diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 45d7f06d84369370a2553f9f8ee6c26b96b43694..6281ac2a1254c47d4eee89adb35eb27fbf6ab477 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Fix remaining Cairo build bustage from
+        https://bugs.webkit.org/show_bug.cgi?id=25709 changes.  Use
+        Vector<char> in place of std::string.
+
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::setData):
+        (WebCore::XBMImageDecoder::decodeHeader):
+        (WebCore::XBMImageDecoder::decodeDatum):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+
 2009-06-12  David Levin  <levin@chromium.org>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
index caa4f0dc2e0bbfcadeeda5ad21fbf54d382f6f82..09faca5106dd17537d76f364a954e9e70b806a2c 100644
--- a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.cpp
@@ -47,10 +47,8 @@ XBMImageDecoder::XBMImageDecoder()
 void XBMImageDecoder::setData(SharedBuffer* data, bool allDataReceived)
 {
     ImageDecoder::setData(data, allDataReceived);
-
-    const Vector<char>& buf = m_data->buffer();
-    if (buf.size() > m_xbmString.size())
-        m_xbmString.append(&buf[m_xbmString.size()], buf.size() - m_xbmString.size());
+    m_xbmString = data->buffer();
+    m_xbmString.append('\0');
 
     m_allDataReceived = allDataReceived;
 }
@@ -106,7 +104,7 @@ bool XBMImageDecoder::decodeHeader()
     ASSERT(m_decodeOffset <= m_xbmString.size());
     ASSERT(!m_decodedHeader);
 
-    const char* input = m_xbmString.c_str();
+    const char* input = m_xbmString.data();
 
     // At least 2 "#define <string> <unsigned>" sequences are required. These
     // specify the width and height of the image.
@@ -185,7 +183,7 @@ bool XBMImageDecoder::decodeHeader()
 // The checks after strtoul are based on Mozilla's nsXBMDecoder.cpp.
 bool XBMImageDecoder::decodeDatum(uint16_t* result)
 {
-    const char* input = m_xbmString.c_str();
+    const char* input = m_xbmString.data();
     char* endPtr;
     const uint16_t value = strtoul(&input[m_decodeOffset], &endPtr, 0);
 
diff --git a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
index cdcf8e6478dc675187b0f7cb8f244090e1f24763..32323643fcd462fe5ec8bec770d46aab9bbde1e2 100644
--- a/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
+++ b/WebCore/platform/image-decoders/xbm/XBMImageDecoder.h
@@ -31,7 +31,6 @@
 #ifndef XBMImageDecoder_h
 #define XBMImageDecoder_h
 
-#include <string>
 #include "ImageDecoder.h"
 
 namespace WebCore {
@@ -68,7 +67,10 @@ namespace WebCore {
         bool decodeData();
         void decodeXBM(bool sizeOnly);
 
-        std::string m_xbmString;  // Null-terminated copy of the XBM data.
+        // FIXME: Copying all the XBM data just so we can NULL-terminate, just
+        // so we can use sscanf() and friends, is lame.  The decoder should be
+        // rewritten to operate on m_data directly.
+        Vector<char> m_xbmString;  // Null-terminated copy of the XBM data.
         size_t m_decodeOffset;    // The current offset in m_xbmString for decoding.
         bool m_allDataReceived;
         bool m_decodedHeader;