010 22:00:36 -0400
+
+webkit (1.2.5-1) unstable; urgency=high
+
+  [ Gustavo Noronha Silva ]
+
+  * New upstream release
+  - fixes the following CVES:
+
+      CVE-2010-1780 CVE-2010-3113 CVE-2010-1814 CVE-2010-1812
+      CVE-2010-1815 CVE-2010-3115 CVE-2010-1807 CVE-2010-3114
+      CVE-2010-3116 CVE-2010-3257 CVE-2010-3259
+
+  [ Michael Gilbert ]
+  * fix cve-2010-2646: security origin bypass using IFRAME elements.
+  * fix cve-2010-2651: vulnerability in css style rendering.
+  * fix cve-2010-2900: vulnerability with large canvas elements when using the
+    SKIA library.
+  * fix cve-2010-2901: vulnerability in the rendering implementation.
+  * fix cve-2010-3120: vulnerability in geolocation feature.
+
+ -- Gustavo Noronha Silva <[e-mail]>  Sat, 16 Oct 2010 17:50:56 -0300
+
 webkit (1.2.5-0ubuntu3) natty; urgency=low
 
   * debian/patches/ubuntu-gir-version.patch:

=== added file 'debian/patches/05-fix-jit-on-kfreebsd-i386.patch'
--- debian/patches/05-fix-jit-on-kfreebsd-i386.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/05-fix-jit-on-kfreebsd-i386.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,51 @@
+Author: Petr Salinger
+Tester: Michael Dorrington
+Description: Fixes Javascript JIT crashing on kfreebsd-i386.
+ Fixes Javascript JIT issue that causes webkit to crash on kfreebsd-i386,
+ see <http://bugs.debian.org/598956>.
+
+ For reasoning of patch see:
+ "Common practices and problems found when porting to GNU/k*BSD"
+ <http://glibc-bsd.alioth.debian.org/porting/PORTING>
+
+ On kfreebsd-amd64, this issue does not occur.
+
+
+--- webkit-1.2.4/JavaScriptCore/jit/JITOpcodes.cpp	2010-09-03 20:18:02.000000000 +0100
++++ webkit-1.2.4-fix_jit_kfreebsd_i386/JavaScriptCore/jit/JITOpcodes.cpp	2010-10-07 06:09:55.000000000 +0100
+@@ -165,7 +165,7 @@
+      * stack pointer by the right amount after the call.
+      */
+ 
+-#if COMPILER(MSVC) || OS(LINUX)
++#if COMPILER(MSVC) || OS(LINUX) || defined(__GLIBC__)
+ #if COMPILER(MSVC)
+ #pragma pack(push)
+ #pragma pack(4)
+@@ -228,7 +228,7 @@
+     storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+     storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+ 
+-#if COMPILER(MSVC) || OS(LINUX)
++#if COMPILER(MSVC) || OS(LINUX) || defined(__GLIBC__)
+     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
+ 
+@@ -1689,7 +1689,7 @@
+      * not the rest of the callframe so we need a nice way to ensure we increment the
+      * stack pointer by the right amount after the call.
+      */
+-#if COMPILER(MSVC) || OS(LINUX)
++#if COMPILER(MSVC) || OS(LINUX) || defined(__GLIBC__)
+     struct NativeCallFrameStructure {
+       //  CallFrame* callFrame; // passed in EDX
+         JSObject* callee;
+@@ -1742,7 +1742,7 @@
+     loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
+     storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
+ 
+-#if COMPILER(MSVC) || OS(LINUX)
++#if COMPILER(MSVC) || OS(LINUX) || defined(__GLIBC__)
+     // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+     addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);
+ 

