Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.7

117 files changed, 2146 insertions, 669 deletions

diff --git a/bin/createpackage.pl b/bin/createpackage.pl
index 939c38e..8b787cb 100755
--- a/bin/createpackage.pl
+++ b/bin/createpackage.pl
@@ -78,6 +78,7 @@ Where supported options are as follows:
                                as a comments. Also empty lines are ignored. The paths in
                                <file> can be absolute or relative to <file>.
      [-u|unsigned]           = Preserves the unsigned package.
+     [-o|only-unsigned]      = Creates only unsigned package.
      [-s|stub]               = Generates stub sis for ROM.
      [-n|sisname <name>]     = Specifies the final sis name.
 Where parameters are as follows:
@@ -121,11 +122,13 @@ my $certfile = "";
 my $preserveUnsigned = "";
 my $stub = "";
 my $signed_sis_name = "";
+my $onlyUnsigned = "";
 
 unless (GetOptions('i|install' => \$install,
                    'p|preprocess' => \$preprocessonly,
                    'c|certfile=s' => \$certfile,
                    'u|unsigned' => \$preserveUnsigned,
+                   'o|only-unsigned' => \$onlyUnsigned,
                    's|stub' => \$stub,
                    'n|sisname=s' => \$signed_sis_name,)) {
     Usage();
@@ -292,7 +295,10 @@ if($stub) {
     # Create stub SIS.
     system ("makesis -s $pkgoutput $stub_sis_name");
 } else {
-    if ($certtext eq "Self Signed" && !@certificates && $templatepkg !~ m/_installer\.pkg$/i) {
+    if ($certtext eq "Self Signed"
+        && !@certificates
+        && $templatepkg !~ m/_installer\.pkg$/i
+        && !$onlyUnsigned) {
         print("Auto-patching capabilities for self signed package.\n");
         system ("patch_capabilities $pkgoutput");
     }
@@ -302,6 +308,25 @@ if($stub) {
     system ("makesis $pkgoutput $unsigned_sis_name") and die ("makesis failed");
     print("\n");
 
+    my $targetInsert = "";
+    if ($targetplatform ne "-") {
+        $targetInsert = " for $targetplatform";
+    }
+
+    if ($onlyUnsigned) {
+        stat($unsigned_sis_name);
+        if( -e _ ) {
+            print ("Successfully created unsigned package ${unsigned_sis_name}${targetInsert}!\n");
+        } else {
+            print ("\nUnsigned package creation failed!\n");
+        }
+
+        if (!$preservePkgOutput) {
+            unlink $pkgoutput;
+        }
+        exit;
+    }
+
     # Sign SIS with certificate info given as an argument.
     my $relcert = File::Spec->abs2rel($certificate);
     my $relkey = File::Spec->abs2rel($key);
@@ -311,11 +336,7 @@ if($stub) {
     # Check if creating signed SIS Succeeded
     stat($signed_sis_name);
     if( -e _ ) {
-        my $targetInsert = "";
-        if ($targetplatform ne "-") {
-            $targetInsert = "for $targetplatform ";
-        }
-        print ("Successfully created $signed_sis_name ${targetInsert}using certificate: $certtext!\n");
+        print ("Successfully created signed package ${signed_sis_name}${targetInsert} using certificate: $certtext!\n");
 
         # Sign with additional certificates & keys
         for my $row ( @certificates ) {
diff --git a/bin/patch_capabilities.pl b/bin/patch_capabilities.pl
index 9741bc3..501939a 100755
--- a/bin/patch_capabilities.pl
+++ b/bin/patch_capabilities.pl
@@ -269,7 +269,8 @@ if (@ARGV)
         }
 
         print ("\n");
-        print ("NOTE: A patched package should not be used for distribution!\n");
+        print ("NOTE: A patched package may not work as expected due to reduced capabilities.\n");
+        print ("      Therefore it should not be used for any kind of Symbian signing or distribution!\n");
         print ("\n");
     }
 }
diff --git a/demos/declarative/samegame/samegame.qml b/demos/declarative/samegame/samegame.qml
index 9a721da..9c4bfa8 100644
--- a/demos/declarative/samegame/samegame.qml
+++ b/demos/declarative/samegame/samegame.qml
@@ -115,6 +115,8 @@ Rectangle {
             id: nameInputText
             anchors { verticalCenter: parent.verticalCenter; left: dialogText.right }
             focus: false
+            autoScroll: false
+            maximumLength: 24
             onTextChanged: {
                 var newWidth = nameInputText.width + dialogText.width + 40;
                 if ( (newWidth > nameInputDialog.width && newWidth < screen.width) 
diff --git a/demos/declarative/snake/content/Link.qml b/demos/declarative/snake/content/Link.qml
index 9aa6006..f4d7165 100644
--- a/demos/declarative/snake/content/Link.qml
+++ b/demos/declarative/snake/content/Link.qml
@@ -73,12 +73,14 @@ Item { id:link
                 }
             }
 
+                    /*
             transform: Rotation {
                 id: actualImageRotation
                 origin.x: width/2; origin.y: height/2;
                 angle: rotation * 90
                 Behavior on angle { NumberAnimation { duration: spawned ? 200 : 0} }
             }
+            */
         }
 
         Image {
diff --git a/dist/changes-4.6.4 b/dist/changes-4.6.4
new file mode 100644
index 0000000..381023f
--- /dev/null
+++ b/dist/changes-4.6.4
@@ -0,0 +1,158 @@
+Qt 4.6.4 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 4.6.0.  For more details,
+refer to the online documentation included in this distribution. The
+documentation is also available online:
+
+  http://qt.nokia.com/doc/4.6
+
+The Qt version 4.6 series is binary compatible with the 4.5.x series.
+Applications compiled for 4.5 will continue to run with 4.6.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker or the Merge Request queue
+of the public source repository.
+
+Qt Bug Tracker: http://bugreports.qt.nokia.com
+Merge Request:  http://qt.gitorious.org
+
+****************************************************************************
+*                           General                                        *
+****************************************************************************
+
+New features
+------------
+
+ - SomeClass, SomeOtherClass
+    * New classes for foo, bar and baz
+
+Optimizations
+-------------
+
+ - Optimized foo in QSomeClass
+    * See list of Important Behavior Changes below
+
+
+****************************************************************************
+*                          Library                                         *
+****************************************************************************
+
+QtCore
+------
+
+ - foo
+    * bar
+
+QtGui
+-----
+
+ - foo
+    * bar
+
+QtDBus
+------
+
+ - foo
+    * bar
+
+QtNetwork
+---------
+
+ - foo
+    * bar
+
+QtOpenGL
+--------
+
+ - foo
+    * bar
+
+QtScript
+--------
+
+ - foo
+    * bar
+
+QtSql
+-----
+
+ - foo
+    * bar
+
+QtXml
+-----
+
+ - foo
+    * bar
+
+Qt Plugins
+----------
+
+ - foo
+    * bar
+
+Third party components
+----------------------
+
+ - Updated foo to version 2.3.9.
+
+ - Updated bar to the latest version from baz.org.
+
+
+****************************************************************************
+*                      Platform Specific Changes                           *
+****************************************************************************
+
+Qt for Unix (X11 and Mac OS X)
+------------------------------
+
+ - 
+
+Qt for Linux/X11
+----------------
+
+ -
+
+Qt for Windows
+--------------
+
+ -
+
+Qt for Mac OS X
+---------------
+
+ -
+
+Qt for Embedded Linux
+---------------------
+
+ -
+
+DirectFB
+--------
+
+ -
+
+Qt for Windows CE
+-----------------
+
+ -
+
+****************************************************************************
+*                          Tools                                           *
+****************************************************************************
+
+ - Designer
+   * foo
+
+ - qdoc3
+   * bar
+
+ - Linguist
+   * baz
+
+****************************************************************************
+* Important Behavior Changes *
+****************************************************************************
+
+ -
+
diff --git a/dist/changes-4.7.0 b/dist/changes-4.7.0
index 95cff56..c19bf15 100644
--- a/dist/changes-4.7.0
+++ b/dist/changes-4.7.0
@@ -377,3 +377,9 @@ QtCore:
     ABIs, but it also allowed for unaligned access. Qt never generates
     or uses unaligned access and the new EABI aligns as expected, so
     the flag was removed.
+
+QtNetwork:
+  - Qt does no longer provide its own CA bundle, but uses system APIs for
+    retrieving the default system certificates. On Symbian,
+    QSslSocket::systemCaCertificates() provides an empty list of
+    certificates.
diff --git a/doc/src/declarative/extending.qdoc b/doc/src/declarative/extending.qdoc
index 173fb6d..03c0ec4 100644
--- a/doc/src/declarative/extending.qdoc
+++ b/doc/src/declarative/extending.qdoc
@@ -425,6 +425,9 @@ value will not be accessible from script.
 \l {Extending QML - Signal Support Example} shows the complete code used to
 implement the onPartyStarted signal property.
 
+If you want to use signals from items not created in QML, you can access their
+signals with the \l {Connections} element.
+
 \section1 Property Value Sources
 
 \snippet examples/declarative/cppextensions/referenceexamples/valuesource/example.qml 0
diff --git a/doc/src/declarative/qtbinding.qdoc b/doc/src/declarative/qtbinding.qdoc
index 7d696d7..784c59a 100644
--- a/doc/src/declarative/qtbinding.qdoc
+++ b/doc/src/declarative/qtbinding.qdoc
@@ -269,5 +269,10 @@ For example:
 \c [project/main.qml]
 \snippet doc/src/snippets/declarative/qtbinding/resources/main.qml 0
 
+Note that the resource system cannot be accessed from QML directly. If the main QML file is
+loaded as a resource, all files specifed as relative paths in QML will also be loaded from
+the resource system. Using the resource system is completely transparent to the QML layer.
+This also means that if the main QML file is not loaded as a resource then files in the resource
+system cannot be accessed from QML.
 */
 
diff --git a/doc/src/platforms/symbian-introduction.qdoc b/doc/src/platforms/symbian-introduction.qdoc
index 6ffc568..316764b 100644
--- a/doc/src/platforms/symbian-introduction.qdoc
+++ b/doc/src/platforms/symbian-introduction.qdoc
@@ -127,6 +127,7 @@
     \row \o \c run           \o Run the application on the emulator.
     \row \o \c runonphone    \o Run the application on a device.
     \row \o \c sis           \o Create signed \c .sis file for project.
+    \row \o \c unsigned_sis  \o Create unsigned \c .sis file for project.
     \row \o \c installer_sis \o Create signed \l{Smart Installer}{smart installer}
                                 \c .sis file for project.
                                 Smart installer will attempt to download
@@ -193,6 +194,7 @@
     \row \o -p                  \o Only preprocess the template \c .pkg file.
     \row \o -c <file>           \o Read certificate information from a file.
     \row \o -u                  \o Preserves unsigned package.
+    \row \o -o                  \o Creates only unsigned package.
     \row \o -s                  \o Generates stub sis for ROM.
     \row \o -n <name>           \o Specifies the final sis name.
     \endtable
diff --git a/examples/declarative/toys/clocks/content/center.png b/examples/declarative/toys/clocks/content/center.png
index 7fbd802..7fbd802 100755..100644
--- a/examples/declarative/toys/clocks/content/center.png
+++ b/examples/declarative/toys/clocks/content/center.png
diff --git a/examples/declarative/toys/clocks/content/clock-night.png b/examples/declarative/toys/clocks/content/clock-night.png
index cc7151a..cc7151a 100755..100644
--- a/examples/declarative/toys/clocks/content/clock-night.png
+++ b/examples/declarative/toys/clocks/content/clock-night.png
diff --git a/examples/declarative/toys/clocks/content/clock.png b/examples/declarative/toys/clocks/content/clock.png
index 462edac..462edac 100755..100644
--- a/examples/declarative/toys/clocks/content/clock.png
+++ b/examples/declarative/toys/clocks/content/clock.png
diff --git a/examples/declarative/toys/clocks/content/hour.png b/examples/declarative/toys/clocks/content/hour.png
index f8061a1..f8061a1 100755..100644
--- a/examples/declarative/toys/clocks/content/hour.png
+++ b/examples/declarative/toys/clocks/content/hour.png
diff --git a/examples/declarative/toys/clocks/content/minute.png b/examples/declarative/toys/clocks/content/minute.png
index 1297ec7..1297ec7 100755..100644
--- a/examples/declarative/toys/clocks/content/minute.png
+++ b/examples/declarative/toys/clocks/content/minute.png
diff --git a/examples/declarative/toys/clocks/content/second.png b/examples/declarative/toys/clocks/content/second.png
index 4aa9fb5..4aa9fb5 100755..100644
--- a/examples/declarative/toys/clocks/content/second.png
+++ b/examples/declarative/toys/clocks/content/second.png
diff --git a/examples/multimedia/videographicsitem/videoplayer.cpp b/examples/multimedia/videographicsitem/videoplayer.cpp
index 281cd6e..f98f542 100644
--- a/examples/multimedia/videographicsitem/videoplayer.cpp
+++ b/examples/multimedia/videographicsitem/videoplayer.cpp
@@ -115,7 +115,20 @@ VideoPlayer::~VideoPlayer()
 
 void VideoPlayer::openFile()
 {
-    QString fileName = QFileDialog::getOpenFileName(this, tr("Open Movie"));
+    QStringList supportedFormats;
+    foreach (QString fmt, QMovie::supportedFormats())
+        supportedFormats << fmt;
+    foreach (QString fmt, QImageReader::supportedImageFormats())
+        supportedFormats << fmt;
+
+    QString filter = "Images (";
+    foreach ( QString fmt, supportedFormats) {
+        filter.append(QString("*.%1 ").arg(fmt));
+    }
+    filter.append(")");
+
+    QString fileName = QFileDialog::getOpenFileName(this, tr("Open Movie"),
+            QDir::homePath(), filter);
 
     if (!fileName.isEmpty()) {
         videoItem->stop();
diff --git a/examples/multimedia/videowidget/videoplayer.cpp b/examples/multimedia/videowidget/videoplayer.cpp
index 87a2621..ad12069 100644
--- a/examples/multimedia/videowidget/videoplayer.cpp
+++ b/examples/multimedia/videowidget/videoplayer.cpp
@@ -96,7 +96,20 @@ VideoPlayer::~VideoPlayer()
 
 void VideoPlayer::openFile()
 {
-    QString fileName = QFileDialog::getOpenFileName(this, tr("Open Movie"));
+    QStringList supportedFormats;
+    foreach (QString fmt, QMovie::supportedFormats())
+        supportedFormats << fmt;
+    foreach (QString fmt, QImageReader::supportedImageFormats())
+        supportedFormats << fmt;
+
+    QString filter = "Images (";
+    foreach ( QString fmt, supportedFormats) {
+        filter.append(QString("*.%1 ").arg(fmt));
+    }
+    filter.append(")");
+
+    QString fileName = QFileDialog::getOpenFileName(this, tr("Open Movie"),
+            QDir::homePath(), filter);
 
     if (!fileName.isEmpty()) {
         surface->stop();
diff --git a/mkspecs/features/sis_targets.prf b/mkspecs/features/sis_targets.prf
index b149a22..37b758b 100644
--- a/mkspecs/features/sis_targets.prf
+++ b/mkspecs/features/sis_targets.prf
@@ -32,6 +32,24 @@ equals(GENERATE_SIS_TARGETS, true) {
         ok_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) $$basename(TARGET)_template.pkg \
                                      $(QT_SIS_TARGET) $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
 
+        unsigned_sis_target.target = unsigned_sis
+        unsigned_sis_target.commands = $(if $(wildcard $$basename(TARGET)_template.pkg), \
+                                  $(if $(wildcard $$make_cache_name), \
+                                      $(MAKE) -f $(MAKEFILE) ok_unsigned_sis MAKEFILES=$$make_cache_name \
+                                  , \
+                                      $(if $(QT_SIS_TARGET), \
+                                          $(MAKE) -f $(MAKEFILE) ok_unsigned_sis \
+                                      , \
+                                          $(MAKE) -f $(MAKEFILE) fail_sis_nocache \
+                                      ) \
+                                  ) \
+                              , \
+                                  $(MAKE) -f $(MAKEFILE) fail_sis_nopkg \
+                              )
+
+        ok_unsigned_sis_target.target = ok_unsigned_sis
+        ok_unsigned_sis_target.commands = createpackage.bat $(QT_SIS_OPTIONS) -o $$basename(TARGET)_template.pkg $(QT_SIS_TARGET)
+
         target_sis_target.target = $${sis_destdir}$${TARGET}.sis
         target_sis_target.commands = $(MAKE) -f $(MAKEFILE) sis
 
@@ -74,6 +92,8 @@ equals(GENERATE_SIS_TARGETS, true) {
 
         QMAKE_EXTRA_TARGETS += sis_target \
                                ok_sis_target \
+                               unsigned_sis_target \
+                               ok_unsigned_sis_target \
                                target_sis_target \
                                installer_sis_target \
                                ok_installer_sis_target \
@@ -114,6 +134,10 @@ equals(GENERATE_SIS_TARGETS, true) {
                                   - $(QT_SIS_CERTIFICATE) $(QT_SIS_KEY) $(QT_SIS_PASSPHRASE)
         sis_target.depends = first
 
+        unsigned_sis_target.target = unsigned_sis
+        unsigned_sis_target.commands = createpackage $(QT_SIS_OPTIONS) -o $$basename(TARGET)_template.pkg
+        unsigned_sis_target.depends = first
+
         target_sis_target.target = $${sis_destdir}$${TARGET}.sis
         target_sis_target.commands = $(MAKE) -f $(MAKEFILE) sis
 
@@ -128,6 +152,7 @@ equals(GENERATE_SIS_TARGETS, true) {
         }
 
         QMAKE_EXTRA_TARGETS += sis_target \
+                               unsigned_sis_target \
                                target_sis_target \
                                installer_sis_target
     }
diff --git a/qmake/generators/win32/msbuild_objectmodel.cpp b/qmake/generators/win32/msbuild_objectmodel.cpp
index 75fc910..bf874b2 100644
--- a/qmake/generators/win32/msbuild_objectmodel.cpp
+++ b/qmake/generators/win32/msbuild_objectmodel.cpp
@@ -385,6 +385,7 @@ VCXCLCompilerTool::VCXCLCompilerTool()
         DisableLanguageExtensions(unset),
         EnableFiberSafeOptimizations(unset),
         EnablePREfast(unset),
+        ExceptionHandling("false"),
         ExpandAttributedSource(unset),
         FloatingPointExceptions(unset),
         ForceConformanceInForLoopScope(unset),
diff --git a/qmake/generators/win32/msvc_objectmodel.cpp b/qmake/generators/win32/msvc_objectmodel.cpp
index 1e060a0..e23e119 100644
--- a/qmake/generators/win32/msvc_objectmodel.cpp
+++ b/qmake/generators/win32/msvc_objectmodel.cpp
@@ -360,8 +360,11 @@ inline XmlOutput::xml_output xformUsePrecompiledHeaderForNET2005(pchOption whatP
 
 inline XmlOutput::xml_output xformExceptionHandlingNET2005(exceptionHandling eh, DotNET compilerVersion)
 {
-    if (eh == ehDefault)
-        return noxml();
+    if (eh == ehDefault) {
+        if (compilerVersion >= NET2005)
+            return attrE(_ExceptionHandling, ehNone);
+        return attrS(_ExceptionHandling, "false");
+    }
 
     if (compilerVersion >= NET2005)
         return attrE(_ExceptionHandling, eh);
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h b/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
index b134407..0d7c2c2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
@@ -32,6 +32,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 typedef struct HB_GlyphItemRec_ {
   HB_UInt     gindex;
   HB_UInt     properties;
@@ -48,13 +52,13 @@ typedef struct HB_PositionRec_ {
   HB_Fixed   y_advance;
   HB_UShort  back;            /* number of glyphs to go back
 				 for drawing current glyph   */
+  HB_Short  cursive_chain;   /* character to which this connects,
+				 may be positive or negative; used
+				 only internally                     */
   HB_Bool    new_advance;     /* if set, the advance width values are
 				 absolute, i.e., they won't be
 				 added to the original glyph's value
 				 but rather replace them.            */
-  HB_Short  cursive_chain;   /* character to which this connects,
-				 may be positive or negative; used
-				 only internally                     */
 } HB_PositionRec, *HB_Position;
 
