Merge branch '4.5' of [email protected]:qt/qt into 4.5

dist/changes-4.5.2

@@ -54,6 +54,7 @@ General Improvements
        Network (r41664, r42516, r42747)
        Plugins (r41346, r43550, r43915, r43917, r43923)
        Clipboard (r41360)
+       SVG (r43590, r43795)
 
 - QAbstractItemView
     * [250754] Changing the font of the view did not update the size of the

src/3rdparty/webkit/VERSION

@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        4ee8af9348b3f57d3c0f3575ae0a58336cf07a92
+        44bbcef18007e00c6cfee294640c5cfc9e464aa4

src/3rdparty/webkit/WebCore/ChangeLog

@@ -1,3 +1,31 @@
+2009-05-15  Adam Barth  <[email protected]>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25741
+
+        Append instead of throwing when insertItemBefore gets an out-of-bound
+        index.
+
+        Test: svg/dom/svglist-insertItemBefore-appends.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-03-19  Oliver Hunt  <[email protected]>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6702386> Incorrect bound check in SVGList::insertItemBefore
+
+        SVGList::insertItemBefore would not perform a bounds check on the
+        index it was provided, potentially leading to a buffer overflow. 
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
 2009-05-19  Kenneth Rohde Christiansen  <[email protected]>
 
         Reviewed by Simon Hausmann.

src/3rdparty/webkit/WebCore/svg/SVGList.h

@@ -96,7 +96,11 @@ namespace WebCore {
 
         Item insertItemBefore(Item newItem, unsigned int index, ExceptionCode&)
         {
-            m_vector.insert(index, newItem);
+            if (index < m_vector.size()) {
+                m_vector.insert(index, newItem);
+            } else {
+                m_vector.append(newItem);
+            }
             return newItem;
         }