=== added file 'debian/patches/cve-2010-2646.patch'
--- debian/patches/cve-2010-2646.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2010-2646.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,110 @@
+description: fix cve-2010-2646
+author: Michael Gilbert <[e-mail]>
+origin: http://trac.webkit.org/changeset/58873
+Index: webkit-1.2.4/WebCore/storage/StorageEventDispatcher.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/storage/StorageEventDispatcher.cpp	2010-09-07 01:13:45.000000000 -0400
++++ webkit-1.2.4/WebCore/storage/StorageEventDispatcher.cpp	2010-09-07 01:14:42.000000000 -0400
+@@ -54,8 +54,12 @@
+                 frames.append(frame);
+         }
+ 
+-        for (unsigned i = 0; i < frames.size(); ++i)
+-            frames[i]->document()->enqueueStorageEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
++        for (unsigned i = 0; i < frames.size(); ++i) {
++            ExceptionCode ec = 0;
++            Storage* storage = frames[i]->domWindow()->sessionStorage(ec);
++            if (!ec)
++                frames[i]->document()->enqueueStorageEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
++        }
+     } else {
+         // Send events to every page.
+         const HashSet<Page*>& pages = page->group().pages();
+Index: webkit-1.2.4/WebCore/page/DOMWindow.h
+===================================================================
+--- webkit-1.2.4.orig/WebCore/page/DOMWindow.h	2010-09-07 01:13:45.000000000 -0400
++++ webkit-1.2.4/WebCore/page/DOMWindow.h	2010-09-07 01:14:42.000000000 -0400
+@@ -206,7 +206,7 @@
+ 
+ #if ENABLE(DOM_STORAGE)
+         // HTML 5 key/value storage
+-        Storage* sessionStorage() const;
++        Storage* sessionStorage(ExceptionCode&) const;
+         Storage* localStorage(ExceptionCode&) const;
+ #endif
+ 
+Index: webkit-1.2.4/WebCore/page/DOMWindow.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/page/DOMWindow.cpp	2010-09-07 01:13:45.000000000 -0400
++++ webkit-1.2.4/WebCore/page/DOMWindow.cpp	2010-09-07 01:14:42.000000000 -0400
+@@ -567,7 +567,7 @@
+ }
+ 
+ #if ENABLE(DOM_STORAGE)
+-Storage* DOMWindow::sessionStorage() const
++Storage* DOMWindow::sessionStorage(ExceptionCode& ec) const
+ {
+     if (m_sessionStorage)
+         return m_sessionStorage.get();
+@@ -576,6 +576,11 @@
+     if (!document)
+         return 0;
+ 
++    if (!document->securityOrigin()->canAccessLocalStorage()) {
++        ec = SECURITY_ERR;
++        return 0;
++    }
++
+     Page* page = document->page();
+     if (!page)
+         return 0;
+@@ -593,16 +598,16 @@
+ {
+     if (m_localStorage)
+         return m_localStorage.get();
+-    
++
+     Document* document = this->document();
+     if (!document)
+         return 0;
+-    
++
+     if (!document->securityOrigin()->canAccessLocalStorage()) {
+         ec = SECURITY_ERR;
+         return 0;
+     }
+-        
++
+     Page* page = document->page();
+     if (!page)
+         return 0;
+Index: webkit-1.2.4/WebCore/page/SecurityOrigin.h
+===================================================================
+--- webkit-1.2.4.orig/WebCore/page/SecurityOrigin.h	2010-09-07 01:13:45.000000000 -0400
++++ webkit-1.2.4/WebCore/page/SecurityOrigin.h	2010-09-07 01:14:42.000000000 -0400
+@@ -120,6 +120,11 @@
+     bool canAccessLocalStorage() const { return !isUnique(); }
+     bool canAccessCookies() const { return !isUnique(); }
+ 
++    // Technically, we should always allow access to sessionStorage, but we
++    // currently don't handle creating a sessionStorage area for unique
++    // origins.
++    bool canAccessSessionStorage() const { return !isUnique(); }
++
+     bool isSecureTransitionTo(const KURL&) const;
+ 
+     // The local SecurityOrigin is the most privileged SecurityOrigin.
+Index: webkit-1.2.4/WebCore/page/DOMWindow.idl
+===================================================================
+--- webkit-1.2.4.orig/WebCore/page/DOMWindow.idl	2010-09-07 01:14:36.000000000 -0400
++++ webkit-1.2.4/WebCore/page/DOMWindow.idl	2010-09-07 01:14:42.000000000 -0400
+@@ -164,7 +164,8 @@
+             raises(DOMException);
+ #endif
+ #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+-        readonly attribute [EnabledAtRuntime] Storage sessionStorage;
++        readonly attribute [EnabledAtRuntime] Storage sessionStorage
++            getter raises(DOMException);
+         readonly attribute [EnabledAtRuntime] Storage localStorage
+             getter raises(DOMException);
+ #endif