 
@@ -66,12 +70,12 @@ typedef struct HB_BufferRec_{
   HB_UInt    in_pos;
   HB_UInt    out_pos;
   
-  HB_Bool       separate_out;
   HB_GlyphItem  in_string;
   HB_GlyphItem  out_string;
   HB_GlyphItem  alt_string;
   HB_Position   positions;
   HB_UShort      max_ligID;
+  HB_Bool       separate_out;
 } HB_BufferRec, *HB_Buffer;
 
 HB_Error
@@ -89,6 +93,10 @@ hb_buffer_add_glyph( HB_Buffer buffer,
 		      HB_UInt    properties,
 		      HB_UInt    cluster );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_BUFFER_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-dump.c b/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
index 8c81da1..54d42e9 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
@@ -519,13 +519,14 @@ Dump_ValueRecord (HB_ValueRecord *ValueRecord, FILE *stream, int indent, HB_Type
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE)
     DUMP_FINT (ValueRecord, XAdvance);
   if (value_format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->XPlacementDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_X_PLACEMENT_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->YPlacementDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_Y_PLACEMENT_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->XAdvanceDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_X_ADVANCE_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->YAdvanceDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_Y_ADVANCE_DEVICE]);
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   if (value_format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT)
     DUMP_FUINT (ValueRecord, XIdPlacement);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ID_PLACEMENT)
@@ -534,6 +535,7 @@ Dump_ValueRecord (HB_ValueRecord *ValueRecord, FILE *stream, int indent, HB_Type
     DUMP_FUINT (ValueRecord, XIdAdvance);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ID_ADVANCE)
     DUMP_FUINT (ValueRecord, XIdAdvance);
+#endif
 }
 
 static void
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-external.h b/src/3rdparty/harfbuzz/src/harfbuzz-external.h
index 760749b..7644f0d 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-external.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-external.h
@@ -146,11 +146,7 @@ HB_CharCategory HB_GetUnicodeCharCategory(HB_UChar32 ch);
 int HB_GetUnicodeCharCombiningClass(HB_UChar32 ch);
 HB_UChar16 HB_GetMirroredChar(HB_UChar16 ch);
 
-void *HB_Library_Resolve(const char *library, const char *symbol);
-
-void *HB_TextCodecForMib(int mib);
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength);
-void HB_TextCodec_FreeResult(char *);
+void *HB_Library_Resolve(const char *library, int version, const char *symbol);
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
index da06b6f..2a6d958 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
@@ -34,12 +34,16 @@
 HB_BEGIN_HEADER
 
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Attachment related structures */
 
 struct  HB_AttachPoint_
 {
-  HB_UShort   PointCount;             /* size of the PointIndex array */
   HB_UShort*  PointIndex;             /* array of contour points      */
+  HB_UShort   PointCount;             /* size of the PointIndex array */
 };
 
 /* Ligature Caret related structures */
@@ -62,32 +66,36 @@ typedef struct HB_CaretValueFormat2_  HB_CaretValueFormat2;
 
 struct  HB_CaretValueFormat3_
 {
+  HB_Device*  Device;                 /* Device table for x or y value  */
   HB_Short    Coordinate;             /* x or y value (in design units) */
-  HB_Device  Device;                 /* Device table for x or y value  */
 };
 
 typedef struct HB_CaretValueFormat3_  HB_CaretValueFormat3;
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 struct  HB_CaretValueFormat4_
 {
   HB_UShort  IdCaretValue;            /* metric ID */
 };
 
 typedef struct HB_CaretValueFormat4_  HB_CaretValueFormat4;
+#endif
 
 
 struct  HB_CaretValue_
 {
-  HB_UShort  CaretValueFormat;        /* 1, 2, 3, or 4 */
-
   union
   {
     HB_CaretValueFormat1  cvf1;
     HB_CaretValueFormat2  cvf2;
     HB_CaretValueFormat3  cvf3;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     HB_CaretValueFormat4  cvf4;
+#endif
   } cvf;
+
+  HB_Byte  CaretValueFormat;          /* 1, 2, 3, or 4 */
 };
 
 typedef struct HB_CaretValue_  HB_CaretValue;
@@ -95,10 +103,9 @@ typedef struct HB_CaretValue_  HB_CaretValue;
 
 struct  HB_LigGlyph_
 {
-  HB_Bool          loaded;
-
-  HB_UShort        CaretCount;        /* number of caret values */
   HB_CaretValue*  CaretValue;        /* array of caret values  */
+  HB_UShort        CaretCount;        /* number of caret values */
+  HB_Bool          loaded;
 };
 
 
@@ -119,6 +126,10 @@ _HB_GDEF_LoadMarkAttachClassDef_From_LookupFlags( HB_GDEFHeader* gdef,
 						  HB_Lookup*     lo,
 						  HB_UShort      num_lookups );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GDEF_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
index ff3a1f4..c0c6f2c 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
@@ -442,7 +442,11 @@ static HB_Error  Load_CaretValue( HB_CaretValue*  cv,
     if ( ACCESS_Frame( 2L ) )
       return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     cv->cvf.cvf4.IdCaretValue = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
     break;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
index b6dcadc..f9a03dd 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
@@ -31,6 +31,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* GDEF glyph properties.  Note that HB_GDEF_COMPONENT has no corresponding
  * flag in the LookupFlag field.     */
 #define HB_GDEF_BASE_GLYPH  0x0002
@@ -44,12 +48,11 @@ typedef struct HB_AttachPoint_  HB_AttachPoint;
 
 struct  HB_AttachList_
 {
-  HB_Bool           loaded;
-
+  HB_AttachPoint*   AttachPoint;      /* array of AttachPoint tables */
   HB_Coverage       Coverage;         /* Coverage table              */
   HB_UShort         GlyphCount;       /* number of glyphs with
 					 attachments                 */
-  HB_AttachPoint*   AttachPoint;      /* array of AttachPoint tables */
+  HB_Bool           loaded;
 };
 
 typedef struct HB_AttachList_  HB_AttachList;
@@ -58,11 +61,10 @@ typedef struct HB_LigGlyph_  HB_LigGlyph;
 
 struct  HB_LigCaretList_
 {
-  HB_Bool        loaded;
-
+  HB_LigGlyph*   LigGlyph;            /* array of LigGlyph tables  */
   HB_Coverage    Coverage;            /* Coverage table            */
   HB_UShort      LigGlyphCount;       /* number of ligature glyphs */
-  HB_LigGlyph*   LigGlyph;            /* array of LigGlyph tables  */
+  HB_Bool        loaded;
 };
 
 typedef struct HB_LigCaretList_  HB_LigCaretList;
@@ -91,18 +93,18 @@ typedef struct HB_LigCaretList_  HB_LigCaretList;
 
 struct  HB_GDEFHeader_
 {
+  HB_UShort**          NewGlyphClasses;
   HB_UInt             offset;
+  HB_UInt             MarkAttachClassDef_offset;
 
   HB_16Dot16             Version;
 
   HB_ClassDefinition   GlyphClassDef;
   HB_AttachList        AttachList;
   HB_LigCaretList      LigCaretList;
-  HB_UInt             MarkAttachClassDef_offset;
   HB_ClassDefinition   MarkAttachClassDef;        /* new in OT 1.2 */
 
   HB_UShort            LastGlyph;
-  HB_UShort**          NewGlyphClasses;
 };
 
 typedef struct HB_GDEFHeader_   HB_GDEFHeader;
@@ -129,6 +131,9 @@ HB_Error  HB_GDEF_Build_ClassDefinition( HB_GDEFHeader*  gdef,
 					 HB_UShort*       glyph_array,
 					 HB_UShort*       class_array );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-global.h b/src/3rdparty/harfbuzz/src/harfbuzz-global.h
index d4e6b46..5b2b679 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-global.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-global.h
@@ -39,6 +39,10 @@
 #define HB_END_HEADER  /* nothing */
 #endif
 
+#if defined(__GNUC__) || defined(__ARMCC__) || defined(__CC_ARM) || defined(_MSC_VER)
+#define HB_USE_PACKED_STRUCTS
+#endif
+
 HB_BEGIN_HEADER
 
 #ifndef FALSE
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
index 4110700..39f3159 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
@@ -32,9 +32,17 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
 
 /* shared tables */
 
+#define VR_X_PLACEMENT_DEVICE 0
+#define VR_Y_PLACEMENT_DEVICE 1
+#define VR_X_ADVANCE_DEVICE   2
+#define VR_Y_ADVANCE_DEVICE   3
+
 struct  HB_ValueRecord_
 {
   HB_Short    XPlacement;             /* horizontal adjustment for
@@ -45,18 +53,16 @@ struct  HB_ValueRecord_
 					 advance                        */
   HB_Short    YAdvance;               /* vertical adjustment for
 					 advance                        */
-  HB_Device  XPlacementDevice;       /* device table for horizontal
-					 placement                      */
-  HB_Device  YPlacementDevice;       /* device table for vertical
-					 placement                      */
-  HB_Device  XAdvanceDevice;         /* device table for horizontal
-					 advance                        */
-  HB_Device  YAdvanceDevice;         /* device table for vertical
-					 advance                        */
+
+  HB_Device** DeviceTables;           /* device tables for placement
+					 and advance                    */
+
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_UShort   XIdPlacement;           /* horizontal placement metric ID */
   HB_UShort   YIdPlacement;           /* vertical placement metric ID   */
   HB_UShort   XIdAdvance;             /* horizontal advance metric ID   */
   HB_UShort   YIdAdvance;             /* vertical advance metric ID     */
+#endif
 };
 
 typedef struct HB_ValueRecord_  HB_ValueRecord;
@@ -65,6 +71,8 @@ typedef struct HB_ValueRecord_  HB_ValueRecord;
 /* Mask values to scan the value format of the ValueRecord structure.
  We always expand compressed ValueRecords of the font.              */
 
+#define HB_GPOS_FORMAT_HAVE_DEVICE_TABLES       0x00F0
+
 #define HB_GPOS_FORMAT_HAVE_X_PLACEMENT         0x0001
 #define HB_GPOS_FORMAT_HAVE_Y_PLACEMENT         0x0002
 #define HB_GPOS_FORMAT_HAVE_X_ADVANCE           0x0004
@@ -97,18 +105,20 @@ struct  HB_AnchorFormat2_
 
 typedef struct HB_AnchorFormat2_  HB_AnchorFormat2;
 
+#define AF3_X_DEVICE_TABLE 0
+#define AF3_Y_DEVICE_TABLE 1
 
 struct  HB_AnchorFormat3_
 {
   HB_Short    XCoordinate;            /* horizontal value              */
   HB_Short    YCoordinate;            /* vertical value                */
-  HB_Device  XDeviceTable;           /* device table for X coordinate */
-  HB_Device  YDeviceTable;           /* device table for Y coordinate */
+  HB_Device** DeviceTables;           /* device tables for coordinates */
 };
 
 typedef struct HB_AnchorFormat3_  HB_AnchorFormat3;
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 struct  HB_AnchorFormat4_
 {
   HB_UShort  XIdAnchor;               /* horizontal metric ID */
@@ -116,11 +126,12 @@ struct  HB_AnchorFormat4_
 };
 
 typedef struct HB_AnchorFormat4_  HB_AnchorFormat4;
+#endif
 
 
 struct  HB_Anchor_
 {
-  HB_UShort  PosFormat;               /* 1, 2, 3, or 4 -- 0 indicates
+  HB_Byte  PosFormat;                 /* 1, 2, 3, or 4 -- 0 indicates
 					 that there is no Anchor table */
 
   union
@@ -128,7 +139,9 @@ struct  HB_Anchor_
     HB_AnchorFormat1  af1;
     HB_AnchorFormat2  af2;
     HB_AnchorFormat3  af3;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     HB_AnchorFormat4  af4;
+#endif
   } af;
 };
 
@@ -175,7 +188,7 @@ typedef struct HB_SinglePosFormat2_  HB_SinglePosFormat2;
 
 struct  HB_SinglePos_
 {
-  HB_UShort     PosFormat;            /* 1 or 2         */
+  HB_Byte       PosFormat;            /* 1 or 2         */
   HB_Coverage  Coverage;             /* Coverage table */
 
   HB_UShort     ValueFormat;          /* format of ValueRecord table */
@@ -255,7 +268,7 @@ typedef struct HB_PairPosFormat2_  HB_PairPosFormat2;
 
 struct  HB_PairPos_
 {
-  HB_UShort     PosFormat;            /* 1 or 2         */
+  HB_Byte       PosFormat;            /* 1 or 2         */
   HB_Coverage  Coverage;             /* Coverage table */
   HB_UShort     ValueFormat1;         /* format of ValueRecord table
 					 for first glyph             */
@@ -507,7 +520,7 @@ typedef struct HB_ContextPosFormat3_  HB_ContextPosFormat3;
 
 struct  HB_ContextPos_
 {
-  HB_UShort  PosFormat;               /* 1, 2, or 3     */
+  HB_Byte  PosFormat;                 /* 1, 2, or 3     */
 
   union
   {
@@ -524,18 +537,18 @@ typedef struct HB_ContextPos_  HB_ContextPos;
 
 struct  HB_ChainPosRule_
 {
+  HB_UShort*            Backtrack;    /* array of backtrack glyph IDs     */
+  HB_UShort*            Input;        /* array of input glyph IDs         */
+  HB_UShort*            Lookahead;    /* array of lookahead glyph IDs     */
+  HB_PosLookupRecord*  PosLookupRecord;
+				      /* array of PosLookupRecords       */
   HB_UShort             BacktrackGlyphCount;
 				      /* total number of backtrack glyphs */
-  HB_UShort*            Backtrack;    /* array of backtrack glyph IDs     */
   HB_UShort             InputGlyphCount;
 				      /* total number of input glyphs     */
-  HB_UShort*            Input;        /* array of input glyph IDs         */
   HB_UShort             LookaheadGlyphCount;
 				      /* total number of lookahead glyphs */
-  HB_UShort*            Lookahead;    /* array of lookahead glyph IDs     */
   HB_UShort             PosCount;     /* number of PosLookupRecords       */
-  HB_PosLookupRecord*  PosLookupRecord;
-				      /* array of PosLookupRecords       */
 };
 
 typedef struct HB_ChainPosRule_  HB_ChainPosRule;
@@ -565,20 +578,20 @@ typedef struct HB_ChainContextPosFormat1_  HB_ChainContextPosFormat1;
 
 struct  HB_ChainPosClassRule_
 {
+  HB_UShort*            Backtrack;    /* array of backtrack classes      */
+  HB_UShort*            Input;        /* array of context classes        */
+  HB_UShort*            Lookahead;    /* array of lookahead classes      */
+  HB_PosLookupRecord*  PosLookupRecord;
+				      /* array of substitution lookups   */
   HB_UShort             BacktrackGlyphCount;
 				      /* total number of backtrack
 					 classes                         */
-  HB_UShort*            Backtrack;    /* array of backtrack classes      */
   HB_UShort             InputGlyphCount;
 				      /* total number of context classes */
-  HB_UShort*            Input;        /* array of context classes        */
   HB_UShort             LookaheadGlyphCount;
 				      /* total number of lookahead
 					 classes                         */
-  HB_UShort*            Lookahead;    /* array of lookahead classes      */
   HB_UShort             PosCount;     /* number of PosLookupRecords      */
-  HB_PosLookupRecord*  PosLookupRecord;
-				      /* array of substitution lookups   */
 };
 
 typedef struct HB_ChainPosClassRule_  HB_ChainPosClassRule;
@@ -656,7 +669,7 @@ typedef struct HB_ChainContextPosFormat3_  HB_ChainContextPosFormat3;
 
 struct  HB_ChainContextPos_
 {
-  HB_UShort  PosFormat;             /* 1, 2, or 3 */
+  HB_Byte  PosFormat;               /* 1, 2, or 3 */
 
   union
   {
@@ -707,6 +720,10 @@ HB_INTERNAL void
 _HB_GPOS_Free_SubTable( HB_GPOS_SubTable* st,
 			      HB_UShort     lookup_type );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GPOS_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
index 356dc01..d71a85e 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
@@ -57,6 +57,7 @@ static HB_Error  GPOS_Do_Glyph_Lookup( GPOS_Instance*    gpi,
 
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 /* the client application must replace this with something more
    meaningful if multiple master fonts are to be supported.     */
 
@@ -71,6 +72,7 @@ static HB_Error  default_mmfunc( HB_Font      font,
   HB_UNUSED(data);
   return ERR(HB_Err_Not_Covered); /* ERR() call intended */
 }
+#endif
 
 
 
@@ -97,7 +99,9 @@ HB_Error  HB_Load_GPOS_Table( HB_Stream stream,
   if ( ALLOC ( gpos, sizeof( *gpos ) ) )
     return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   gpos->mmfunc = default_mmfunc;
+#endif
 
   /* skip version */
 
@@ -252,6 +256,20 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
   else
     vr->YAdvance = 0;
 
+  if ( format & HB_GPOS_FORMAT_HAVE_DEVICE_TABLES )
+  {
+    if ( ALLOC_ARRAY( vr->DeviceTables, 4, HB_Device ) )
+      return error;
+    vr->DeviceTables[VR_X_ADVANCE_DEVICE] = 0;
+    vr->DeviceTables[VR_Y_ADVANCE_DEVICE] = 0;
+    vr->DeviceTables[VR_X_PLACEMENT_DEVICE] = 0;
+    vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] = 0;
+  }
+  else
+  {
+    vr->DeviceTables = 0;
+  }
+
   if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
   {
     if ( ACCESS_Frame( 2L ) )
@@ -267,20 +285,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->XPlacementDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	return error;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty1;
-  }
-  else
-  {
-  empty1:
-    vr->XPlacementDevice.StartSize  = 0;
-    vr->XPlacementDevice.EndSize    = 0;
-    vr->XPlacementDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
@@ -298,20 +307,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->YPlacementDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail3;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty2;
-  }
-  else
-  {
-  empty2:
-    vr->YPlacementDevice.StartSize  = 0;
-    vr->YPlacementDevice.EndSize    = 0;
-    vr->YPlacementDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
@@ -329,20 +329,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->XAdvanceDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail2;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty3;
-  }
-  else
-  {
-  empty3:
-    vr->XAdvanceDevice.StartSize  = 0;
-    vr->XAdvanceDevice.EndSize    = 0;
-    vr->XAdvanceDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
@@ -360,20 +351,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->YAdvanceDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail1;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty4;
-  }
-  else
-  {
-  empty4:
-    vr->YAdvanceDevice.StartSize  = 0;
-    vr->YAdvanceDevice.EndSize    = 0;
-    vr->YAdvanceDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT )
@@ -381,59 +363,85 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->XIdPlacement = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->XIdPlacement = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ID_PLACEMENT )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->YIdPlacement = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->YIdPlacement = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_ADVANCE )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->XIdAdvance = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->XIdAdvance = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ID_ADVANCE )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->YIdAdvance = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->YIdAdvance = 0;
+#endif
 
   return HB_Err_Ok;
 
 Fail1:
-  _HB_OPEN_Free_Device( &vr->YAdvanceDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
 
 Fail2:
-  _HB_OPEN_Free_Device( &vr->XAdvanceDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
 
 Fail3:
-  _HB_OPEN_Free_Device( &vr->YPlacementDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
+
+  FREE( vr->DeviceTables );
   return error;
 }
 
@@ -442,13 +450,14 @@ static void  Free_ValueRecord( HB_ValueRecord*  vr,
 			       HB_UShort         format )
 {
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->YAdvanceDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->XAdvanceDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->YPlacementDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->XPlacementDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE] );
+  FREE( vr->DeviceTables );
 }
 
 
@@ -457,10 +466,12 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
 				  HB_UShort         format,
 				  HB_Position      gd )
 {
-  HB_Fixed           value;
   HB_Short         pixel_value;
   HB_Error         error = HB_Err_Ok;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_GPOSHeader*  gpos = gpi->gpos;
+  HB_Fixed           value;
+#endif
 
   HB_UShort  x_ppem, y_ppem;
   HB_16Dot16   x_scale, y_scale;
@@ -489,28 +500,39 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
   {
     /* pixel -> fractional pixel */
 
