external/webkit r30707
SVN commits 30708-30711
Initial Contribution
This fixes two webkit bugs already fixed in the G1:

(1) Memory corruption due to dangling ownerNode pointer on JSStyleSheet
object (CVE-2008-2317). Described by: http://trac.webkit.org/changeset/37368

(2) Integer overflow in handling of JavaScript array indicees
(CVE-2008-2303). This is a slightly smaller change than the one shown by:
http://trac.webkit.org/changeset/37355
Code drop from //branches/cupcake/...@124589
Merge commit 'remotes/korg/cupcake'

Conflicts:
	JavaScriptCore/kjs/function.cpp
	JavaScriptCore/kjs/function.h
	WebCore/bindings/js/JSStyleSheetCustom.cpp
auto import from //branches/cupcake/...@125939
Merge branch 'cupcake'
auto import from //branches/cupcake/...@126645
Merge branch 'cupcake'
auto import from //branches/cupcake/...@127101
Merge branch 'cupcake'
auto import from //branches/cupcake/...@127436
Merge branch 'cupcake'
auto import from //branches/cupcake/...@130745
auto import from //branches/cupcake/...@131421
auto import from //branches/cupcake/...@132276
auto import from //branches/cupcake/...@132569
auto import from //depot/cupcake/@137055
auto import from //depot/cupcake/@132589