=== added file 'debian/patches/cve-2010-2651.patch'
--- debian/patches/cve-2010-2651.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2010-2651.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,38 @@
+description: fix cve-2010-2651
+author: Michael Gilbert <[e-mail]>
+origin: http://trac.webkit.org/changeset/59247
+Index: webkit-1.2.4/WebCore/rendering/RenderBlock.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/rendering/RenderBlock.cpp	2010-09-03 15:18:07.000000000 -0400
++++ webkit-1.2.4/WebCore/rendering/RenderBlock.cpp	2010-09-06 21:50:51.000000000 -0400
+@@ -4651,10 +4651,12 @@
+ 
+     // Drill into inlines looking for our first text child.
+     RenderObject* currChild = firstLetterBlock->firstChild();
+-    while (currChild && currChild->needsLayout() && ((!currChild->isReplaced() && !currChild->isRenderButton() && !currChild->isMenuList()) || currChild->isFloatingOrPositioned()) && !currChild->isText()) {
++    while (currChild && ((!currChild->isReplaced() && !currChild->isRenderButton() && !currChild->isMenuList()) || currChild->isFloatingOrPositioned()) && !currChild->isText()) {
+         if (currChild->isFloatingOrPositioned()) {
+-            if (currChild->style()->styleType() == FIRST_LETTER)
++            if (currChild->style()->styleType() == FIRST_LETTER) {
++                currChild = currChild->firstChild();
+                 break;
++            }
+             currChild = currChild->nextSibling();
+         } else
+             currChild = currChild->firstChild();
+@@ -4671,11 +4673,11 @@
+ 
+     // If the child already has style, then it has already been created, so we just want
+     // to update it.
+-    if (currChild->style()->styleType() == FIRST_LETTER) {
++    if (firstLetterContainer->style()->styleType() == FIRST_LETTER) {
+         RenderStyle* pseudo = firstLetterBlock->getCachedPseudoStyle(FIRST_LETTER,
+-                                                                     firstLetterContainer->firstLineStyle());
+-        currChild->setStyle(pseudo);
+-        for (RenderObject* genChild = currChild->firstChild(); genChild; genChild = genChild->nextSibling()) {
++                                                                     firstLetterContainer->parent()->firstLineStyle());
++        firstLetterContainer->setStyle(pseudo);
++        for (RenderObject* genChild = firstLetterContainer->firstChild(); genChild; genChild = genChild->nextSibling()) {
+             if (genChild->isText()) 
+                 genChild->setStyle(pseudo);
+         }

=== added file 'debian/patches/cve-2010-2900.patch'
--- debian/patches/cve-2010-2900.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2010-2900.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,29 @@
+description: fix cve-2010-2900
+author: Michael Gilbert <[e-mail]>
+origin: http://trac.webkit.org/changeset/63219
+Index: webkit-1.2.4/WebCore/html/HTMLCanvasElement.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/html/HTMLCanvasElement.cpp	2010-09-06 22:28:56.000000000 -0400
++++ webkit-1.2.4/WebCore/html/HTMLCanvasElement.cpp	2010-09-06 22:29:28.000000000 -0400
+@@ -64,6 +64,9 @@
+ // in exchange for a smaller maximum canvas size.
+ const float HTMLCanvasElement::MaxCanvasArea = 32768 * 8192; // Maximum canvas area in CSS pixels
+ 
++//In Skia, we will also limit width/height to 32767.
++static const float MaxSkiaDim = 32767.0F; // Maximum width/height in CSS pixels.
++
+ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc)
+     : HTMLElement(tagName, doc)
+     , m_size(defaultWidth, defaultHeight)
+@@ -293,6 +296,11 @@
+     if (!(wf >= 1 && hf >= 1 && wf * hf <= MaxCanvasArea))
+         return IntSize();
+ 
++#if PLATFORM(SKIA)
++    if (wf > MaxSkiaDim || hf > MaxSkiaDim)
++        return IntSize();
++#endif
++
+     return IntSize(static_cast<unsigned>(wf), static_cast<unsigned>(hf));
+ }
+ 