+    if ( format & HB_GPOS_FORMAT_HAVE_DEVICE_TABLES )
+    {
+      if ( ALLOC_ARRAY( vr->DeviceTables, 4, HB_Device ) )
+        return error;
+      vr->DeviceTables[VR_X_ADVANCE_DEVICE] = 0;
+      vr->DeviceTables[VR_Y_ADVANCE_DEVICE] = 0;
+      vr->DeviceTables[VR_X_PLACEMENT_DEVICE] = 0;
+      vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] = 0;
+    }
+
     if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->XPlacementDevice, x_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE], x_ppem, &pixel_value );
       gd->x_pos += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->YPlacementDevice, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE], y_ppem, &pixel_value );
       gd->y_pos += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->XAdvanceDevice, x_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE], x_ppem, &pixel_value );
       gd->x_advance += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->YAdvanceDevice, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE], y_ppem, &pixel_value );
       gd->y_advance += pixel_value << 6;
     }
   }
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   /* values returned from mmfunc() are already in fractional pixels */
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT )
@@ -545,6 +567,7 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
       return error;
     gd->y_advance += value;
   }
+#endif
 
   return error;
 }
@@ -608,21 +631,21 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
 
     if ( new_offset )
     {
+      if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+        return error;
+
+      an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] = 0;
+      an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] = 0;
+
       new_offset += base_offset;
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &an->af.af3.XDeviceTable,
+	   ( error = _HB_OPEN_Load_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE],
 				  stream ) ) != HB_Err_Ok )
 	return error;
       (void)FILE_Seek( cur_offset );
     }
-    else
-    {
-      an->af.af3.XDeviceTable.StartSize  = 0;
-      an->af.af3.XDeviceTable.EndSize    = 0;
-      an->af.af3.XDeviceTable.DeltaValue = NULL;
-    }
 
     if ( ACCESS_Frame( 2L ) )
       goto Fail;
@@ -633,29 +656,37 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
 
     if ( new_offset )
     {
+      if ( !an->af.af3.DeviceTables )
+      {
+        if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+          return error;
+
+        an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] = 0;
+        an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] = 0;
+      }
+
       new_offset += base_offset;
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &an->af.af3.YDeviceTable,
+	   ( error = _HB_OPEN_Load_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail;
       (void)FILE_Seek( cur_offset );
     }
-    else
-    {
-      an->af.af3.YDeviceTable.StartSize  = 0;
-      an->af.af3.YDeviceTable.EndSize    = 0;
-      an->af.af3.YDeviceTable.DeltaValue = NULL;
-    }
     break;
 
   case 4:
     if ( ACCESS_Frame( 4L ) )
       return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     an->af.af4.XIdAnchor = GET_UShort();
     an->af.af4.YIdAnchor = GET_UShort();
+#else
+    (void) GET_UShort();
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
     break;
@@ -667,7 +698,9 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
   return HB_Err_Ok;
 
 Fail:
-  _HB_OPEN_Free_Device( &an->af.af3.XDeviceTable );
+  _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+
+  FREE( an->af.af3.DeviceTables );
   return error;
 }
 
@@ -676,8 +709,9 @@ static void  Free_Anchor( HB_Anchor*  an)
 {
   if ( an->PosFormat == 3 )
   {
-    _HB_OPEN_Free_Device( &an->af.af3.YDeviceTable );
-    _HB_OPEN_Free_Device( &an->af.af3.XDeviceTable );
+    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] );
+    FREE( an->af.af3.DeviceTables );
   }
 }
 
@@ -690,7 +724,9 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
 {
   HB_Error  error = HB_Err_Ok;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_GPOSHeader*  gpos = gpi->gpos;
+#endif
   HB_UShort        ap;
 
   HB_Short         pixel_value;
@@ -743,9 +779,12 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
   case 3:
     if ( !gpi->dvi )
     {
-      _HB_OPEN_Get_Device( &an->af.af3.XDeviceTable, x_ppem, &pixel_value );
+      if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+        return error;
+
+      _HB_OPEN_Get_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE], x_ppem, &pixel_value );
       *x_value = pixel_value << 6;
-      _HB_OPEN_Get_Device( &an->af.af3.YDeviceTable, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE], y_ppem, &pixel_value );
       *y_value = pixel_value << 6;
     }
     else
@@ -756,6 +795,7 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
     break;
 
   case 4:
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     error = (gpos->mmfunc)( gpi->font, an->af.af4.XIdAnchor,
 			    x_value, gpos->data );
     if ( error )
@@ -766,6 +806,9 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
     if ( error )
       return error;
     break;
+#else
+    return ERR(HB_Err_Not_Covered);
+#endif
   }
 
   return error;
@@ -5966,8 +6009,7 @@ HB_Error  HB_GPOS_Clear_Features( HB_GPOSHeader*  gpos )
   return HB_Err_Ok;
 }
 
-
-
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 					HB_MMFunction   mmfunc,
 					void*            data )
@@ -5980,6 +6022,7 @@ HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 
   return HB_Err_Ok;
 }
+#endif
 
 /* If `dvi' is TRUE, glyph contour points for anchor points and device
    tables are ignored -- you will get device independent values.         */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
index 2840dae..92bff84 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
@@ -44,6 +44,7 @@ HB_BEGIN_HEADER
 #define HB_GPOS_LOOKUP_CHAIN      8
 #define HB_GPOS_LOOKUP_EXTENSION  9
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 /* A pointer to a function which accesses the PostScript interpreter.
    Multiple Master fonts need this interface to convert a metric ID
    (as stored in an OpenType font version 1.2 or higher) `metric_id'
@@ -59,6 +60,7 @@ typedef HB_Error  (*HB_MMFunction)(HB_Font       font,
 				    HB_UShort    metric_id,
 				    HB_Fixed*      metric_value,
 				    void*        data );
+#endif
 
 
 struct  HB_GPOSHeader_
@@ -71,12 +73,14 @@ struct  HB_GPOSHeader_
 
   HB_GDEFHeader*    gdef;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   /* this is OpenType 1.2 -- Multiple Master fonts need this
      callback function to get various metric values from the
      PostScript interpreter.                                 */
 
   HB_MMFunction     mmfunc;
   void*              data;
+#endif
 };
 
 typedef struct HB_GPOSHeader_  HB_GPOSHeader;
@@ -129,9 +133,11 @@ HB_Error  HB_GPOS_Add_Feature( HB_GPOSHeader*  gpos,
 HB_Error  HB_GPOS_Clear_Features( HB_GPOSHeader*  gpos );
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 					HB_MMFunction   mmfunc,
 					void*            data );
+#endif
 
 /* If `dvi' is TRUE, glyph contour points for anchor points and device
    tables are ignored -- you will get device independent values.         */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
index dd5ffdf..7eb329e 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
@@ -32,6 +32,9 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
 
 typedef union HB_GSUB_SubTable_  HB_GSUB_SubTable;
 
@@ -48,9 +51,9 @@ typedef struct HB_SingleSubstFormat1_  HB_SingleSubstFormat1;
 
 struct  HB_SingleSubstFormat2_
 {
+  HB_UShort*  Substitute;             /* array of substitute glyph IDs */
   HB_UShort   GlyphCount;             /* number of glyph IDs in
 					 Substitute array              */
-  HB_UShort*  Substitute;             /* array of substitute glyph IDs */
 };
 
 typedef struct HB_SingleSubstFormat2_  HB_SingleSubstFormat2;
@@ -58,14 +61,14 @@ typedef struct HB_SingleSubstFormat2_  HB_SingleSubstFormat2;
 
 struct  HB_SingleSubst_
 {
-  HB_UShort     SubstFormat;          /* 1 or 2         */
-  HB_Coverage  Coverage;             /* Coverage table */
-
   union
   {
     HB_SingleSubstFormat1  ssf1;
     HB_SingleSubstFormat2  ssf2;
   } ssf;
+
+  HB_Coverage  Coverage;             /* Coverage table */
+  HB_Byte     SubstFormat;            /* 1 or 2         */
 };
 
 typedef struct HB_SingleSubst_  HB_SingleSubst;
@@ -75,10 +78,10 @@ typedef struct HB_SingleSubst_  HB_SingleSubst;
 
 struct  HB_Sequence_
 {
-  HB_UShort   GlyphCount;             /* number of glyph IDs in the
-					 Substitute array           */
   HB_UShort*  Substitute;             /* string of glyph IDs to
 					 substitute                 */
+  HB_UShort   GlyphCount;             /* number of glyph IDs in the
+					 Substitute array           */
 };
 
 typedef struct HB_Sequence_  HB_Sequence;
@@ -86,10 +89,10 @@ typedef struct HB_Sequence_  HB_Sequence;
 
 struct  HB_MultipleSubst_
 {
-  HB_UShort      SubstFormat;         /* always 1                  */
+  HB_Sequence*  Sequence;            /* array of Sequence tables  */
   HB_Coverage   Coverage;            /* Coverage table            */
+  HB_UShort      SubstFormat;         /* always 1                  */
   HB_UShort      SequenceCount;       /* number of Sequence tables */
-  HB_Sequence*  Sequence;            /* array of Sequence tables  */
 };
 
 typedef struct HB_MultipleSubst_  HB_MultipleSubst;
@@ -99,9 +102,9 @@ typedef struct HB_MultipleSubst_  HB_MultipleSubst;
 
 struct  HB_AlternateSet_
 {
+  HB_UShort*  Alternate;              /* array of alternate glyph IDs */
   HB_UShort   GlyphCount;             /* number of glyph IDs in the
 					 Alternate array              */
-  HB_UShort*  Alternate;              /* array of alternate glyph IDs */
 };
 
 typedef struct HB_AlternateSet_  HB_AlternateSet;
@@ -109,11 +112,11 @@ typedef struct HB_AlternateSet_  HB_AlternateSet;
 
 struct  HB_AlternateSubst_
 {
-  HB_UShort          SubstFormat;     /* always 1                      */
+  HB_AlternateSet*  AlternateSet;    /* array of AlternateSet tables  */
   HB_Coverage       Coverage;        /* Coverage table                */
+  HB_UShort          SubstFormat;     /* always 1                      */
   HB_UShort          AlternateSetCount;
 				      /* number of AlternateSet tables */
-  HB_AlternateSet*  AlternateSet;    /* array of AlternateSet tables  */
 };
 
 typedef struct HB_AlternateSubst_  HB_AlternateSubst;
@@ -123,10 +126,10 @@ typedef struct HB_AlternateSubst_  HB_AlternateSubst;
 
 struct  HB_Ligature_
 {
+  HB_UShort*  Component;              /* array of component glyph IDs     */
   HB_UShort   LigGlyph;               /* glyphID of ligature
 					 to substitute                    */
   HB_UShort   ComponentCount;         /* number of components in ligature */
-  HB_UShort*  Component;              /* array of component glyph IDs     */
 };
 
 typedef struct HB_Ligature_  HB_Ligature;
@@ -134,8 +137,8 @@ typedef struct HB_Ligature_  HB_Ligature;
 
 struct  HB_LigatureSet_
 {
-  HB_UShort      LigatureCount;       /* number of Ligature tables */
   HB_Ligature*  Ligature;            /* array of Ligature tables  */
+  HB_UShort      LigatureCount;       /* number of Ligature tables */
 };
 
 typedef struct HB_LigatureSet_  HB_LigatureSet;
@@ -143,10 +146,10 @@ typedef struct HB_LigatureSet_  HB_LigatureSet;
 
 struct  HB_LigatureSubst_
 {
-  HB_UShort         SubstFormat;      /* always 1                     */
+  HB_LigatureSet*  LigatureSet;      /* array of LigatureSet tables  */
   HB_Coverage      Coverage;         /* Coverage table               */
+  HB_UShort         SubstFormat;      /* always 1                     */
   HB_UShort         LigatureSetCount; /* number of LigatureSet tables */
-  HB_LigatureSet*  LigatureSet;      /* array of LigatureSet tables  */
 };
 
 typedef struct HB_LigatureSubst_  HB_LigatureSubst;
@@ -168,13 +171,13 @@ typedef struct HB_SubstLookupRecord_  HB_SubstLookupRecord;
 
 struct  HB_SubRule_
 {
-  HB_UShort               GlyphCount; /* total number of input glyphs */
-  HB_UShort               SubstCount; /* number of SubstLookupRecord
-					 tables                       */
   HB_UShort*              Input;      /* array of input glyph IDs     */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of SubstLookupRecord
 					 tables                       */
+  HB_UShort               GlyphCount; /* total number of input glyphs */
+  HB_UShort               SubstCount; /* number of SubstLookupRecord
+					 tables                       */
 };
 
 typedef struct HB_SubRule_  HB_SubRule;
@@ -182,8 +185,8 @@ typedef struct HB_SubRule_  HB_SubRule;
 
 struct  HB_SubRuleSet_
 {
-  HB_UShort     SubRuleCount;         /* number of SubRule tables */
   HB_SubRule*  SubRule;              /* array of SubRule tables  */
+  HB_UShort     SubRuleCount;         /* number of SubRule tables */
 };
 
 typedef struct HB_SubRuleSet_  HB_SubRuleSet;
@@ -191,9 +194,9 @@ typedef struct HB_SubRuleSet_  HB_SubRuleSet;
 
 struct  HB_ContextSubstFormat1_
 {
+  HB_SubRuleSet*  SubRuleSet;        /* array of SubRuleSet tables  */
   HB_Coverage     Coverage;          /* Coverage table              */
   HB_UShort        SubRuleSetCount;   /* number of SubRuleSet tables */
-  HB_SubRuleSet*  SubRuleSet;        /* array of SubRuleSet tables  */
 };
 
 typedef struct HB_ContextSubstFormat1_  HB_ContextSubstFormat1;
@@ -201,13 +204,13 @@ typedef struct HB_ContextSubstFormat1_  HB_ContextSubstFormat1;
 
 struct  HB_SubClassRule_
 {
-  HB_UShort               GlyphCount; /* total number of context classes */
-  HB_UShort               SubstCount; /* number of SubstLookupRecord
-					 tables                          */
   HB_UShort*              Class;      /* array of classes                */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of SubstLookupRecord
 					 tables                          */
+  HB_UShort               GlyphCount; /* total number of context classes */
+  HB_UShort               SubstCount; /* number of SubstLookupRecord
+					 tables                          */
 };
 
 typedef struct HB_SubClassRule_  HB_SubClassRule;
@@ -215,9 +218,9 @@ typedef struct HB_SubClassRule_  HB_SubClassRule;
 
 struct  HB_SubClassSet_
 {
+  HB_SubClassRule*  SubClassRule;    /* array of SubClassRule tables  */
   HB_UShort          SubClassRuleCount;
 				      /* number of SubClassRule tables */
-  HB_SubClassRule*  SubClassRule;    /* array of SubClassRule tables  */
 };
 
 typedef struct HB_SubClassSet_  HB_SubClassSet;
@@ -229,13 +232,13 @@ typedef struct HB_SubClassSet_  HB_SubClassSet;
 
 struct  HB_ContextSubstFormat2_
 {
-  HB_UShort            MaxContextLength;
-				      /* maximal context length       */
+  HB_SubClassSet*     SubClassSet;   /* array of SubClassSet tables  */
   HB_Coverage         Coverage;      /* Coverage table               */
   HB_ClassDefinition  ClassDef;      /* ClassDef table               */
   HB_UShort            SubClassSetCount;
 				      /* number of SubClassSet tables */
-  HB_SubClassSet*     SubClassSet;   /* array of SubClassSet tables  */
+  HB_UShort            MaxContextLength;
+				      /* maximal context length       */
 };
 
 typedef struct HB_ContextSubstFormat2_  HB_ContextSubstFormat2;
@@ -243,11 +246,11 @@ typedef struct HB_ContextSubstFormat2_  HB_ContextSubstFormat2;
 
 struct  HB_ContextSubstFormat3_
 {
-  HB_UShort               GlyphCount; /* number of input glyphs        */
-  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
   HB_Coverage*           Coverage;   /* array of Coverage tables      */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of substitution lookups */
+  HB_UShort               GlyphCount; /* number of input glyphs        */
+  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
 };
 
 typedef struct HB_ContextSubstFormat3_  HB_ContextSubstFormat3;
@@ -255,14 +258,14 @@ typedef struct HB_ContextSubstFormat3_  HB_ContextSubstFormat3;
 
 struct  HB_ContextSubst_
 {
-  HB_UShort  SubstFormat;             /* 1, 2, or 3 */
-
   union
   {
     HB_ContextSubstFormat1  csf1;
     HB_ContextSubstFormat2  csf2;
     HB_ContextSubstFormat3  csf3;
   } csf;
+
+  HB_Byte  SubstFormat;               /* 1, 2, or 3 */
 };
 
 typedef struct HB_ContextSubst_  HB_ContextSubst;
@@ -272,18 +275,18 @@ typedef struct HB_ContextSubst_  HB_ContextSubst;
 
 struct  HB_ChainSubRule_
 {
+  HB_UShort*              Backtrack;  /* array of backtrack glyph IDs     */
+  HB_UShort*              Input;      /* array of input glyph IDs         */
+  HB_UShort*              Lookahead;  /* array of lookahead glyph IDs     */
+  HB_SubstLookupRecord*  SubstLookupRecord;
+				      /* array of SubstLookupRecords      */
   HB_UShort               BacktrackGlyphCount;
 				      /* total number of backtrack glyphs */
-  HB_UShort*              Backtrack;  /* array of backtrack glyph IDs     */
   HB_UShort               InputGlyphCount;
 				      /* total number of input glyphs     */
-  HB_UShort*              Input;      /* array of input glyph IDs         */
   HB_UShort               LookaheadGlyphCount;
 				      /* total number of lookahead glyphs */
-  HB_UShort*              Lookahead;  /* array of lookahead glyph IDs     */
   HB_UShort               SubstCount; /* number of SubstLookupRecords     */
-  HB_SubstLookupRecord*  SubstLookupRecord;
-				      /* array of SubstLookupRecords      */
 };
 
 typedef struct HB_ChainSubRule_  HB_ChainSubRule;
@@ -291,9 +294,9 @@ typedef struct HB_ChainSubRule_  HB_ChainSubRule;
 
 struct  HB_ChainSubRuleSet_
 {
+  HB_ChainSubRule*  ChainSubRule;    /* array of ChainSubRule tables  */
   HB_UShort          ChainSubRuleCount;
 				      /* number of ChainSubRule tables */
-  HB_ChainSubRule*  ChainSubRule;    /* array of ChainSubRule tables  */
 };
 
 typedef struct HB_ChainSubRuleSet_  HB_ChainSubRuleSet;
@@ -301,11 +304,11 @@ typedef struct HB_ChainSubRuleSet_  HB_ChainSubRuleSet;
 
 struct  HB_ChainContextSubstFormat1_
 {
+  HB_ChainSubRuleSet*  ChainSubRuleSet;
+				      /* array of ChainSubRuleSet tables  */
   HB_Coverage          Coverage;     /* Coverage table                   */
   HB_UShort             ChainSubRuleSetCount;
 				      /* number of ChainSubRuleSet tables */
-  HB_ChainSubRuleSet*  ChainSubRuleSet;
-				      /* array of ChainSubRuleSet tables  */
 };
 
 typedef struct HB_ChainContextSubstFormat1_  HB_ChainContextSubstFormat1;
@@ -313,20 +316,20 @@ typedef struct HB_ChainContextSubstFormat1_  HB_ChainContextSubstFormat1;
 
 struct  HB_ChainSubClassRule_
 {
+  HB_UShort*              Backtrack;  /* array of backtrack classes      */
+  HB_UShort*              Input;      /* array of context classes        */
+  HB_UShort*              Lookahead;  /* array of lookahead classes      */
+  HB_SubstLookupRecord*  SubstLookupRecord;
+				      /* array of substitution lookups   */
   HB_UShort               BacktrackGlyphCount;
 				      /* total number of backtrack
 					 classes                         */
-  HB_UShort*              Backtrack;  /* array of backtrack classes      */
   HB_UShort               InputGlyphCount;
 				      /* total number of context classes */
-  HB_UShort*              Input;      /* array of context classes        */
   HB_UShort               LookaheadGlyphCount;
 				      /* total number of lookahead
 					 classes                         */
-  HB_UShort*              Lookahead;  /* array of lookahead classes      */
   HB_UShort               SubstCount; /* number of SubstLookupRecords    */
-  HB_SubstLookupRecord*  SubstLookupRecord;
-				      /* array of substitution lookups   */
 };
 
 typedef struct HB_ChainSubClassRule_  HB_ChainSubClassRule;
@@ -334,12 +337,12 @@ typedef struct HB_ChainSubClassRule_  HB_ChainSubClassRule;
 
 struct  HB_ChainSubClassSet_
 {
-  HB_UShort               ChainSubClassRuleCount;
-				      /* number of ChainSubClassRule
-					 tables                      */
   HB_ChainSubClassRule*  ChainSubClassRule;
 				      /* array of ChainSubClassRule
 					 tables                      */
+  HB_UShort               ChainSubClassRuleCount;
+				      /* number of ChainSubClassRule
+					 tables                      */
 };
 
 typedef struct HB_ChainSubClassSet_  HB_ChainSubClassSet;
@@ -351,27 +354,27 @@ typedef struct HB_ChainSubClassSet_  HB_ChainSubClassSet;
 
 struct  HB_ChainContextSubstFormat2_
 {
+  HB_ChainSubClassSet*  ChainSubClassSet;
+				      /* array of ChainSubClassSet
+					 tables                     */
   HB_Coverage           Coverage;    /* Coverage table             */
 
