diff --git a/pkgs/applications/networking/browsers/firefox/3.6.nix b/pkgs/applications/networking/browsers/firefox/3.6.nix
index f98e9465f82..bf9f2c8c189 100644
--- a/pkgs/applications/networking/browsers/firefox/3.6.nix
+++ b/pkgs/applications/networking/browsers/firefox/3.6.nix
@@ -45,10 +45,16 @@ rec {
     
     inherit src;
 
-    # To be removed when the change gets upstream. I don't know if the patch
-    # affects xulrunner or firefox.
-    patches = [ ./symlinks-bug551152.patch ./xulrunner-chromium-mips.patch
-      ./xulrunner-mips-n32.patch ];
+    patches = [
+      # To be removed when the change gets upstream. I don't know if the patch
+      # affects xulrunner or firefox.
+      ./symlinks-bug551152.patch
+
+      # Loongson2f related patches:
+      ./xulrunner-chromium-mips.patch
+      ./xulrunner-mips-n32.patch
+      ./xulrunner-1.9.2_beta4-mips-bus-error.patch
+    ];
 
     buildInputs =
       [ pkgconfig gtk perl zip libIDL libjpeg libpng zlib cairo bzip2
diff --git a/pkgs/applications/networking/browsers/firefox/xulrunner-1.9.2_beta4-mips-bus-error.patch b/pkgs/applications/networking/browsers/firefox/xulrunner-1.9.2_beta4-mips-bus-error.patch
new file mode 100644
index 00000000000..54799397f6f
--- /dev/null
+++ b/pkgs/applications/networking/browsers/firefox/xulrunner-1.9.2_beta4-mips-bus-error.patch
@@ -0,0 +1,26 @@
+http://www.gentoo-cn.org/gitweb/?p=loongson.git;a=blob;f=net-libs/xulrunner/files/xulrunner-1.9.2_beta4-mips-bus-error.patch;h=2bf51d77054796ffaf4f4d903dd8560bf96b7844;hb=HEAD
+
+--- ./xpcom/glue/nsTArray.h.orig	2009-04-26 01:21:58.000000000 +0800
++++ ./xpcom/glue/nsTArray.h	2009-04-26 01:21:33.000000000 +0800
+@@ -168,6 +168,7 @@
+ 
+     // The array's elements (prefixed with a Header).  This pointer is never
+     // null.  If the array is empty, then this will point to sEmptyHdr.
++    void   *padding;
+     Header *mHdr;
+ };
+
+diff --git a/layout/svg/base/src/nsSVGGlyphFrame.cpp b/layout/svg/base/src/nsSVGGlyphFrame.cpp
+index 6d452d0..3ce4193 100644
+--- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
++++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
+@@ -169,8 +169,8 @@ private:
+   PRBool SetupForDirectTextRun(gfxContext *aContext, float aScale);
+   void SetupFor(gfxContext *aContext, float aScale);
+ 
+-  nsSVGGlyphFrame *mSource;
+   nsAutoTArray<CharacterPosition,80> mPositions;
++  nsSVGGlyphFrame *mSource;
+   gfxMatrix mInitialMatrix;
+   // Textrun advance width from start to mCurrentChar, in appunits
+   gfxFloat mCurrentAdvance;