=== added file 'debian/patches/cve-2010-2901.patch'
--- debian/patches/cve-2010-2901.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2010-2901.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,98 @@
+description: fix cve-2010-2901
+author: Michael Gilbert <[e-mail]>
+origin: http://trac.webkit.org/changeset/63048
+Index: webkit-1.2.4/WebCore/rendering/RenderObject.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/rendering/RenderObject.cpp	2010-09-06 22:55:29.000000000 -0400
++++ webkit-1.2.4/WebCore/rendering/RenderObject.cpp	2010-09-06 22:56:03.000000000 -0400
+@@ -560,6 +560,19 @@
+     return 0;
+ }
+ 
++RenderBoxModelObject* RenderObject::enclosingBoxModelObject() const
++{
++    RenderObject* curr = const_cast<RenderObject*>(this);
++    while (curr) {
++        if (curr->isBoxModelObject())
++            return toRenderBoxModelObject(curr);
++        curr = curr->parent();
++    }
++
++    ASSERT_NOT_REACHED();
++    return 0;
++}
++
+ RenderBlock* RenderObject::firstLineBlock() const
+ {
+     return 0;
+Index: webkit-1.2.4/WebCore/rendering/RenderObject.h
+===================================================================
+--- webkit-1.2.4.orig/WebCore/rendering/RenderObject.h	2010-09-06 22:55:29.000000000 -0400
++++ webkit-1.2.4/WebCore/rendering/RenderObject.h	2010-09-06 22:56:03.000000000 -0400
+@@ -193,7 +193,8 @@
+ 
+     // Convenience function for getting to the nearest enclosing box of a RenderObject.
+     RenderBox* enclosingBox() const;
+-    
++    RenderBoxModelObject* enclosingBoxModelObject() const;
++
+     virtual bool isEmpty() const { return firstChild() == 0; }
+ 
+ #ifndef NDEBUG
+Index: webkit-1.2.4/WebCore/rendering/InlineFlowBox.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/rendering/InlineFlowBox.cpp	2010-09-06 22:55:28.000000000 -0400
++++ webkit-1.2.4/WebCore/rendering/InlineFlowBox.cpp	2010-09-06 22:56:24.000000000 -0400
+@@ -639,11 +639,24 @@
+             // outlines.
+             if (renderer()->style()->visibility() == VISIBLE && renderer()->hasOutline() && !isRootInlineBox()) {
+                 RenderInline* inlineFlow = toRenderInline(renderer());
+-                if ((inlineFlow->continuation() || inlineFlow->isInlineContinuation()) && !boxModelObject()->hasSelfPaintingLayer()) {
++
++                RenderBlock* cb = 0;
++                bool containingBlockPaintsContinuationOutline = inlineFlow->continuation() || inlineFlow->isInlineContinuation();
++                if (containingBlockPaintsContinuationOutline) {
++                    cb = renderer()->containingBlock()->containingBlock();
++
++                    for (RenderBoxModelObject* box = boxModelObject(); box != cb; box = box->parent()->enclosingBoxModelObject()) {
++                        if (box->hasSelfPaintingLayer()) {
++                            containingBlockPaintsContinuationOutline = false;
++                            break;
++                        }
++                    }
++                }
++
++                if (containingBlockPaintsContinuationOutline) {
+                     // Add ourselves to the containing block of the entire continuation so that it can
+                     // paint us atomically.
+-                    RenderBlock* block = renderer()->containingBlock()->containingBlock();
+-                    block->addContinuationWithOutline(toRenderInline(renderer()->node()->renderer()));
++                    cb->addContinuationWithOutline(toRenderInline(renderer()->node()->renderer()));
+                 } else if (!inlineFlow->isInlineContinuation())
+                     paintInfo.outlineObjects->add(inlineFlow);
+             }
+Index: webkit-1.2.4/WebCore/rendering/RenderBlock.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/rendering/RenderBlock.cpp	2010-09-06 22:55:28.000000000 -0400
++++ webkit-1.2.4/WebCore/rendering/RenderBlock.cpp	2010-09-06 22:56:03.000000000 -0400
+@@ -1766,8 +1766,18 @@
+     if ((paintPhase == PaintPhaseOutline || paintPhase == PaintPhaseChildOutlines)) {
+         if (inlineContinuation() && inlineContinuation()->hasOutline() && inlineContinuation()->style()->visibility() == VISIBLE) {
+             RenderInline* inlineRenderer = toRenderInline(inlineContinuation()->node()->renderer());
+-            if (!inlineRenderer->hasSelfPaintingLayer())
+-                containingBlock()->addContinuationWithOutline(inlineRenderer);
++            RenderBlock* cb = containingBlock();
++
++            bool inlineEnclosedInSelfPaintingLayer = false;
++            for (RenderBoxModelObject* box = inlineRenderer; box != cb; box = box->parent()->enclosingBoxModelObject()) {
++                if (box->hasSelfPaintingLayer()) {
++                    inlineEnclosedInSelfPaintingLayer = true;
++                    break;
++                }
++            }
++
++            if (!inlineEnclosedInSelfPaintingLayer)
++                cb->addContinuationWithOutline(inlineRenderer);
+             else if (!inlineRenderer->firstLineBox())
+                 inlineRenderer->paintOutline(paintInfo.context, tx - x() + inlineRenderer->containingBlock()->x(),
+                                              ty - y() + inlineRenderer->containingBlock()->y());