-  HB_UShort              MaxBacktrackLength;
-				      /* maximal backtrack length   */
   HB_ClassDefinition    BacktrackClassDef;
 				      /* BacktrackClassDef table    */
-  HB_UShort              MaxInputLength;
-				      /* maximal input length       */
   HB_ClassDefinition    InputClassDef;
 				      /* InputClassDef table        */
-  HB_UShort              MaxLookaheadLength;
-				      /* maximal lookahead length   */
   HB_ClassDefinition    LookaheadClassDef;
 				      /* LookaheadClassDef table    */
 
   HB_UShort              ChainSubClassSetCount;
 				      /* number of ChainSubClassSet
 					 tables                     */
-  HB_ChainSubClassSet*  ChainSubClassSet;
-				      /* array of ChainSubClassSet
-					 tables                     */
+  HB_UShort              MaxBacktrackLength;
+				      /* maximal backtrack length   */
+  HB_UShort              MaxLookaheadLength;
+				      /* maximal lookahead length   */
+  HB_UShort              MaxInputLength;
+				      /* maximal input length       */
 };
 
 typedef struct HB_ChainContextSubstFormat2_  HB_ChainContextSubstFormat2;
@@ -379,24 +382,24 @@ typedef struct HB_ChainContextSubstFormat2_  HB_ChainContextSubstFormat2;
 
 struct  HB_ChainContextSubstFormat3_
 {
-  HB_UShort               BacktrackGlyphCount;
-				      /* number of backtrack glyphs    */
   HB_Coverage*           BacktrackCoverage;
 				      /* array of backtrack Coverage
 					 tables                        */
-  HB_UShort               InputGlyphCount;
-				      /* number of input glyphs        */
   HB_Coverage*           InputCoverage;
 				      /* array of input coverage
 					 tables                        */
-  HB_UShort               LookaheadGlyphCount;
-				      /* number of lookahead glyphs    */
   HB_Coverage*           LookaheadCoverage;
 				      /* array of lookahead coverage
 					 tables                        */
-  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of substitution lookups */
+  HB_UShort               BacktrackGlyphCount;
+				      /* number of backtrack glyphs    */
+  HB_UShort               InputGlyphCount;
+				      /* number of input glyphs        */
+  HB_UShort               LookaheadGlyphCount;
+				      /* number of lookahead glyphs    */
+  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
 };
 
 typedef struct HB_ChainContextSubstFormat3_  HB_ChainContextSubstFormat3;
@@ -404,14 +407,14 @@ typedef struct HB_ChainContextSubstFormat3_  HB_ChainContextSubstFormat3;
 
 struct  HB_ChainContextSubst_
 {
-  HB_UShort  SubstFormat;             /* 1, 2, or 3 */
-
   union
   {
     HB_ChainContextSubstFormat1  ccsf1;
     HB_ChainContextSubstFormat2  ccsf2;
     HB_ChainContextSubstFormat3  ccsf3;
   } ccsf;
+
+  HB_Byte  SubstFormat;               /* 1, 2, or 3 */
 };
 
 typedef struct HB_ChainContextSubst_  HB_ChainContextSubst;
@@ -421,9 +424,9 @@ typedef struct HB_ChainContextSubst_  HB_ChainContextSubst;
 /* LookupType 7 */
 struct HB_ExtensionSubst_
 {
+  HB_GSUB_SubTable *subtable;         /* referenced subtable */
   HB_UShort      SubstFormat;         /* always 1 */
   HB_UShort      LookuptType;         /* lookup-type of referenced subtable */
-  HB_GSUB_SubTable *subtable;         /* referenced subtable */
 };
 
 typedef struct HB_ExtensionSubst_  HB_ExtensionSubst;
@@ -433,16 +436,16 @@ typedef struct HB_ExtensionSubst_  HB_ExtensionSubst;
 /* LookupType 8 */
 struct HB_ReverseChainContextSubst_
 {
-  HB_UShort      SubstFormat;         /* always 1 */
-  HB_Coverage   Coverage;	        /* coverage table for input glyphs */
-  HB_UShort      BacktrackGlyphCount; /* number of backtrack glyphs      */
+  HB_Coverage*  LookaheadCoverage;   /* array of lookahead Coverage
+					 tables                          */
+  HB_UShort*     Substitute;          /* array of substitute Glyph ID    */
   HB_Coverage*  BacktrackCoverage;   /* array of backtrack Coverage
 					 tables                          */
+  HB_Coverage   Coverage;	        /* coverage table for input glyphs */
+  HB_UShort      SubstFormat;         /* always 1 */
+  HB_UShort      BacktrackGlyphCount; /* number of backtrack glyphs      */
   HB_UShort      LookaheadGlyphCount; /* number of lookahead glyphs      */
-  HB_Coverage*  LookaheadCoverage;   /* array of lookahead Coverage
-					 tables                          */
   HB_UShort      GlyphCount;          /* number of Glyph IDs             */
-  HB_UShort*     Substitute;          /* array of substitute Glyph ID    */
 };
 
 typedef struct HB_ReverseChainContextSubst_  HB_ReverseChainContextSubst;
@@ -471,6 +474,10 @@ HB_INTERNAL void
 _HB_GSUB_Free_SubTable( HB_GSUB_SubTable* st,
 			      HB_UShort     lookup_type );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GSUB_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
index 1ca3f0c..b00df44 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
@@ -32,6 +32,10 @@
 HB_BEGIN_HEADER
 
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Lookup types for glyph substitution */
 
 #define HB_GSUB_LOOKUP_SINGLE        1
@@ -60,6 +64,14 @@ typedef HB_UShort  (*HB_AltFunction)(HB_UInt    pos,
 
 struct  HB_GSUBHeader_
 {
+  HB_GDEFHeader*  gdef;
+
+  /* the next two fields are used for an alternate substitution callback
+     function to select the proper alternate glyph.                      */
+
+  void*            data;
+  HB_AltFunction  altfunc;
+
   HB_UInt         offset;
 
   HB_16Dot16         Version;
@@ -67,14 +79,6 @@ struct  HB_GSUBHeader_
   HB_ScriptList   ScriptList;
   HB_FeatureList  FeatureList;
   HB_LookupList   LookupList;
-
-  HB_GDEFHeader*  gdef;
-
-  /* the next two fields are used for an alternate substitution callback
-     function to select the proper alternate glyph.                      */
-
-  HB_AltFunction  altfunc;
-  void*            data;
 };
 
 typedef struct HB_GSUBHeader_   HB_GSUBHeader;
@@ -135,6 +139,9 @@ HB_Error  HB_GSUB_Register_Alternate_Function( HB_GSUBHeader*  gsub,
 HB_Error  HB_GSUB_Apply_String( HB_GSUBHeader*   gsub,
 				HB_Buffer        buffer );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
index 73dd383..1f7b353 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
@@ -69,7 +69,7 @@ _HB_OPEN_Load_EmptyOrClassDefinition( HB_ClassDefinition* cd,
 					       HB_UInt              base_offset,
 					       HB_Stream             input );
 HB_INTERNAL HB_Error
-_HB_OPEN_Load_Device( HB_Device* d,
+_HB_OPEN_Load_Device( HB_Device** d,
 		       HB_Stream    input );
 
 HB_INTERNAL void  _HB_OPEN_Free_ScriptList( HB_ScriptList*  sl );
@@ -79,7 +79,7 @@ HB_INTERNAL void  _HB_OPEN_Free_LookupList( HB_LookupList*  ll,
 
 HB_INTERNAL void  _HB_OPEN_Free_Coverage( HB_Coverage*  c );
 HB_INTERNAL void  _HB_OPEN_Free_ClassDefinition( HB_ClassDefinition*  cd );
-HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device*  d );
+HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device**  d );
 
 
 
@@ -93,7 +93,7 @@ _HB_OPEN_Get_Class( HB_ClassDefinition* cd,
 		    HB_UShort*          klass,
 		     HB_UShort*            index );
 HB_INTERNAL HB_Error
-_HB_OPEN_Get_Device( HB_Device* d,
+_HB_OPEN_Get_Device( HB_Device** d,
 		      HB_UShort    size,
 		      HB_Short*    value );
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open.c b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
index 0fe1e4d..255b7e6 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
@@ -1282,9 +1282,10 @@ _HB_OPEN_Get_Class( HB_ClassDefinition* cd,
 
 
 HB_INTERNAL HB_Error
-_HB_OPEN_Load_Device( HB_Device* d,
+_HB_OPEN_Load_Device( HB_Device** device,
 		       HB_Stream    stream )
 {
+  HB_Device*  d;
   HB_Error   error;
 
   HB_UShort   n, count;
@@ -1295,6 +1296,14 @@ _HB_OPEN_Load_Device( HB_Device* d,
   if ( ACCESS_Frame( 6L ) )
     return error;
 
+  if ( ALLOC( *device, sizeof(HB_Device)) )
+  {
+    *device = 0;
+    return error;
+  }
+
+  d = *device;
+
   d->StartSize   = GET_UShort();
   d->EndSize     = GET_UShort();
   d->DeltaFormat = GET_UShort();
@@ -1318,11 +1327,17 @@ _HB_OPEN_Load_Device( HB_Device* d,
 	      ( 4 - d->DeltaFormat ) ) + 1;
 
   if ( ALLOC_ARRAY( d->DeltaValue, count, HB_UShort ) )
+  {
+    FREE( *device );
+    *device = 0;
     return error;
+  }
 
   if ( ACCESS_Frame( count * 2L ) )
   {
     FREE( d->DeltaValue );
+    FREE( *device );
+    *device = 0;
     return error;
   }
 
@@ -1338,9 +1353,13 @@ _HB_OPEN_Load_Device( HB_Device* d,
 
 
 HB_INTERNAL void
-_HB_OPEN_Free_Device( HB_Device* d )
+_HB_OPEN_Free_Device( HB_Device** d )
 {
-  FREE( d->DeltaValue );
+  if ( *d )
+  {
+    FREE( (*d)->DeltaValue );
+    FREE( *d );
+  }
 }
 
 
@@ -1380,12 +1399,21 @@ _HB_OPEN_Free_Device( HB_Device* d )
      mask = 0x00FF                                    */
 
 HB_INTERNAL HB_Error
-_HB_OPEN_Get_Device( HB_Device* d,
+_HB_OPEN_Get_Device( HB_Device** device,
 		      HB_UShort    size,
 		      HB_Short*    value )
 {
+  HB_Device* d;
   HB_UShort  byte, bits, mask, f, s;
+  HB_Error   error;
+
+  if ( ALLOC( *device, sizeof(HB_Device)) )
+  {
+    *device = 0;
+    return error;
+  }
 
+  d = *device;
 
   f = d->DeltaFormat;
 
@@ -1408,6 +1436,8 @@ _HB_OPEN_Get_Device( HB_Device* d,
   else
   {
     *value = 0;
+    FREE( *device );
+    *device = 0;
     return HB_Err_Not_Covered;
   }
 }
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open.h b/src/3rdparty/harfbuzz/src/harfbuzz-open.h
index bdc6358..4ba6cf5 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open.h
@@ -30,6 +30,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Use this if a feature applies to all glyphs */
 #define HB_ALL_GLYPHS                    0xFFFF
 
@@ -42,10 +46,10 @@ HB_BEGIN_HEADER
 
 struct  HB_LangSys_
 {
+  HB_UShort*  FeatureIndex;           /* array of Feature indices  */
   HB_UShort   LookupOrderOffset;      /* always 0 for TT Open 1.0  */
   HB_UShort   ReqFeatureIndex;        /* required FeatureIndex     */
   HB_UShort   FeatureCount;           /* number of Feature indices */
-  HB_UShort*  FeatureIndex;           /* array of Feature indices  */
 };
 
 typedef struct HB_LangSys_  HB_LangSys;
@@ -53,8 +57,8 @@ typedef struct HB_LangSys_  HB_LangSys;
 
 struct  HB_LangSysRecord_
 {
-  HB_UInt     LangSysTag;            /* LangSysTag identifier */
   HB_LangSys  LangSys;               /* LangSys table         */
+  HB_UInt     LangSysTag;            /* LangSysTag identifier */
 };
 
 typedef struct HB_LangSysRecord_  HB_LangSysRecord;
@@ -62,9 +66,9 @@ typedef struct HB_LangSysRecord_  HB_LangSysRecord;
 
 struct  HB_ScriptTable_
 {
+  HB_LangSysRecord*  LangSysRecord;  /* array of LangSysRecords  */
   HB_LangSys         DefaultLangSys; /* DefaultLangSys table     */
   HB_UShort           LangSysCount;   /* number of LangSysRecords */
-  HB_LangSysRecord*  LangSysRecord;  /* array of LangSysRecords  */
 };
 
 typedef struct HB_ScriptTable_  HB_ScriptTable;
@@ -81,8 +85,8 @@ typedef struct HB_ScriptRecord_  HB_ScriptRecord;
 
 struct  HB_ScriptList_
 {
-  HB_UShort          ScriptCount;     /* number of ScriptRecords */
   HB_ScriptRecord*  ScriptRecord;    /* array of ScriptRecords  */
+  HB_UShort          ScriptCount;     /* number of ScriptRecords */
 };
 
 typedef struct HB_ScriptList_  HB_ScriptList;
@@ -92,9 +96,9 @@ typedef struct HB_ScriptList_  HB_ScriptList;
 
 struct HB_Feature_
 {
+  HB_UShort*  LookupListIndex;        /* array of LookupList indices  */
   HB_UShort   FeatureParams;          /* always 0 for TT Open 1.0     */
   HB_UShort   LookupListCount;        /* number of LookupList indices */
-  HB_UShort*  LookupListIndex;        /* array of LookupList indices  */
 };
 
 typedef struct HB_Feature_  HB_Feature;
@@ -111,9 +115,9 @@ typedef struct HB_FeatureRecord_  HB_FeatureRecord;
 
 struct  HB_FeatureList_
 {
-  HB_UShort           FeatureCount;   /* number of FeatureRecords */
-  HB_FeatureRecord*  FeatureRecord;  /* array of FeatureRecords  */
   HB_UShort*		ApplyOrder;	/* order to apply features */
+  HB_FeatureRecord*  FeatureRecord;  /* array of FeatureRecords  */
+  HB_UShort           FeatureCount;   /* number of FeatureRecords */
   HB_UShort		ApplyCount;	/* number of elements in ApplyOrder */
 };
 
@@ -127,10 +131,10 @@ typedef struct HB_SubTable_  HB_SubTable;
 
 struct  HB_Lookup_
 {
+  HB_SubTable*  SubTable;            /* array of SubTables  */
   HB_UShort      LookupType;          /* Lookup type         */
   HB_UShort      LookupFlag;          /* Lookup qualifiers   */
   HB_UShort      SubTableCount;       /* number of SubTables */
-  HB_SubTable*  SubTable;            /* array of SubTables  */
 };
 
 typedef struct HB_Lookup_  HB_Lookup;
@@ -144,9 +148,9 @@ typedef struct HB_Lookup_  HB_Lookup;
 
 struct  HB_LookupList_
 {
-  HB_UShort    LookupCount;           /* number of Lookups       */
   HB_Lookup*  Lookup;                /* array of Lookup records */
   HB_UInt*     Properties;            /* array of flags          */
+  HB_UShort    LookupCount;           /* number of Lookups       */
 };
 
 typedef struct HB_LookupList_  HB_LookupList;
@@ -167,8 +171,8 @@ typedef struct HB_LookupList_  HB_LookupList;
 
 struct  HB_CoverageFormat1_
 {
-  HB_UShort   GlyphCount;             /* number of glyphs in GlyphArray */
   HB_UShort*  GlyphArray;             /* array of glyph IDs             */
+  HB_UShort   GlyphCount;             /* number of glyphs in GlyphArray */
 };
 
 typedef struct HB_CoverageFormat1_  HB_CoverageFormat1;
@@ -187,8 +191,8 @@ typedef struct HB_RangeRecord_  HB_RangeRecord;
 
 struct  HB_CoverageFormat2_
 {
-  HB_UShort         RangeCount;       /* number of RangeRecords */
   HB_RangeRecord*  RangeRecord;      /* array of RangeRecords  */
+  HB_UShort         RangeCount;       /* number of RangeRecords */
 };
 
 typedef struct HB_CoverageFormat2_  HB_CoverageFormat2;
@@ -196,7 +200,7 @@ typedef struct HB_CoverageFormat2_  HB_CoverageFormat2;
 
 struct  HB_Coverage_
 {
-  HB_UShort  CoverageFormat;          /* 1 or 2 */
+  HB_Byte    CoverageFormat;          /* 1 or 2 */
 
   union
   {
@@ -210,10 +214,10 @@ typedef struct HB_Coverage_  HB_Coverage;
 
 struct  HB_ClassDefFormat1_
 {
+  HB_UShort*  ClassValueArray;        /* array of class values       */
   HB_UShort   StartGlyph;             /* first glyph ID of the
 					 ClassValueArray             */
   HB_UShort   GlyphCount;             /* size of the ClassValueArray */
-  HB_UShort*  ClassValueArray;        /* array of class values       */
 };
 
 typedef struct HB_ClassDefFormat1_  HB_ClassDefFormat1;
@@ -231,10 +235,10 @@ typedef struct HB_ClassRangeRecord_  HB_ClassRangeRecord;
 
 struct  HB_ClassDefFormat2_
 {
-  HB_UShort              ClassRangeCount;
-				      /* number of ClassRangeRecords */
   HB_ClassRangeRecord*  ClassRangeRecord;
 				      /* array of ClassRangeRecords  */
+  HB_UShort              ClassRangeCount;
+				      /* number of ClassRangeRecords */
 };
 
 typedef struct HB_ClassDefFormat2_  HB_ClassDefFormat2;
@@ -242,15 +246,14 @@ typedef struct HB_ClassDefFormat2_  HB_ClassDefFormat2;
 
 struct  HB_ClassDefinition_
 {
-  HB_Bool    loaded;
-
-  HB_UShort  ClassFormat;             /* 1 or 2                      */
-
   union
   {
     HB_ClassDefFormat1  cd1;
     HB_ClassDefFormat2  cd2;
   } cd;
+
+  HB_Byte    ClassFormat;             /* 1 or 2                      */
+  HB_Bool    loaded;
 };
 
 typedef struct HB_ClassDefinition_  HB_ClassDefinition;
@@ -258,11 +261,11 @@ typedef struct HB_ClassDefinition_  HB_ClassDefinition;
 
 struct HB_Device_
 {
+  HB_UShort*  DeltaValue;             /* array of compressed data      */
   HB_UShort   StartSize;              /* smallest size to correct      */
   HB_UShort   EndSize;                /* largest size to correct       */
-  HB_UShort   DeltaFormat;            /* DeltaValue array data format:
+  HB_Byte     DeltaFormat;            /* DeltaValue array data format:
 					 1, 2, or 3                    */
-  HB_UShort*  DeltaValue;             /* array of compressed data      */
 };
 
 typedef struct HB_Device_  HB_Device;
@@ -276,6 +279,9 @@ enum  HB_Type_
 
 typedef enum HB_Type_  HB_Type;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index 4bc53c8..ce4d4ac 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -183,18 +183,15 @@ static void calcLineBreaks(const HB_UChar16 *uc, hb_uint32 len, HB_CharAttribute
         if (ncls >= HB_LineBreak_CR)
             goto next;
 
-        // two complex chars (thai or lao), thai_attributes might override, but here we do a best guess
-	if (cls == HB_LineBreak_SA && ncls == HB_LineBreak_SA) {
-            lineBreakType = HB_Break;
-            goto next;
-        }
-
         {
             int tcls = ncls;
+            // for south east asian chars that require a complex (dictionary analysis), the unicode
+            // standard recommends to treat them as AL. thai_attributes and other attribute methods that
+            // do dictionary analysis can override
             if (tcls >= HB_LineBreak_SA)
-                tcls = HB_LineBreak_ID;
+                tcls = HB_LineBreak_AL;
             if (cls >= HB_LineBreak_SA)
-                cls = HB_LineBreak_ID;
+                cls = HB_LineBreak_AL;
 
             int brk = breakTable[cls][tcls];
             switch (brk) {
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
index 470e27b..ab5c07a 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
@@ -34,6 +34,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /*
    using anything else than signed or unsigned for bitfields in C is non standard,
    but accepted by almost all compilers. And it gives a significant reduction in
@@ -254,6 +258,10 @@ typedef struct HB_Font_ {
     void *userData;
 } HB_FontRec;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 typedef struct HB_ShaperItem_ HB_ShaperItem;
 
 struct HB_ShaperItem_ {
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-stream.h b/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
index 9991936..a155cc2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
@@ -30,15 +30,21 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 typedef struct HB_StreamRec_
 {
     HB_Byte*       base;
+    HB_Byte*       cursor;
     HB_UInt        size;
     HB_UInt        pos;
-    
-    HB_Byte*       cursor;
 } HB_StreamRec;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
index 1d1aa2f..fc2bdbf 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
@@ -27,57 +27,79 @@
 #include "harfbuzz-external.h"
 
 #include <assert.h>
+#include <stdio.h>
+
+typedef int (*th_brk_def)(const char*, int[], int);
+static th_brk_def th_brk = 0;
+static int libthai_resolved = 0;
+
+static void resolve_libthai()
+{
+    if (!th_brk)
+        th_brk = (th_brk_def)HB_Library_Resolve("thai", 0, "th_brk");
+    libthai_resolved = 1;
+}
+
+static void to_tis620(const HB_UChar16 *string, hb_uint32 len, const char *cstr)
+{
+    hb_uint32 i;
+    unsigned char *result = (unsigned char *)cstr;
+
+    for (i = 0; i < len; ++i) {
+        if (string[i] <= 0xa0)
+            result[i] = (unsigned char)string[i];
+        if (string[i] >= 0xe01 && string[i] <= 0xe5b)
+            result[i] = (unsigned char)(string[i] - 0xe00 + 0xa0);
+        else
+            result[i] = '?';
+    }
+}
 
 static void thaiWordBreaks(const HB_UChar16 *string, hb_uint32 len, HB_CharAttributes *attributes)
 {
-    typedef int (*th_brk_def)(const char*, int[], int);
-    static void *thaiCodec = 0;
-    static th_brk_def th_brk = 0;
-    char *cstr = 0;
+    char s[128];
+    char *cstr = s;
     int brp[128];
     int *break_positions = brp;
     hb_uint32 numbreaks;
     hb_uint32 i;
 
-    if (!thaiCodec)
-        thaiCodec = HB_TextCodecForMib(2259);
-
-    /* load libthai dynamically */
-    if (!th_brk && thaiCodec) {
-        th_brk = (th_brk_def)HB_Library_Resolve("thai", "th_brk");
-        if (!th_brk)
-            thaiCodec = 0;
-    }
+    if (!libthai_resolved)
+        resolve_libthai();
 
     if (!th_brk)
         return;
 
-    cstr = HB_TextCodec_ConvertFromUnicode(thaiCodec, string, len, 0);
-    if (!cstr)
-        return;
+    if (len > 128)
+        cstr = (char *)malloc(len*sizeof(char));
+
+    to_tis620(string, len, cstr);
 
-    break_positions = brp;
     numbreaks = th_brk(cstr, break_positions, 128);
     if (numbreaks > 128) {
         break_positions = (int *)malloc(numbreaks * sizeof(int));
         numbreaks = th_brk(cstr, break_positions, numbreaks);
     }
 
-    for (i = 0; i < len; ++i)
+    for (i = 0; i < len; ++i) {
         attributes[i].lineBreakType = HB_NoBreak;
+        attributes[i].wordBoundary = FALSE;
+    }
 
     for (i = 0; i < numbreaks; ++i) {
-        if (break_positions[i] > 0)
+        if (break_positions[i] > 0) {
             attributes[break_positions[i]-1].lineBreakType = HB_Break;
+            attributes[i].wordBoundary = TRUE;
+        }
     }
 
     if (break_positions != brp)
         free(break_positions);
 
-    HB_TextCodec_FreeResult(cstr);
+    if (len > 128)
+        free(cstr);
 }
 
-
 void HB_ThaiAttributes(HB_Script script, const HB_UChar16 *text, hb_uint32 from, hb_uint32 len, HB_CharAttributes *attributes)
 {
     assert(script == HB_Script_Thai);
diff --git a/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc b/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc
new file mode 100644
index 0000000..133577a
--- /dev/null
+++ b/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc
@@ -0,0 +1,124 @@
+// This is a fuzzing harness for Harfbuzz. Since Harfbuzz's input is generally
+// expected to be controlled by a remote party it's a possible vector for
+// security issues.
+//
+// Fuzzing is a black-box testing scheme where the black-box (Harfbuzz's shaping
+// engine in this case) is fed random input to see if it will misbehave.
+// Misbehaviours can often be turned into security or crash issues.
+//
+// It's expected that one will generally run this under valgrind in order to get
+// better detection of problems.
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#include "../../src/harfbuzz-shaper.h"
+#include "../../src/harfbuzz-global.h"
+#include "../../src/harfbuzz-gpos.h"
+
+extern "C" {
+#include "../../contrib/harfbuzz-unicode.h"
+#include "../../contrib/harfbuzz-freetype.h"
+}
+
+static FT_Library freetype;
+
+static FT_Face loadFace(const char *path)
+{
+  FT_Face face;
+
+  if (FT_New_Face(freetype, path, /* index */ 0, &face))
+      return 0;
+  return face;
+}
+
+static const int kWidth = 100;
+static const int kHeight = 100;
+
+static int
+usage(const char *argv0) {
+  fprintf(stderr, "Usage: %s <TTF file>\n", argv0);
+  return 1;
+}
+
+int
+main(int argc, char **argv) {
+  FT_Init_FreeType(&freetype);
+
+  if (argc != 2)
+    return usage(argv[0]);
+
+  FT_Face face;
+  if (FT_New_Face(freetype, argv[1], 0 /* face index */, &face)) {
+    fprintf(stderr, "Failed to load font file\n");
+    return 1;
+  }
+
+  HB_Face hbFace = HB_NewFace(face, hb_freetype_table_sfnt_get);
+
+  HB_FontRec hbFont;
+  hbFont.klass = &hb_freetype_class;
+  hbFont.userData = face;
+  hbFont.x_ppem  = face->size->metrics.x_ppem;
+  hbFont.y_ppem  = face->size->metrics.y_ppem;
+  hbFont.x_scale = face->size->metrics.x_scale;
+  hbFont.y_scale = face->size->metrics.y_scale;
+
+  // This is the maximum number of bytes of input which we'll feed to Harfbuzz
+  // in one shot. We also overload it and make it the size of the output arrays
+  // as well. (Must be a power of two.)
+  static const unsigned kMaxInputBytes = 1024;
+  uint8_t str[kMaxInputBytes];
+
+  HB_ShaperItem shaper_item;
+  shaper_item.kerning_applied = false;
+  shaper_item.string = (HB_UChar16 *) str;
+  shaper_item.stringLength = 0;
+  shaper_item.item.bidiLevel = 0;
+  shaper_item.shaperFlags = 0;
+  shaper_item.font = &hbFont;
+  shaper_item.face = hbFace;
+  shaper_item.glyphIndicesPresent = false;
+  shaper_item.initialGlyphCount = 0;
+
+  HB_Glyph out_glyphs[kMaxInputBytes];
+  HB_GlyphAttributes out_attrs[kMaxInputBytes];
+  HB_Fixed out_advs[kMaxInputBytes];
+  HB_FixedPoint out_offsets[kMaxInputBytes];
+  unsigned short out_logClusters[kMaxInputBytes];
+
+  shaper_item.glyphs = out_glyphs;
+  shaper_item.attributes = out_attrs;
+  shaper_item.advances = out_advs;
+  shaper_item.offsets = out_offsets;
+  shaper_item.log_clusters = out_logClusters;
+  shaper_item.num_glyphs = kMaxInputBytes;
+
+  FILE *urandom = fopen("/dev/urandom", "rb");
+  if (!urandom) {
+    fprintf(stderr, "Cannot open /dev/urandom\n");
+    return 1;
+  }
+
+  for (;;) {
+    uint16_t len;
+    fread(&len, sizeof(len), 1, urandom);
+    len &= (kMaxInputBytes - 1);
+    len &= ~1;
+    fread(str, len, 1, urandom);
+
+    ssize_t iterator = 0;
+
+    for (;;) {
+      if (!hb_utf16_script_run_next(NULL, &shaper_item.item, (uint16_t *) str, len >> 1, &iterator))
+        break;
+
+      HB_ShapeItem(&shaper_item);
+    }
+  }
+
+  HB_FreeFace(hbFace);
+}
diff --git a/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp b/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
index ea03052..f0048b7 100644
--- a/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
+++ b/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
@@ -79,30 +79,9 @@ void HB_GetGraphemeAndLineBreakClass(HB_UChar32 ch, HB_GraphemeClass *grapheme,
     *lineBreak = (HB_LineBreakClass) prop->line_break_class;
 }
 
-void *HB_Library_Resolve(const char *library, const char *symbol)
+void *HB_Library_Resolve(const char *library, int version, const char *symbol)
 {
-    return QLibrary::resolve(library, symbol);
-}
-
-void *HB_TextCodecForMib(int mib)
-{
-    return QTextCodec::codecForMib(mib);
-}
-
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength)
-{
-    QByteArray data = reinterpret_cast<QTextCodec *>(codec)->fromUnicode((const QChar *)unicode, length);
-    // ### suboptimal
-    char *output = (char *)malloc(data.length() + 1);
-    memcpy(output, data.constData(), data.length() + 1);
-    if (outputLength)
-        *outputLength = data.length();
-    return output;
-}
-
-void HB_TextCodec_FreeResult(char *string)
-{
-    free(string);
+    return QLibrary::resolve(library, version, symbol);
 }
 
 }
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
index fd6125f..b0873ab 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
@@ -12,6 +12,23 @@
 
         * wtf/Platform.h:
 
+2010-04-28  Simon Hausmann  <simon.hausmann@nokia.com>, Kent Hansen <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JSC's currentThreadStackBase is not reentrant on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37195
+
+        This function needs to be reentrant to avoid memory corruption on platforms where
+        the implementation uses global variables.
+
+        This patch adds a mutex lock where necessary and makes the Symbian implementation
+        reentrant.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBaseMutex):
+        (JSC::currentThreadStackBase):
+
 2010-04-14  Kent Hansen  <kent.hansen@nokia.com>
 
         Reviewed by Maciej Stachowiak.
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
index 57f2a92..eafcc23 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
@@ -637,6 +637,8 @@ static inline void* currentThreadStackBase()
 #elif OS(HPUX)
     return hpux_get_stack_base();
 #elif OS(QNX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     return currentThreadStackBaseQNX();
 #elif OS(SOLARIS)
     stack_t s;
@@ -660,19 +662,17 @@ static inline void* currentThreadStackBase()
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
 #elif OS(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
-    }
-    return (void*)stackBase;
+    TThreadStackInfo info;
+    RThread thread;
+    thread.StackInfo(info);
+    return (void*)info.iBase;
 #elif OS(HAIKU)
     thread_info threadInfo;
     get_thread_info(find_thread(NULL), &threadInfo);
     return threadInfo.stack_end;
 #elif OS(UNIX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     static void* stackBase = 0;
     static size_t stackSize = 0;
     static pthread_t stackThread;
@@ -695,6 +695,8 @@ static inline void* currentThreadStackBase()
     }
     return static_cast<char*>(stackBase) + stackSize;
 #elif OS(WINCE)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     if (g_stackBase)
         return g_stackBase;
     else {
diff --git a/src/3rdparty/javascriptcore/VERSION b/src/3rdparty/javascriptcore/VERSION
index 1b5109a..daecc37 100644
--- a/src/3rdparty/javascriptcore/VERSION
+++ b/src/3rdparty/javascriptcore/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of JavaScriptCore from
 
 The commit imported was from the
 
-        javascriptcore-snapshot-19052010 branch/tag
+        javascriptcore-snapshot-16062010 branch/tag
 
 and has the sha1 checksum
 
-        8039ba79702d6516cf6841c9f15b324ec499bbf3
+        8b2d3443afca194f8ac50a63151dc9d19a150582
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
index 910d39a..799055d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
@@ -404,7 +404,9 @@ bool BitmapImage::internalAdvanceAnimation(bool skippingFrames)
         // Get the repetition count again.  If we weren't able to get a
         // repetition count before, we should have decoded the whole image by
         // now, so it should now be available.
-        if (repetitionCount(true) && m_repetitionsComplete >= m_repetitionCount) {
+        // Note that we don't need to special-case cAnimationLoopOnce here
+        // because it is 0 (see comments on its declaration in ImageSource.h).
+        if (repetitionCount(true) != cAnimationLoopInfinite && m_repetitionsComplete > m_repetitionCount) {
             m_animationFinished = true;
             m_desiredFrameStartTime = 0;
             --m_currentFrame;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
index 258fd0f..0853d7b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
@@ -86,7 +86,22 @@ typedef RefPtr<SharedBitmap> NativeImagePtr;
 #endif
 #endif
 
-const int cAnimationLoopOnce = -1;
+// Right now GIFs are the only recognized image format that supports animation.
+// The animation system and the constants below are designed with this in mind.
+// GIFs have an optional 16-bit unsigned loop count that describes how an
+// animated GIF should be cycled.  If the loop count is absent, the animation
+// cycles once; if it is 0, the animation cycles infinitely; otherwise the
+// animation plays n + 1 cycles (where n is the specified loop count).  If the
+// GIF decoder defaults to cAnimationLoopOnce in the absence of any loop count
+// and translates an explicit "0" loop count to cAnimationLoopInfinite, then we
+// get a couple of nice side effects:
+//   * By making cAnimationLoopOnce be 0, we allow the animation cycling code in
+//     BitmapImage.cpp to avoid special-casing it, and simply treat all
+//     non-negative loop counts identically.
+//   * By making the other two constants negative, we avoid conflicts with any
+//     real loop count values.
+const int cAnimationLoopOnce = 0;
+const int cAnimationLoopInfinite = -1;
 const int cAnimationNone = -2;
 
 class ImageSource : public Noncopyable {
diff --git a/src/corelib/io/qbuffer.cpp b/src/corelib/io/qbuffer.cpp
index c1ff353..73c71ea 100644
--- a/src/corelib/io/qbuffer.cpp
+++ b/src/corelib/io/qbuffer.cpp
@@ -62,6 +62,9 @@ public:
     QByteArray defaultBuf;
     int ioIndex;
 
+    virtual qint64 peek(char *data, qint64 maxSize);
+    virtual QByteArray peek(qint64 maxSize);
+
 #ifndef QT_NO_QOBJECT
     // private slots
     void _q_emitSignals();
@@ -83,6 +86,21 @@ void QBufferPrivate::_q_emitSignals()
 }
 #endif
 
+qint64 QBufferPrivate::peek(char *data, qint64 maxSize)
+{
+    qint64 readBytes = qMin(maxSize, static_cast<qint64>(buf->size()) - pos);
+    memcpy(data, buf->constData() + pos, readBytes);
+    return readBytes;
+}
+
+QByteArray QBufferPrivate::peek(qint64 maxSize)
+{
+    qint64 readBytes = qMin(maxSize, static_cast<qint64>(buf->size()) - pos);
+    if (pos == 0 && maxSize >= buf->size())
+        return *buf;
+    return QByteArray(buf->constData() + pos, readBytes);
+}
+
 /*!
     \class QBuffer
     \reentrant
diff --git a/src/corelib/io/qiodevice.cpp b/src/corelib/io/qiodevice.cpp
index 223df9b..ea60792 100644
--- a/src/corelib/io/qiodevice.cpp
+++ b/src/corelib/io/qiodevice.cpp
@@ -1442,6 +1442,35 @@ bool QIODevicePrivate::putCharHelper(char c)
     return q_func()->write(&c, 1) == 1;
 }
 
+/*!
+    \internal
+*/
+qint64 QIODevicePrivate::peek(char *data, qint64 maxSize)
+{
+    qint64 readBytes = q_func()->read(data, maxSize);
+    if (readBytes <= 0)
+        return readBytes;
+
+    buffer.ungetBlock(data, readBytes);
+    pos -= readBytes;
+    return readBytes;
+}
+
+/*!
+    \internal
+*/
+QByteArray QIODevicePrivate::peek(qint64 maxSize)
+{
+    QByteArray result = q_func()->read(maxSize);
+
+    if (result.isEmpty())
+        return result;
+
+    buffer.ungetBlock(result.constData(), result.size());
+    pos -= result.size();
+    return result;
+}
+
 /*! \fn bool QIODevice::getChar(char *c)
 
     Reads one character from the device and stores it in \a c. If \a c
@@ -1476,11 +1505,7 @@ bool QIODevice::getChar(char *c)
 */
 qint64 QIODevice::peek(char *data, qint64 maxSize)
 {
-    qint64 readBytes = read(data, maxSize);
-    int i = readBytes;
-    while (i > 0)
-        ungetChar(data[i-- - 1]);
-    return readBytes;
+    return d_func()->peek(data, maxSize);
 }
 
 /*!
@@ -1502,12 +1527,7 @@ qint64 QIODevice::peek(char *data, qint64 maxSize)
 */
 QByteArray QIODevice::peek(qint64 maxSize)
 {
-    QByteArray result = read(maxSize);
-    int i = result.size();
-    const char *data = result.constData();
-    while (i > 0)
-        ungetChar(data[i-- - 1]);
-    return result;
+    return d_func()->peek(maxSize);
 }
 
 /*!
diff --git a/src/corelib/io/qiodevice_p.h b/src/corelib/io/qiodevice_p.h
index 94dadca..4a25562 100644
--- a/src/corelib/io/qiodevice_p.h
+++ b/src/corelib/io/qiodevice_p.h
@@ -151,6 +151,15 @@ public:
         len++;
         *first = c;
     }
+    void ungetBlock(const char* block, int size) {
+        if ((first - buf) < size) {
+            // underflow, the existing valid data needs to move to the end of the (potentially bigger) buffer
+            makeSpace(len + size, freeSpaceAtStart);
+            memcpy(first - size, block, size);
+        }
+        first -= size;
+        len += size;
+    }
 
 private:
     enum FreeSpacePos {freeSpaceAtStart, freeSpaceAtEnd};
@@ -222,7 +231,9 @@ public:
             accessMode = q_func()->isSequential() ? Sequential : RandomAccess;
         return accessMode == Sequential;
     }
-    
+
+    virtual qint64 peek(char *data, qint64 maxSize);
+    virtual QByteArray peek(qint64 maxSize);
 
 #ifdef QT_NO_QOBJECT
     QIODevice *q_ptr;
diff --git a/src/corelib/tools/qharfbuzz.cpp b/src/corelib/tools/qharfbuzz.cpp
index 1b6d334..9166a14 100644
--- a/src/corelib/tools/qharfbuzz.cpp
+++ b/src/corelib/tools/qharfbuzz.cpp
@@ -102,45 +102,15 @@ HB_UChar16 HB_GetMirroredChar(HB_UChar16 ch)
     return QChar::mirroredChar(ch);
 }
 
-void *HB_Library_Resolve(const char *library, const char *symbol)
+void *HB_Library_Resolve(const char *library, int version, const char *symbol)
 {
 #ifdef QT_NO_LIBRARY
     return 0;
 #else
-    return QLibrary::resolve(QLatin1String(library), symbol);
+    return QLibrary::resolve(QLatin1String(library), version, symbol);
 #endif
 }
 