=== added file 'debian/patches/cve-2010-3120.patch'
--- debian/patches/cve-2010-3120.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/cve-2010-3120.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,27 @@
+description: fix cve-2010-3120
+author: Michael Gilbert <[e-mail]>
+origin: http://trac.webkit.org/changeset/65329
+Index: webkit-1.2.4/WebCore/page/Geolocation.cpp
+===================================================================
+--- webkit-1.2.4.orig/WebCore/page/Geolocation.cpp	2010-09-03 15:18:06.000000000 -0400
++++ webkit-1.2.4/WebCore/page/Geolocation.cpp	2010-09-06 22:14:03.000000000 -0400
+@@ -252,6 +252,9 @@
+ 
+ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
+ {
++    if (!m_frame)
++        return;
++
+     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+     ASSERT(notifier);
+ 
+@@ -260,6 +263,9 @@
+ 
+ int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
+ {
++    if (!m_frame)
++        return 0;
++
+     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+     ASSERT(notifier);
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-10-21 13:40:42 +0000
+++ debian/patches/series	2010-12-16 18:14:15 +0000
@@ -1,3 +1,10 @@
 02-pool-fixup-and-sparc-support.patch
 04-spoof-user-agent-to-google.patch
+05-fix-jit-on-kfreebsd-i386.patch
+cve-2010-2646.patch
+cve-2010-2651.patch
+cve-2010-2900.patch
+cve-2010-2901.patch
+cve-2010-3120.patch
 ubuntu-gir-version.patch
+typo_webkitwebsettings.patch

=== added file 'debian/patches/typo_webkitwebsettings.patch'
--- debian/patches/typo_webkitwebsettings.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/typo_webkitwebsettings.patch	2010-12-16 18:14:15 +0000
@@ -0,0 +1,18 @@
+From: Artur Rona <[e-mail]>
+Description: Fix typo in WebKit/gtk/webkit/webkitwebsettings.cpp.
+Bug-Ubuntu: https://launchpad.net/bugs/552718
+Origin: upstream, http://trac.webkit.org/changeset/64629/
+Author: David Stansby <[e-mail]>
+
+diff -pruN -x '*~' webkit-1.2.5.orig/WebKit/gtk/webkit/webkitwebsettings.cpp webkit-1.2.5/WebKit/gtk/webkit/webkitwebsettings.cpp
+--- webkit-1.2.5.orig/WebKit/gtk/webkit/webkitwebsettings.cpp	2010-12-16 13:31:40.000000000 +0100
++++ webkit-1.2.5/WebKit/gtk/webkit/webkitwebsettings.cpp	2010-12-16 15:42:22.000000000 +0100
+@@ -578,7 +578,7 @@ static void webkit_web_settings_class_in
+                                     PROP_ENABLE_XSS_AUDITOR,
+                                     g_param_spec_boolean("enable-xss-auditor",
+                                                          _("Enable XSS Auditor"),
+-                                                         _("Whether to enable teh XSS auditor"),
++                                                         _("Whether to enable the XSS auditor"),
+                                                          TRUE,
+                                                          flags));
+     /**

=== modified file 'debian/patches/ubuntu-gir-version.patch'
--- debian/patches/ubuntu-gir-version.patch	2010-10-21 13:40:42 +0000
+++ debian/patches/ubuntu-gir-version.patch	2010-12-16 18:14:15 +0000
@@ -1,3 +1,8 @@
+From: Artur Rona <[e-mail]>
+Description: Use the 1.2 gobject introspection abi.
+Forwarded: not-needed
+Author: Robert Ancell <[e-mail]>
+
 Index: webkit-1.2.5/WebKit/gtk/JSCore-1.0.gir
 ===================================================================
 --- webkit-1.2.5.orig/WebKit/gtk/JSCore-1.0.gir	2010-09-10 23:20:33.000000000 +1000