-void *HB_TextCodecForMib(int mib)
-{
-#ifndef QT_NO_TEXTCODEC
-    return QTextCodec::codecForMib(mib);
-#else
-    return 0;
-#endif
-}
-
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength)
-{
-#ifndef QT_NO_TEXTCODEC
-    QByteArray data = reinterpret_cast<QTextCodec *>(codec)->fromUnicode((const QChar *)unicode, length);
-    // ### suboptimal
-    char *output = (char *)malloc(data.length() + 1);
-    Q_CHECK_PTR(output);
-    memcpy(output, data.constData(), data.length() + 1);
-    if (outputLength)
-        *outputLength = data.length();
-    return output;
-#else
-    return 0;
-#endif
-}
-
-void HB_TextCodec_FreeResult(char *string)
-{
-    free(string);
-}
-
 } // extern "C"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/corelib/tools/qtextboundaryfinder.cpp b/src/corelib/tools/qtextboundaryfinder.cpp
index 9205297..bcddcb2 100644
--- a/src/corelib/tools/qtextboundaryfinder.cpp
+++ b/src/corelib/tools/qtextboundaryfinder.cpp
@@ -131,6 +131,11 @@ static void init(QTextBoundaryFinder::BoundaryType type, const QChar *chars, int
     Line break boundaries give possible places where a line break
     might happen and sentence boundaries will show the beginning and
     end of whole sentences.
+
+    The first position in a string is always a valid boundary and
+    refers to the position before the first character. The last
+    position at the length of the string is also valid and refers
+    to the position after the last character.
 */
 
 /*!
@@ -363,7 +368,8 @@ int QTextBoundaryFinder::toNextBoundary()
             ++pos;
         break;
     case Line:
-        while (pos < length && d->attributes[pos].lineBreakType < HB_Break)
+        Q_ASSERT(pos);
+        while (pos < length && d->attributes[pos-1].lineBreakType < HB_Break)
             ++pos;
         break;
     }
@@ -405,7 +411,7 @@ int QTextBoundaryFinder::toPreviousBoundary()
             --pos;
         break;
     case Line:
-        while (pos > 0 && d->attributes[pos].lineBreakType < HB_Break)
+        while (pos > 0 && d->attributes[pos-1].lineBreakType < HB_Break)
             --pos;
         break;
     }
@@ -430,7 +436,7 @@ bool QTextBoundaryFinder::isAtBoundary() const
     case Word:
         return d->attributes[pos].wordBoundary;
     case Line:
-        return d->attributes[pos].lineBreakType >= HB_Break;
+        return (pos > 0) ? d->attributes[pos-1].lineBreakType >= HB_Break : true;
     case Sentence:
         return d->attributes[pos].sentenceBoundary;
     }
diff --git a/src/declarative/graphicsitems/qdeclarativeflickable.cpp b/src/declarative/graphicsitems/qdeclarativeflickable.cpp
index fdc1444..6dfd4d9 100644
--- a/src/declarative/graphicsitems/qdeclarativeflickable.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeflickable.cpp
@@ -1214,6 +1214,7 @@ bool QDeclarativeFlickable::sendMouseEvent(QGraphicsSceneMouseEvent *event)
         default:
             break;
         }
+        stealThisEvent = d->stealMouse;   // Update stealThisEvent and grabber in case changed by function calls above
         grabber = qobject_cast<QDeclarativeItem*>(s->mouseGrabberItem());
         if (grabber && stealThisEvent && !grabber->keepMouseGrab() && grabber != this) {
             d->clearDelayedPress();
diff --git a/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp b/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
index 0be8dac..b198077 100644
--- a/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
@@ -79,8 +79,24 @@
 #endif
 #include "private/qdeclarativeanchors_p.h"
 
+static QDeclarativePrivate::AutoParentResult qgraphicsobject_autoParent(QObject *obj, QObject *parent)
+{
+    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(obj);
+    if (!gobj)
+        return QDeclarativePrivate::IncompatibleObject;
+
+    QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parent);
+    if (!gparent)
+        return QDeclarativePrivate::IncompatibleParent;
+
+    gobj->setParentItem(gparent);
+    return QDeclarativePrivate::Parented;
+}
+
 void QDeclarativeItemModule::defineModule()
 {
+    QDeclarativePrivate::registerAutoParentFunction(qgraphicsobject_autoParent);
+
 #ifdef QT_NO_MOVIE
     qmlRegisterTypeNotAvailable("Qt",4,7,"AnimatedImage",
         qApp->translate("QDeclarativeAnimatedImage","Qt was built without support for QMovie"));
diff --git a/src/declarative/graphicsitems/qdeclarativepositioners.cpp b/src/declarative/graphicsitems/qdeclarativepositioners.cpp
index ad61bab..b9231a1 100644
--- a/src/declarative/graphicsitems/qdeclarativepositioners.cpp
+++ b/src/declarative/graphicsitems/qdeclarativepositioners.cpp
@@ -358,6 +358,8 @@ Column {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Column.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Row, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -502,6 +504,8 @@ Row {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Row.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Column, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -657,6 +661,8 @@ Grid {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Grid.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Flow, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -913,6 +919,8 @@ void QDeclarativeGrid::reportConflictingAnchors()
   positioner may exhibit strange behaviour.  If you need to perform any of these
   actions, consider positioning the items without the use of a Flow.
 
+  Items with a width or height of 0 will not be positioned.
+
     \sa Grid, {declarative/positioners}{Positioners example}
 */
 /*!
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput.cpp b/src/declarative/graphicsitems/qdeclarativetextinput.cpp
index cba01ef..9e5dfb5 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput.cpp
+++ b/src/declarative/graphicsitems/qdeclarativetextinput.cpp
@@ -100,6 +100,7 @@ void QDeclarativeTextInput::setText(const QString &s)
     if(s == text())
         return;
     d->control->setText(s);
+    d->updateHorizontalScroll();
     //emit textChanged();
 }
 
@@ -337,6 +338,7 @@ void QDeclarativeTextInput::setHAlign(HAlignment align)
         return;
     d->hAlign = align;
     updateRect();
+    d->updateHorizontalScroll();
     emit horizontalAlignmentChanged(d->hAlign);
 }
 
@@ -554,7 +556,9 @@ void QDeclarativeTextInput::setAutoScroll(bool b)
         return;
 
     d->autoScroll = b;
-
+    d->updateHorizontalScroll();
+    //We need to repaint so that the scrolling is taking into account.
+    updateSize(true);
     emit autoScrollChanged(d->autoScroll);
 }
 
@@ -836,17 +840,23 @@ void QDeclarativeTextInput::moveCursor()
     Q_D(QDeclarativeTextInput);
     if(!d->cursorItem)
         return;
+    d->updateHorizontalScroll();
     d->cursorItem->setX(d->control->cursorToX() - d->hscroll);
 }
 
 /*!
-    \qmlmethod rect TextInput::positionToRectangle(int x)
+    \qmlmethod rect TextInput::positionToRectangle(int pos)
+
+    This function takes a character position and returns the rectangle that the
+    cursor would occupy, if it was placed at that character position.
+
+    This is similar to setting the cursorPosition, and then querying the cursor
+    rectangle, but the cursorPosition is not changed.
 */
-QRectF QDeclarativeTextInput::positionToRectangle(int x) const
+QRectF QDeclarativeTextInput::positionToRectangle(int pos) const
 {
     Q_D(const QDeclarativeTextInput);
-    QFontMetrics fm = QFontMetrics(d->font);
-    return QRectF(d->control->cursorToX(x)-d->hscroll,
+    return QRectF(d->control->cursorToX(pos)-d->hscroll,
         0.0,
         d->control->cursorWidth(),
         cursorRectangle().height());
@@ -1006,61 +1016,73 @@ void QDeclarativeTextInput::geometryChanged(const QRectF &newGeometry,
     QDeclarativePaintedItem::geometryChanged(newGeometry, oldGeometry);
 }
 
-void QDeclarativeTextInput::drawContents(QPainter *p, const QRect &r)
+void QDeclarativeTextInputPrivate::updateHorizontalScroll()
 {
-    Q_D(QDeclarativeTextInput);
-    p->setRenderHint(QPainter::TextAntialiasing, true);
-    p->save();
-    p->setPen(QPen(d->color));
-    int flags = QLineControl::DrawText;
-    if(!isReadOnly() && d->cursorVisible && !d->cursorItem)
-        flags |= QLineControl::DrawCursor;
-    if (d->control->hasSelectedText())
-            flags |= QLineControl::DrawSelections;
-    QPoint offset = QPoint(0,0);
-    QFontMetrics fm = QFontMetrics(d->font);
-    int cix = qRound(d->control->cursorToX());
-    QRect br(boundingRect().toRect());
+    Q_Q(QDeclarativeTextInput);
+    QFontMetrics fm = QFontMetrics(font);
+    int cix = qRound(control->cursorToX());
+    QRect br(q->boundingRect().toRect());
     //###Is this using bearing appropriately?
     int minLB = qMax(0, -fm.minLeftBearing());
     int minRB = qMax(0, -fm.minRightBearing());
-    int widthUsed = qRound(d->control->naturalTextWidth()) + 1 + minRB;
-    if (d->autoScroll) {
+    int widthUsed = qRound(control->naturalTextWidth()) + 1 + minRB;
+    if (autoScroll) {
         if ((minLB + widthUsed) <=  br.width()) {
             // text fits in br; use hscroll for alignment
-            switch (d->hAlign & ~(Qt::AlignAbsolute|Qt::AlignVertical_Mask)) {
+            switch (hAlign & ~(Qt::AlignAbsolute|Qt::AlignVertical_Mask)) {
             case Qt::AlignRight:
-                d->hscroll = widthUsed - br.width() + 1;
+                hscroll = widthUsed - br.width() + 1;
                 break;
             case Qt::AlignHCenter:
-                d->hscroll = (widthUsed - br.width()) / 2;
+                hscroll = (widthUsed - br.width()) / 2;
                 break;
             default:
                 // Left
-                d->hscroll = 0;
+                hscroll = 0;
                 break;
             }
-            d->hscroll -= minLB;
-        } else if (cix - d->hscroll >= br.width()) {
+            hscroll -= minLB;
+        } else if (cix - hscroll >= br.width()) {
             // text doesn't fit, cursor is to the right of br (scroll right)
-            d->hscroll = cix - br.width() + 1;
-        } else if (cix - d->hscroll < 0 && d->hscroll < widthUsed) {
+            hscroll = cix - br.width() + 1;
+        } else if (cix - hscroll < 0 && hscroll < widthUsed) {
             // text doesn't fit, cursor is to the left of br (scroll left)
-            d->hscroll = cix;
-        } else if (widthUsed - d->hscroll < br.width()) {
+            hscroll = cix;
+        } else if (widthUsed - hscroll < br.width()) {
             // text doesn't fit, text document is to the left of br; align
             // right
-            d->hscroll = widthUsed - br.width() + 1;
+            hscroll = widthUsed - br.width() + 1;
+        }
+    } else {
+        if(hAlign == QDeclarativeTextInput::AlignRight){
+            hscroll = q->width() - widthUsed;
+        }else if(hAlign == QDeclarativeTextInput::AlignHCenter){
+            hscroll = (q->width() - widthUsed) / 2;
+        } else {
+            hscroll = 0;
         }
+        hscroll -= minLB;
+    }
+}
+
+void QDeclarativeTextInput::drawContents(QPainter *p, const QRect &r)
+{
+    Q_D(QDeclarativeTextInput);
+    p->setRenderHint(QPainter::TextAntialiasing, true);
+    p->save();
+    p->setPen(QPen(d->color));
+    int flags = QLineControl::DrawText;
+    if(!isReadOnly() && d->cursorVisible && !d->cursorItem)
+        flags |= QLineControl::DrawCursor;
+    if (d->control->hasSelectedText())
+            flags |= QLineControl::DrawSelections;
+    QPoint offset = QPoint(0,0);
+    QFontMetrics fm = QFontMetrics(d->font);
+    QRect br(boundingRect().toRect());
+    if (d->autoScroll) {
         // the y offset is there to keep the baseline constant in case we have script changes in the text.
         offset = br.topLeft() - QPoint(d->hscroll, d->control->ascent() - fm.ascent());
     } else {
-        if(d->hAlign == AlignRight){
-            d->hscroll = width() - widthUsed;
-        }else if(d->hAlign == AlignHCenter){
-            d->hscroll = (width() - widthUsed) / 2;
-        }
-        d->hscroll -= minLB;
         offset = QPoint(d->hscroll, 0);
     }
     d->control->draw(p, offset, r, flags);
@@ -1230,6 +1252,7 @@ void QDeclarativeTextInput::moveCursorSelection(int position)
 {
     Q_D(QDeclarativeTextInput);
     d->control->moveCursor(position, true);
+    d->updateHorizontalScroll();
 }
 
 /*!
@@ -1420,6 +1443,7 @@ void QDeclarativeTextInput::selectionChanged()
 void QDeclarativeTextInput::q_textChanged()
 {
     Q_D(QDeclarativeTextInput);
+    d->updateHorizontalScroll();
     updateSize();
     emit textChanged();
     if(hasAcceptableInput() != d->oldValidity){
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput_p.h b/src/declarative/graphicsitems/qdeclarativetextinput_p.h
index c539bd3..03f55ae 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput_p.h
+++ b/src/declarative/graphicsitems/qdeclarativetextinput_p.h
@@ -112,7 +112,7 @@ public:
 
     //Auxilliary functions needed to control the TextInput from QML
     Q_INVOKABLE int positionAt(int x) const;
-    Q_INVOKABLE QRectF positionToRectangle(int x) const;
+    Q_INVOKABLE QRectF positionToRectangle(int pos) const;
     Q_INVOKABLE void moveCursorSelection(int pos);
 
     Q_INVOKABLE void openSoftwareInputPanel();
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h b/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
index 6865147..8b74bcc 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
+++ b/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
@@ -99,6 +99,7 @@ public:
     void init();
     void startCreatingCursor();
     void focusChanged(bool hasFocus);
+    void updateHorizontalScroll();
 
     QLineControl* control;
 
diff --git a/src/declarative/qml/qdeclarativecomponent.cpp b/src/declarative/qml/qdeclarativecomponent.cpp
index 55ee783..b4919ff 100644
--- a/src/declarative/qml/qdeclarativecomponent.cpp
+++ b/src/declarative/qml/qdeclarativecomponent.cpp
@@ -60,7 +60,6 @@
 #include <QFileInfo>
 #include <QtCore/qdebug.h>
 #include <QApplication>
-#include <QGraphicsObject>
 
 QT_BEGIN_NAMESPACE
 
@@ -579,20 +578,26 @@ QScriptValue QDeclarativeComponent::createObject(QObject* parent)
     if (!ret)
         return QScriptValue(QScriptValue::NullValue);
 
-    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(ret);
-    bool needParent = (gobj != 0);
-    if(parent){
+
+    if (parent) {
         ret->setParent(parent);
-        if (gobj) {
-            QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parent);
-            if(gparent){
-                gobj->setParentItem(gparent);
+        QList<QDeclarativePrivate::AutoParentFunction> functions = QDeclarativeMetaType::parentFunctions();
+
+        bool needParent = false;
+
+        for (int ii = 0; ii < functions.count(); ++ii) {
+            QDeclarativePrivate::AutoParentResult res = functions.at(ii)(ret, parent);
+            if (res == QDeclarativePrivate::Parented) {
                 needParent = false;
+                break;
+            } else if (res == QDeclarativePrivate::IncompatibleParent) {
+                needParent = true;
             }
         }
+
+        if (needParent) 
+            qWarning("QDeclarativeComponent: Created graphical object was not placed in the graphics scene.");
     }
-    if(needParent)
-        qWarning("QDeclarativeComponent: Created graphical object was not placed in the graphics scene.");
 
     QDeclarativeEnginePrivate *priv = QDeclarativeEnginePrivate::get(d->engine);
     QDeclarativeData::get(ret, true)->setImplicitDestructible();
diff --git a/src/declarative/qml/qdeclarativeengine.cpp b/src/declarative/qml/qdeclarativeengine.cpp
index 0715624..5c4d229 100644
--- a/src/declarative/qml/qdeclarativeengine.cpp
+++ b/src/declarative/qml/qdeclarativeengine.cpp
@@ -93,7 +93,6 @@
 #include <QtGui/qcolor.h>
 #include <QtGui/qvector3d.h>
 #include <QtGui/qsound.h>
-#include <QGraphicsObject>
 #include <QtCore/qcryptographichash.h>
 
 #include <private/qobject_p.h>
@@ -1195,10 +1194,12 @@ QScriptValue QDeclarativeEnginePrivate::createQmlObject(QScriptContext *ctxt, QS
     Q_ASSERT(obj);
 
     obj->setParent(parentArg);
-    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(obj);
-    QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parentArg);
-    if(gobj && gparent)
-        gobj->setParentItem(gparent);
+
+    QList<QDeclarativePrivate::AutoParentFunction> functions = QDeclarativeMetaType::parentFunctions();
+    for (int ii = 0; ii < functions.count(); ++ii) {
+        if (QDeclarativePrivate::Parented == functions.at(ii)(obj, parentArg))
+            break;
+    }
 
     QDeclarativeData::get(obj, true)->setImplicitDestructible();
     return activeEnginePriv->objectClass->newQObject(obj, QMetaType::QObjectStar);
diff --git a/src/declarative/qml/qdeclarativemetatype.cpp b/src/declarative/qml/qdeclarativemetatype.cpp
index 5fcb7ee..c32cab6 100644
--- a/src/declarative/qml/qdeclarativemetatype.cpp
+++ b/src/declarative/qml/qdeclarativemetatype.cpp
@@ -112,6 +112,8 @@ struct QDeclarativeMetaTypeData
     QBitArray objects;
     QBitArray interfaces;
     QBitArray lists;
+
+    QList<QDeclarativePrivate::AutoParentFunction> parentFunctions;
 };
 Q_GLOBAL_STATIC(QDeclarativeMetaTypeData, metaTypeData)
 Q_GLOBAL_STATIC(QReadWriteLock, metaTypeDataLock)
@@ -483,6 +485,16 @@ int QDeclarativeType::index() const
     return d->m_index;
 }
 
+int QDeclarativePrivate::registerAutoParentFunction(AutoParentFunction function)
+{
+    QWriteLocker lock(metaTypeDataLock());
+    QDeclarativeMetaTypeData *data = metaTypeData();
+
+    data->parentFunctions.append(function);
+
+    return data->parentFunctions.count() - 1;
+}
+
 int QDeclarativePrivate::registerType(const QDeclarativePrivate::RegisterInterface &interface)
 {
     if (interface.version > 0) 
@@ -583,6 +595,13 @@ bool QDeclarativeMetaType::isModule(const QByteArray &module, int versionMajor,
                     ((*it).vmajor_min == versionMajor && (*it).vminor_min <= versionMinor))));
 }
 
+QList<QDeclarativePrivate::AutoParentFunction> QDeclarativeMetaType::parentFunctions()
+{
+    QReadLocker lock(metaTypeDataLock());
+    QDeclarativeMetaTypeData *data = metaTypeData();
+    return data->parentFunctions;
+}
+
 QObject *QDeclarativeMetaType::toQObject(const QVariant &v, bool *ok)
 {
     if (!isQObject(v.userType())) {
diff --git a/src/declarative/qml/qdeclarativemetatype_p.h b/src/declarative/qml/qdeclarativemetatype_p.h
index bf6a700..4c98b6f 100644
--- a/src/declarative/qml/qdeclarativemetatype_p.h
+++ b/src/declarative/qml/qdeclarativemetatype_p.h
@@ -99,6 +99,8 @@ public:
     static StringConverter customStringConverter(int);
 
     static bool isModule(const QByteArray &module, int versionMajor, int versionMinor);
+
+    static QList<QDeclarativePrivate::AutoParentFunction> parentFunctions();
 };
 
 class QDeclarativeTypePrivate;
diff --git a/src/declarative/qml/qdeclarativeprivate.h b/src/declarative/qml/qdeclarativeprivate.h
index e657dd5..cd859fe 100644
--- a/src/declarative/qml/qdeclarativeprivate.h
+++ b/src/declarative/qml/qdeclarativeprivate.h
@@ -214,6 +214,10 @@ namespace QDeclarativePrivate
         const char *iid;
     };
 
+    enum AutoParentResult { Parented, IncompatibleObject, IncompatibleParent };
+    typedef AutoParentResult (*AutoParentFunction)(QObject *object, QObject *parent);
+
+    int Q_DECLARATIVE_EXPORT registerAutoParentFunction(AutoParentFunction);
     int Q_DECLARATIVE_EXPORT registerType(const RegisterType &);
     int Q_DECLARATIVE_EXPORT registerType(const RegisterInterface &);
 
diff --git a/src/declarative/util/qdeclarativepackage.cpp b/src/declarative/util/qdeclarativepackage.cpp
index b149120..1e49ad9 100644
--- a/src/declarative/util/qdeclarativepackage.cpp
+++ b/src/declarative/util/qdeclarativepackage.cpp
@@ -74,7 +74,7 @@ QT_BEGIN_NAMESPACE
 */
 
 /*!
-    \qmlattachedproperty bool Package::name
+    \qmlattachedproperty string Package::name
     This attached property holds the name of an item within a Package.
 */
 
diff --git a/src/gui/graphicsview/qgraphicsgridlayout.cpp b/src/gui/graphicsview/qgraphicsgridlayout.cpp
index 6ca799d..83db3ec 100644
--- a/src/gui/graphicsview/qgraphicsgridlayout.cpp
+++ b/src/gui/graphicsview/qgraphicsgridlayout.cpp
@@ -572,6 +572,18 @@ void QGraphicsGridLayout::removeAt(int index)
         if (QGraphicsLayoutItem *layoutItem = gridItem->layoutItem())
             layoutItem->setParentLayoutItem(0);
         d->engine.removeItem(gridItem);
+
+        // recalculate rowInfo.count if we remove an item that is on the right/bottommost row
+        for (int j = 0; j < NOrientations; ++j) {
+            // 0: Hor, 1: Ver
+            const Qt::Orientation orient = (j == 0 ? Qt::Horizontal : Qt::Vertical);
+            const int oldCount = d->engine.rowCount(orient);
+            if (gridItem->lastRow(orient) == oldCount - 1) {
+                const int newCount = d->engine.effectiveLastRow(orient) + 1;
+                d->engine.removeRows(newCount, oldCount - newCount, orient);
+            }
+        }
+
         delete gridItem;
         invalidate();
     }
diff --git a/src/gui/graphicsview/qgraphicsitem.cpp b/src/gui/graphicsview/qgraphicsitem.cpp
index 51acf9b..2de3638 100644
--- a/src/gui/graphicsview/qgraphicsitem.cpp
+++ b/src/gui/graphicsview/qgraphicsitem.cpp
@@ -3277,7 +3277,8 @@ void QGraphicsItemPrivate::setFocusHelper(Qt::FocusReason focusReason, bool clim
 */
 void QGraphicsItem::clearFocus()
 {
-    d_ptr->clearFocusHelper(/* giveFocusToParent = */ true);
+    if (hasFocus())
+        d_ptr->clearFocusHelper(/* giveFocusToParent = */ true);
 }
 
 /*!
diff --git a/src/gui/graphicsview/qgraphicslinearlayout.cpp b/src/gui/graphicsview/qgraphicslinearlayout.cpp
index 9722683..b828722 100644
--- a/src/gui/graphicsview/qgraphicslinearlayout.cpp
+++ b/src/gui/graphicsview/qgraphicslinearlayout.cpp
@@ -147,7 +147,7 @@ void QGraphicsLinearLayoutPrivate::removeGridItem(QGridLayoutItem *gridItem)
 {
     int index = gridItem->firstRow(orientation);
     engine.removeItem(gridItem);
-    engine.removeRow(index, orientation);
+    engine.removeRows(index, 1, orientation);
 }
 
 void QGraphicsLinearLayoutPrivate::fixIndex(int *index) const
diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index 6c5623e..ca3b56f 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -6277,7 +6277,8 @@ void QGraphicsScenePrivate::cancelGesturesForChildren(QGesture *original)
 {
     Q_ASSERT(original);
     QGraphicsItem *originalItem = gestureTargets.value(original);
-    Q_ASSERT(originalItem);
+    if (originalItem == 0) // we only act on accepted gestures, which implies it has a target.
+        return;
 
     // iterate over all active gestures and for each find the owner
     // if the owner is part of our sub-hierarchy, cancel it.
diff --git a/src/gui/graphicsview/qgridlayoutengine_p.h b/src/gui/graphicsview/qgridlayoutengine_p.h
index cbf704e..9ac9a8e 100644
--- a/src/gui/graphicsview/qgridlayoutengine_p.h
+++ b/src/gui/graphicsview/qgridlayoutengine_p.h
@@ -363,8 +363,8 @@ public:
     QGridLayoutItem *itemAt(int row, int column, Qt::Orientation orientation = Qt::Vertical) const;
     inline void insertRow(int row, Qt::Orientation orientation = Qt::Vertical)
         { insertOrRemoveRows(row, +1, orientation); }
-    inline void removeRow(int row, Qt::Orientation orientation = Qt::Vertical)
-        { insertOrRemoveRows(row, -1, orientation); }
+    inline void removeRows(int row, int count, Qt::Orientation orientation)
+        { insertOrRemoveRows(row, -count, orientation); }
 
     void invalidate();
     void setGeometries(const QLayoutStyleInfo &styleInfo, const QRectF &contentsGeometry);
diff --git a/src/gui/kernel/qapplication_s60.cpp b/src/gui/kernel/qapplication_s60.cpp
index a50fd95..d5d4be6 100644
--- a/src/gui/kernel/qapplication_s60.cpp
+++ b/src/gui/kernel/qapplication_s60.cpp
@@ -2196,4 +2196,29 @@ void QApplication::restoreOverrideCursor()
 
 #endif // QT_NO_CURSOR
 
+QS60ThreadLocalData::QS60ThreadLocalData()
+{
+    CCoeEnv *env = CCoeEnv::Static();
+    if (env) {
+        //if this is the UI thread, share objects owned by CONE
+        usingCONEinstances = true;
+        wsSession = env->WsSession();
+        screenDevice = env->ScreenDevice();
+    }
+    else {
+        usingCONEinstances = false;
+        qt_symbian_throwIfError(wsSession.Connect(qt_s60GetRFs()));
+        screenDevice = new CWsScreenDevice(wsSession);
+        screenDevice->Construct();
+    }
+}
+
+QS60ThreadLocalData::~QS60ThreadLocalData()
+{
+    if (!usingCONEinstances) {
+        delete screenDevice;
+        wsSession.Close();
+    }
+}
+
 QT_END_NAMESPACE
diff --git a/src/gui/kernel/qclipboard_x11.cpp b/src/gui/kernel/qclipboard_x11.cpp
index 3bdc971..9fcc718 100644
--- a/src/gui/kernel/qclipboard_x11.cpp
+++ b/src/gui/kernel/qclipboard_x11.cpp
@@ -1518,7 +1518,7 @@ bool qt_xfixes_selection_changed(Window selectionOwner, Time timestamp)
           (unsigned int)(d ? d->timestamp : 0), (unsigned int)timestamp);
 #endif
     if (!owner || (selectionOwner && selectionOwner != owner->internalWinId()) ||
-        (!selectionOwner && d->timestamp != CurrentTime && d->timestamp < timestamp))
+        (!selectionOwner && (d->timestamp == CurrentTime || d->timestamp < timestamp)))
         return qt_check_selection_sentinel();
     return false;
 }
@@ -1532,7 +1532,7 @@ bool qt_xfixes_clipboard_changed(Window clipboardOwner, Time timestamp)
           (unsigned int)(d ? d->timestamp : 0), (unsigned int)timestamp);
 #endif
     if (!owner || (clipboardOwner && clipboardOwner != owner->internalWinId()) ||
-        (!clipboardOwner && d->timestamp != CurrentTime && d->timestamp < timestamp))
+        (!clipboardOwner && (d->timestamp == CurrentTime || d->timestamp < timestamp)))
         return qt_check_clipboard_sentinel();
     return false;
 }
diff --git a/src/gui/kernel/qt_s60_p.h b/src/gui/kernel/qt_s60_p.h
index fe3fa57..ed53ccf 100644
--- a/src/gui/kernel/qt_s60_p.h
+++ b/src/gui/kernel/qt_s60_p.h
@@ -63,6 +63,7 @@
 #include "qpointer.h"
 #include "qapplication.h"
 #include "qelapsedtimer.h"
+#include "QtCore/qthreadstorage.h"
 #include <w32std.h>
 #include <coecntrl.h>
 #include <eikenv.h>
@@ -86,10 +87,21 @@ const TInt KInternalStatusPaneChange = 0x50000000;
 //this macro exists because EColor16MAP enum value doesn't exist in Symbian OS 9.2
 #define Q_SYMBIAN_ECOLOR16MAP TDisplayMode(13)
 
+class QS60ThreadLocalData
+{
+public:
+    QS60ThreadLocalData();
+    ~QS60ThreadLocalData();
+    bool usingCONEinstances;
+    RWsSession wsSession;
+    CWsScreenDevice *screenDevice;
+};
+
 class QS60Data
 {
 public:
     QS60Data();
+    QThreadStorage<QS60ThreadLocalData *> tls;
     TUid uid;
     int screenDepth;
     QPoint lastCursorPos;
@@ -132,9 +144,9 @@ public:
     int memoryLimitForHwRendering;
     QApplication::QS60MainApplicationFactory s60ApplicationFactory; // typedef'ed pointer type
     static inline void updateScreenSize();
-    static inline RWsSession& wsSession();
+    inline RWsSession& wsSession();
     static inline RWindowGroup& windowGroup();
-    static inline CWsScreenDevice* screenDevice();
+    inline CWsScreenDevice* screenDevice();
     static inline CCoeAppUi* appUi();
     static inline CEikMenuBar* menuBar();
 #ifdef Q_WS_S60
@@ -265,7 +277,10 @@ inline void QS60Data::updateScreenSize()
 
 inline RWsSession& QS60Data::wsSession()
 {
-    return CCoeEnv::Static()->WsSession();
+    if(!tls.hasLocalData()) {
+        tls.setLocalData(new QS60ThreadLocalData);
+    }
+    return tls.localData()->wsSession;
 }
 
 inline RWindowGroup& QS60Data::windowGroup()
@@ -275,7 +290,10 @@ inline RWindowGroup& QS60Data::windowGroup()
 
 inline CWsScreenDevice* QS60Data::screenDevice()
 {
-    return CCoeEnv::Static()->ScreenDevice();
+    if(!tls.hasLocalData()) {
+        tls.setLocalData(new QS60ThreadLocalData);
+    }
+    return tls.localData()->screenDevice;
 }
 
 inline CCoeAppUi* QS60Data::appUi()
diff --git a/src/gui/painting/qoutlinemapper.cpp b/src/gui/painting/qoutlinemapper.cpp
index 1b01960..bf03545 100644
--- a/src/gui/painting/qoutlinemapper.cpp
+++ b/src/gui/painting/qoutlinemapper.cpp
@@ -234,12 +234,12 @@ void QOutlineMapper::endOutline()
 
 
     // Check for out of dev bounds...
-    const bool do_clip = (controlPointRect.left() < -QT_RASTER_COORD_LIMIT
+    const bool do_clip = !m_in_clip_elements && ((controlPointRect.left() < -QT_RASTER_COORD_LIMIT
                           || controlPointRect.right() > QT_RASTER_COORD_LIMIT
                           || controlPointRect.top() < -QT_RASTER_COORD_LIMIT
                           || controlPointRect.bottom() > QT_RASTER_COORD_LIMIT
                           || controlPointRect.width() > QT_RASTER_COORD_LIMIT
-                          || controlPointRect.height() > QT_RASTER_COORD_LIMIT);
+                          || controlPointRect.height() > QT_RASTER_COORD_LIMIT));
 
     if (do_clip) {
         clipElements(elements, elementTypes(), element_count);
@@ -353,7 +353,13 @@ void QOutlineMapper::clipElements(const QPointF *elements,
     // instead of going through convenience functionallity, but since
     // this part of code hardly every used, it shouldn't matter.
 
+    m_in_clip_elements = true;
+
     QPainterPath path;
+
+    if (!(m_outline.flags & QT_FT_OUTLINE_EVEN_ODD_FILL))
+        path.setFillRule(Qt::WindingFill);
+
     if (types) {
         for (int i=0; i<element_count; ++i) {
             switch (types[i]) {
@@ -389,6 +395,8 @@ void QOutlineMapper::clipElements(const QPointF *elements,
     else
         convertPath(clippedPath);
     m_txop = old_txop;
+
+    m_in_clip_elements = false;
 }
 
 QT_END_NAMESPACE
diff --git a/src/gui/painting/qoutlinemapper_p.h b/src/gui/painting/qoutlinemapper_p.h
index 39b7593..f64d03b 100644
--- a/src/gui/painting/qoutlinemapper_p.h
+++ b/src/gui/painting/qoutlinemapper_p.h
@@ -95,7 +95,8 @@ public:
         m_tags(0),
         m_contours(0),
         m_polygon_dev(0),
-        m_round_coords(false)
+        m_round_coords(false),
+        m_in_clip_elements(false)
     {
     }
 
@@ -235,6 +236,7 @@ public:
     qreal m_dy;
 
     bool m_valid;
+    bool m_in_clip_elements;
 
 private:
     bool m_round_coords;
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index f10f12f..a212718 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -459,13 +459,12 @@ bool QRasterPaintEngine::begin(QPaintDevice *device)
 
     QRasterPaintEngineState *s = state();
     ensureOutlineMapper();
-    d->outlineMapper->m_clip_rect = d->deviceRect.adjusted(-10, -10, 10, 10);
-
-    // This is the upp
-    QRect bounds(-QT_RASTER_COORD_LIMIT, -QT_RASTER_COORD_LIMIT,
-                 QT_RASTER_COORD_LIMIT*2 - 1, QT_RASTER_COORD_LIMIT * 2 - 1);
-    d->outlineMapper->m_clip_rect = bounds.intersected(d->outlineMapper->m_clip_rect);
+    d->outlineMapper->m_clip_rect = d->deviceRect;
 
+    if (d->outlineMapper->m_clip_rect.width() > QT_RASTER_COORD_LIMIT)
+        d->outlineMapper->m_clip_rect.setWidth(QT_RASTER_COORD_LIMIT);
+    if (d->outlineMapper->m_clip_rect.height() > QT_RASTER_COORD_LIMIT)
+        d->outlineMapper->m_clip_rect.setHeight(QT_RASTER_COORD_LIMIT);
 
     d->rasterizer->setClipRect(d->deviceRect);
 
diff --git a/src/gui/painting/qpaintengineex.cpp b/src/gui/painting/qpaintengineex.cpp
index ff82d59..e0746fb 100644
--- a/src/gui/painting/qpaintengineex.cpp
+++ b/src/gui/painting/qpaintengineex.cpp
@@ -494,11 +494,9 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
         } else {
             d->activeStroker->moveTo(points[0], points[1]);
             points += 2;
-            ++types;
             while (points < lastPoint) {
                 d->activeStroker->lineTo(points[0], points[1]);
                 points += 2;
-                ++types;
             }
             if (path.hasImplicitClose())
                 d->activeStroker->lineTo(path.points()[0], path.points()[1]);
@@ -561,12 +559,10 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
                 QPointF p = ((QPointF *)points)[0] * state()->matrix;
                 d->activeStroker->moveTo(p.x(), p.y());
                 points += 2;
-                ++types;
                 while (points < lastPoint) {
                     QPointF p = ((QPointF *)points)[0] * state()->matrix;
                     d->activeStroker->lineTo(p.x(), p.y());
                     points += 2;
-                    ++types;
                 }
                 if (path.hasImplicitClose())
                     d->activeStroker->lineTo(p.x(), p.y());
diff --git a/src/gui/text/qfontdatabase.cpp b/src/gui/text/qfontdatabase.cpp
index 4c058ce..139139f 100644
--- a/src/gui/text/qfontdatabase.cpp
+++ b/src/gui/text/qfontdatabase.cpp
@@ -289,7 +289,7 @@ QtFontSize *QtFontStyle::pixelSize(unsigned short size, bool add)
         QtFontSize *newPixelSizes = (QtFontSize *)malloc(sizeof(QtFontSize));
         Q_CHECK_PTR(newPixelSizes);
         pixelSizes = newPixelSizes;
-    } else if (!(count % 8)) {
+    } else if (!(count % 8) || count == 1) {
         QtFontSize *newPixelSizes = (QtFontSize *)
                      realloc(pixelSizes,
                               (((count+8) >> 3) << 3) * sizeof(QtFontSize));
diff --git a/src/gui/text/qfontdatabase_s60.cpp b/src/gui/text/qfontdatabase_s60.cpp
index 943df7f..cdfba3d 100644
--- a/src/gui/text/qfontdatabase_s60.cpp
+++ b/src/gui/text/qfontdatabase_s60.cpp
@@ -118,7 +118,7 @@ public:
         {
             if (!font)
                 return;
-            QS60Data::screenDevice()->ReleaseFont(font);
+            S60->screenDevice()->ReleaseFont(font);
         }
     };
 
@@ -205,7 +205,7 @@ const QSymbianTypeFaceExtras *QSymbianFontDatabaseExtrasImplementation::extras(c
 
         CFont* font = NULL;
 #ifdef Q_SYMBIAN_HAS_FONTTABLE_API
-        const TInt err = QS60Data::screenDevice()->GetNearestFontToDesignHeightInPixels(font, searchSpec);
+        const TInt err = S60->screenDevice()->GetNearestFontToDesignHeightInPixels(font, searchSpec);
         Q_ASSERT(err == KErrNone && font);
         QScopedPointer<CFont, CFontFromScreenDeviceReleaser> sFont(font);
         QSymbianTypeFaceExtras *extras = new QSymbianTypeFaceExtras(font);
@@ -260,17 +260,19 @@ QFontEngineFTS60::QFontEngineFTS60(const QFontDef &fd)
 */
 qreal QFontEngineS60::pixelsToPoints(qreal pixels, Qt::Orientation orientation)
 {
+    CWsScreenDevice* device = S60->screenDevice();
     return (orientation == Qt::Horizontal?
-        S60->screenDevice()->HorizontalPixelsToTwips(pixels)
-        :S60->screenDevice()->VerticalPixelsToTwips(pixels)) / KTwipsPerPoint;
+        device->HorizontalPixelsToTwips(pixels)
+        :device->VerticalPixelsToTwips(pixels)) / KTwipsPerPoint;
 }
 
 qreal QFontEngineS60::pointsToPixels(qreal points, Qt::Orientation orientation)
 {
+    CWsScreenDevice* device = S60->screenDevice();
     const int twips = points * KTwipsPerPoint;
     return orientation == Qt::Horizontal?
-        S60->screenDevice()->HorizontalTwipsToPixels(twips)
-        :S60->screenDevice()->VerticalTwipsToPixels(twips);
+        device->HorizontalTwipsToPixels(twips)
+        :device->VerticalTwipsToPixels(twips);
 }
 
 QFontEngineMultiS60::QFontEngineMultiS60(QFontEngine *first, int script, const QStringList &fallbackFamilies)
@@ -309,16 +311,16 @@ static void initializeDb()
 
     QSymbianFbsHeapLock lock(QSymbianFbsHeapLock::Unlock);
 
-    const int numTypeFaces = QS60Data::screenDevice()->NumTypefaces();
+    const int numTypeFaces = S60->screenDevice()->NumTypefaces();
     const QSymbianFontDatabaseExtrasImplementation *dbExtras =
             static_cast<const QSymbianFontDatabaseExtrasImplementation*>(db->symbianExtras);
     bool fontAdded = false;
     for (int i = 0; i < numTypeFaces; i++) {
         TTypefaceSupport typefaceSupport;
-        QS60Data::screenDevice()->TypefaceSupport(typefaceSupport, i);
+        S60->screenDevice()->TypefaceSupport(typefaceSupport, i);
         CFont *font; // We have to get a font instance in order to know all the details
         TFontSpec fontSpec(typefaceSupport.iTypeface.iName, 11);
-        if (QS60Data::screenDevice()->GetNearestFontInPixels(font, fontSpec) != KErrNone)
+        if (S60->screenDevice()->GetNearestFontInPixels(font, fontSpec) != KErrNone)
             continue;
         QScopedPointer<CFont, QSymbianFontDatabaseExtrasImplementation::CFontFromScreenDeviceReleaser> sFont(font);
         if (font->TypeUid() == KCFbsFontUid) {
diff --git a/src/gui/text/qfontengine_mac.mm b/src/gui/text/qfontengine_mac.mm
index 3be6d28..7ceed61 100644
--- a/src/gui/text/qfontengine_mac.mm
+++ b/src/gui/text/qfontengine_mac.mm
@@ -237,7 +237,8 @@ bool QCoreTextFontEngineMulti::stringToCMap(const QChar *str, int len, QGlyphLay
         *nglyphs = len;
         for (int i = 0; i < len; ++i) {
             outGlyphs[i] = 0;
-            logClusters[i] = i;
+            if (logClusters)
+                logClusters[i] = i;
             outAdvances_x[i] = QFixed();
             outAdvances_y[i] = QFixed();
             outAttributes[i].clusterStart = true;
diff --git a/src/gui/text/qfontengine_s60.cpp b/src/gui/text/qfontengine_s60.cpp
index 925b3bf..f691413 100644
--- a/src/gui/text/qfontengine_s60.cpp
+++ b/src/gui/text/qfontengine_s60.cpp
@@ -66,7 +66,7 @@ QSymbianTypeFaceExtras::QSymbianTypeFaceExtras(CFont* cFont, COpenFont *openFont
 
 QSymbianTypeFaceExtras::~QSymbianTypeFaceExtras()
 {
-    QS60Data::screenDevice()->ReleaseFont(m_cFont);
+    S60->screenDevice()->ReleaseFont(m_cFont);
 }
 
 QByteArray QSymbianTypeFaceExtras::getSfntTable(uint tag) const
diff --git a/src/network/socket/qlocalserver_p.h b/src/network/socket/qlocalserver_p.h
index feaaae0..4f92b64 100644
--- a/src/network/socket/qlocalserver_p.h
+++ b/src/network/socket/qlocalserver_p.h
@@ -99,6 +99,7 @@ public:
     struct Listener {
         HANDLE handle;
         OVERLAPPED overlapped;
+        bool connected;
     };
 
     void setError(const QString &function);
diff --git a/src/network/socket/qlocalserver_win.cpp b/src/network/socket/qlocalserver_win.cpp
index 07baf1e..61220e4 100644
--- a/src/network/socket/qlocalserver_win.cpp
+++ b/src/network/socket/qlocalserver_win.cpp
@@ -85,8 +85,10 @@ bool QLocalServerPrivate::addListener()
     if (!ConnectNamedPipe(listener.handle, &listener.overlapped)) {
         switch (GetLastError()) {
         case ERROR_IO_PENDING:
+            listener.connected = false;
             break;
         case ERROR_PIPE_CONNECTED:
+            listener.connected = true;
             SetEvent(eventHandle);
             break;
         default:
@@ -155,7 +157,9 @@ void QLocalServerPrivate::_q_onNewConnection()
     // a client connection first, so there is no way around polling all of them.
     for (int i = 0; i < listeners.size(); ) {
         HANDLE handle = listeners[i].handle;
-        if (GetOverlappedResult(handle, &listeners[i].overlapped, &dummy, FALSE)) {
+        if (listeners[i].connected
+            || GetOverlappedResult(handle, &listeners[i].overlapped, &dummy, FALSE))
+        {
             listeners.removeAt(i);
 
             addListener();
diff --git a/src/network/socket/qlocalsocket_p.h b/src/network/socket/qlocalsocket_p.h
index 0f1c23c..57ca3c2 100644
--- a/src/network/socket/qlocalsocket_p.h
+++ b/src/network/socket/qlocalsocket_p.h
@@ -135,7 +135,7 @@ public:
     void _q_canWrite();
     void _q_pipeClosed();
     void _q_emitReadyRead();
-    DWORD bytesAvailable();
+    DWORD checkPipeState();
     void startAsyncRead();
     bool completeAsyncRead();
     void checkReadyRead();
diff --git a/src/network/socket/qlocalsocket_win.cpp b/src/network/socket/qlocalsocket_win.cpp
index 5f46ecb..5486f47 100644
--- a/src/network/socket/qlocalsocket_win.cpp
+++ b/src/network/socket/qlocalsocket_win.cpp
@@ -192,6 +192,9 @@ qint64 QLocalSocket::readData(char *data, qint64 maxSize)
 {
     Q_D(QLocalSocket);
 
+    if (d->pipeClosed && d->actualReadBufferSize == 0)
+        return -1;  // signal EOF
+
     qint64 readSoFar;
     // If startAsyncRead() read data, copy it to its destination.
     if (maxSize == 1 && d->actualReadBufferSize > 0) {
@@ -213,10 +216,8 @@ qint64 QLocalSocket::readData(char *data, qint64 maxSize)
     }
 
     if (d->pipeClosed) {
-        if (readSoFar == 0) {
+        if (d->actualReadBufferSize == 0)
             QTimer::singleShot(0, this, SLOT(_q_pipeClosed()));
-            return -1;  // signal EOF
-        }
     } else {
         if (!d->readSequenceStarted)
             d->startAsyncRead();
@@ -250,7 +251,10 @@ void QLocalSocketPrivate::checkReadyRead()
 void QLocalSocketPrivate::startAsyncRead()
 {
     do {
-        DWORD bytesToRead = bytesAvailable();
+        DWORD bytesToRead = checkPipeState();
+        if (pipeClosed)
+            return;
+
         if (bytesToRead == 0) {
             // There are no bytes in the pipe but we need to
             // start the overlapped read with some buffer size.
@@ -333,9 +337,11 @@ void QLocalSocket::abort()
 }
 
 /*!
-    The number of bytes available from the pipe
-  */
-DWORD QLocalSocketPrivate::bytesAvailable()
+    \internal
+    Returns the number of available bytes in the pipe.
+    Sets QLocalSocketPrivate::pipeClosed to true if the connection is broken.
+ */
+DWORD QLocalSocketPrivate::checkPipeState()
 {
     Q_Q(QLocalSocket);
     DWORD bytes;
@@ -345,7 +351,8 @@ DWORD QLocalSocketPrivate::bytesAvailable()
         if (!pipeClosed) {
             pipeClosed = true;
             emit q->readChannelFinished();
-            QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
+            if (actualReadBufferSize == 0)
+                QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
         }
     }
     return 0;
@@ -478,6 +485,8 @@ void QLocalSocketPrivate::_q_notified()
     if (!completeAsyncRead()) {
         pipeClosed = true;
         emit q->readChannelFinished();
+        if (actualReadBufferSize == 0)
+            QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
         return;
     }
     startAsyncRead();
@@ -529,7 +538,7 @@ bool QLocalSocket::waitForDisconnected(int msecs)
     }
     QIncrementalSleepTimer timer(msecs);
     forever {
-        d->bytesAvailable();    // to check if PeekNamedPipe fails
+        d->checkPipeState();
         if (d->pipeClosed)
             close();
         if (state() == UnconnectedState)
@@ -561,11 +570,22 @@ bool QLocalSocket::waitForReadyRead(int msecs)
     if (d->state != QLocalSocket::ConnectedState)
         return false;
 
+    // We already know that the pipe is gone, but did not enter the event loop yet.
+    if (d->pipeClosed) {
+        close();
+        return false;
+    }
+
     Q_ASSERT(d->readSequenceStarted);
     DWORD result = WaitForSingleObject(d->overlapped.hEvent, msecs == -1 ? INFINITE : msecs);
     switch (result) {
         case WAIT_OBJECT_0:
             d->_q_notified();
+            // We just noticed that the pipe is gone.
+            if (d->pipeClosed) {
+                close();
+                return false;
+            }
             return true;
         case WAIT_TIMEOUT:
             return false;
diff --git a/src/opengl/qgl_wince.cpp b/src/opengl/qgl_wince.cpp
index 47a19b5..054a8d1 100644
--- a/src/opengl/qgl_wince.cpp
+++ b/src/opengl/qgl_wince.cpp
@@ -57,7 +57,6 @@
 #include <private/qeglproperties_p.h>
 #include <private/qeglcontext_p.h>
 #include <private/qgl_egl_p.h>
-#include <private/qgl_cl_p.h>
 
 
 QT_BEGIN_NAMESPACE
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index 5e2157e..129a11b 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -132,8 +132,8 @@ private:
 
     int code_size, clear_code, end_code, max_code_size, max_code;
     int firstcode, oldcode, incode;
-    short table[2][1<< max_lzw_bits];
-    short stack[(1<<(max_lzw_bits))*2];
+    short* table[2];
+    short* stack;
     short *sp;
     bool needfirst;
     int x, y;
@@ -162,6 +162,9 @@ QGIFFormat::QGIFFormat()
     lcmap = false;
     newFrame = false;
     partialNewFrame = false;
+    table[0] = 0;
+    table[1] = 0;
+    stack = 0;
 }
 
 /*!
@@ -171,6 +174,7 @@ QGIFFormat::~QGIFFormat()
 {
     if (globalcmap) delete[] globalcmap;
     if (localcmap) delete[] localcmap;
+    delete [] stack;
 }
 
 void QGIFFormat::disposePrevious(QImage *image)
@@ -237,6 +241,12 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
     //    CompuServe Incorporated. GIF(sm) is a Service Mark property of
     //    CompuServe Incorporated."
 
+    if (!stack) {
+        stack = new short[(1 << max_lzw_bits) * 4];
+        table[0] = &stack[(1 << max_lzw_bits) * 2];
+        table[1] = &stack[(1 << max_lzw_bits) * 3];
+    }
+
     image->detach();
     int bpl = image->bytesPerLine();
     unsigned char *bits = image->bits();
@@ -1026,7 +1036,7 @@ inline QRgb QGIFFormat::color(uchar index) const
 QGifHandler::QGifHandler()
 {
     gifFormat = new QGIFFormat;
-    nextDelay = 0;
+    nextDelay = 100;
     loopCnt = 1;
     frameNumber = -1;
     scanIsCached = false;
@@ -1061,7 +1071,7 @@ bool QGifHandler::imageIsComing() const
 
 bool QGifHandler::canRead() const
 {
-    if (!nextDelay && canRead(device()) || imageIsComing()) {
+    if (canRead(device()) || imageIsComing()) {
         setFormat("gif");
         return true;
     }
diff --git a/src/plugins/imageformats/mng/qmnghandler.cpp b/src/plugins/imageformats/mng/qmnghandler.cpp
index c134fd6..ec442a1 100644
--- a/src/plugins/imageformats/mng/qmnghandler.cpp
+++ b/src/plugins/imageformats/mng/qmnghandler.cpp
@@ -271,7 +271,6 @@ bool QMngHandlerPrivate::getNextImage(QImage *result)
     }
     if ((MNG_NOERROR == ret) || (MNG_NEEDTIMERWAIT == ret)) {
         *result = image;
-        image.fill(0);
         frameIndex = nextIndex++;
         if (haveReadAll && (frameCount == 0))
             frameCount = nextIndex;
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp
index f02ea52..e2999c1 100644
--- a/src/script/api/qscriptengine.cpp
+++ b/src/script/api/qscriptengine.cpp
@@ -1011,12 +1011,17 @@ JSC::JSValue QScriptEnginePrivate::arrayFromVariantList(JSC::ExecState *exec, co
     return arr;
 }
 
-QVariantList QScriptEnginePrivate::variantListFromArray(JSC::ExecState *exec, JSC::JSValue arr)
+QVariantList QScriptEnginePrivate::variantListFromArray(JSC::ExecState *exec, JSC::JSArray *arr)
 {
+    QScriptEnginePrivate *eng = QScript::scriptEngineFromExec(exec);
+    if (eng->visitedConversionObjects.contains(arr))
+        return QVariantList(); // Avoid recursion.
+    eng->visitedConversionObjects.insert(arr);
     QVariantList lst;
     uint len = toUInt32(exec, property(exec, arr, exec->propertyNames().length));
     for (uint i = 0; i < len; ++i)
         lst.append(toVariant(exec, property(exec, arr, i)));
+    eng->visitedConversionObjects.remove(arr);
     return lst;
 }
 
@@ -1029,14 +1034,19 @@ JSC::JSValue QScriptEnginePrivate::objectFromVariantMap(JSC::ExecState *exec, co
     return obj;
 }
 
-QVariantMap QScriptEnginePrivate::variantMapFromObject(JSC::ExecState *exec, JSC::JSValue obj)
+QVariantMap QScriptEnginePrivate::variantMapFromObject(JSC::ExecState *exec, JSC::JSObject *obj)
 {
+    QScriptEnginePrivate *eng = QScript::scriptEngineFromExec(exec);
+    if (eng->visitedConversionObjects.contains(obj))
+        return QVariantMap(); // Avoid recursion.
+    eng->visitedConversionObjects.insert(obj);
     JSC::PropertyNameArray propertyNames(exec);
-    JSC::asObject(obj)->getOwnPropertyNames(exec, propertyNames, JSC::IncludeDontEnumProperties);
+    obj->getOwnPropertyNames(exec, propertyNames, JSC::IncludeDontEnumProperties);
     QVariantMap vmap;
     JSC::PropertyNameArray::const_iterator it = propertyNames.begin();
     for( ; it != propertyNames.end(); ++it)
         vmap.insert(it->ustring(), toVariant(exec, property(exec, obj, *it)));
+    eng->visitedConversionObjects.remove(obj);
     return vmap;
 }
 
@@ -1661,16 +1671,10 @@ QVariant QScriptEnginePrivate::toVariant(JSC::ExecState *exec, JSC::JSValue valu
             return QVariant(toRegExp(exec, value));
 #endif
         else if (isArray(value))
-            return variantListFromArray(exec, value);
+            return variantListFromArray(exec, JSC::asArray(value));
         else if (QScriptDeclarativeClass *dc = declarativeClass(value))
             return dc->toVariant(declarativeObject(value));
-        // try to convert to primitive
-        JSC::JSValue savedException;
-        saveException(exec, &savedException);
-        JSC::JSValue prim = value.toPrimitive(exec);
-        restoreException(exec, savedException);
-        if (!prim.isObject())
-            return toVariant(exec, prim);
+        return variantMapFromObject(exec, JSC::asObject(value));
     } else if (value.isNumber()) {
         return QVariant(toNumber(exec, value));
     } else if (value.isString()) {
@@ -3129,12 +3133,12 @@ bool QScriptEnginePrivate::convertValue(JSC::ExecState *exec, JSC::JSValue value
         } break;
     case QMetaType::QVariantList:
         if (isArray(value)) {
-            *reinterpret_cast<QVariantList *>(ptr) = variantListFromArray(exec, value);
+            *reinterpret_cast<QVariantList *>(ptr) = variantListFromArray(exec, JSC::asArray(value));
             return true;
         } break;
     case QMetaType::QVariantMap:
         if (isObject(value)) {
-            *reinterpret_cast<QVariantMap *>(ptr) = variantMapFromObject(exec, value);
+            *reinterpret_cast<QVariantMap *>(ptr) = variantMapFromObject(exec, JSC::asObject(value));
             return true;
         } break;
     case QMetaType::QVariant:
diff --git a/src/script/api/qscriptengine_p.h b/src/script/api/qscriptengine_p.h
index fd47208..56366e2 100644
--- a/src/script/api/qscriptengine_p.h
+++ b/src/script/api/qscriptengine_p.h
@@ -215,10 +215,10 @@ public:
     static QStringList stringListFromArray(JSC::ExecState*, JSC::JSValue arr);
 
     static JSC::JSValue arrayFromVariantList(JSC::ExecState*, const QVariantList &lst);
-    static QVariantList variantListFromArray(JSC::ExecState*, JSC::JSValue arr);
+    static QVariantList variantListFromArray(JSC::ExecState*, JSC::JSArray *arr);
 
     static JSC::JSValue objectFromVariantMap(JSC::ExecState*, const QVariantMap &vmap);
-    static QVariantMap variantMapFromObject(JSC::ExecState*, JSC::JSValue obj);
+    static QVariantMap variantMapFromObject(JSC::ExecState*, JSC::JSObject *obj);
 
     JSC::JSValue defaultPrototype(int metaTypeId) const;
     void setDefaultPrototype(int metaTypeId, JSC::JSValue prototype);
@@ -378,6 +378,8 @@ public:
     QHash<intptr_t, QScript::UStringSourceProviderWithFeedback*> loadedScripts;
     QScriptValue m_currentException;
 
+    QSet<JSC::JSObject*> visitedConversionObjects;
+
 #ifndef QT_NO_QOBJECT
     QHash<QObject*, QScript::QObjectData*> m_qobjectData;
 #endif
diff --git a/src/script/api/qscriptvalue.cpp b/src/script/api/qscriptvalue.cpp
index 1310c8c..451d1b0 100644
--- a/src/script/api/qscriptvalue.cpp
+++ b/src/script/api/qscriptvalue.cpp
@@ -1215,8 +1215,8 @@ qsreal QScriptValue::toInteger() const
     \row    \o QObject Object \o A QVariant containing a pointer to the QObject.
     \row    \o Date Object \o A QVariant containing the date value (toDateTime()).
     \row    \o RegExp Object \o A QVariant containing the regular expression value (toRegExp()).
-    \row    \o Array Object \o The array is converted to a QVariantList.
-    \row    \o Object     \o If the value is primitive, then the result is converted to a QVariant according to the above rules; otherwise, an invalid QVariant is returned.
+    \row    \o Array Object \o The array is converted to a QVariantList. Each element is converted to a QVariant, recursively; cyclic references are not followed.
+    \row    \o Object     \o The object is converted to a QVariantMap. Each property is converted to a QVariant, recursively; cyclic references are not followed.
     \endtable
 
   \sa isVariant()
diff --git a/src/tools/moc/main.cpp b/src/tools/moc/main.cpp
index ebe1834..4997690 100644
--- a/src/tools/moc/main.cpp
+++ b/src/tools/moc/main.cpp
@@ -359,11 +359,10 @@ int runMoc(int _argc, char **_argv)
 
 
     if (autoInclude) {
+        int spos = filename.lastIndexOf(QDir::separator().toLatin1());
         int ppos = filename.lastIndexOf('.');
-        moc.noInclude = (ppos >= 0
-                         && tolower(filename[ppos + 1]) != 'h'
-                         && tolower(filename[ppos + 1]) != QDir::separator().toLatin1()
-                        );
+        // spos >= -1 && ppos > spos => ppos >= 0
+        moc.noInclude = (ppos > spos && tolower(filename[ppos + 1]) != 'h');
     }
     if (moc.includeFiles.isEmpty()) {
         if (moc.includePath.isEmpty()) {
diff --git a/tests/auto/declarative/qdeclarativerepeater/data/repeater2.qml b/tests/auto/declarative/qdeclarativerepeater/data/repeater2.qml
index c8b863c..7f2f85a 100644
--- a/tests/auto/declarative/qdeclarativerepeater/data/repeater2.qml
+++ b/tests/auto/declarative/qdeclarativerepeater/data/repeater2.qml
@@ -9,12 +9,13 @@ Rectangle {
         Item {
             objectName: "myDelegate"
             height: 20
+            width: 240
             Text {
-                y: index*20
+                objectName: "myName"
                 text: name
             }
             Text {
-                y: index*20
+                objectName: "myNumber"
                 x: 100
                 text: number
             }
diff --git a/tests/auto/declarative/qdeclarativerepeater/tst_qdeclarativerepeater.cpp b/tests/auto/declarative/qdeclarativerepeater/tst_qdeclarativerepeater.cpp
index 3cc68f4..7299a43 100644
--- a/tests/auto/declarative/qdeclarativerepeater/tst_qdeclarativerepeater.cpp
+++ b/tests/auto/declarative/qdeclarativerepeater/tst_qdeclarativerepeater.cpp
@@ -45,6 +45,7 @@
 #include <QtDeclarative/qdeclarativeengine.h>
 #include <QtDeclarative/qdeclarativeview.h>
 #include <QtDeclarative/qdeclarativecontext.h>
+#include <QtDeclarative/qdeclarativeexpression.h>
 #include <private/qdeclarativerepeater_p.h>
 #include <private/qdeclarativetext_p.h>
 
@@ -75,6 +76,8 @@ private slots:
 private:
     QDeclarativeView *createView();
     template<typename T>
+    T *findItem(QGraphicsObject *parent, const QString &objectName, int index);
+    template<typename T>
     T *findItem(QGraphicsObject *parent, const QString &id);
 };
 
@@ -312,6 +315,20 @@ void tst_QDeclarativeRepeater::dataModel()
     testModel.removeItem(2);
     QCOMPARE(container->childItems().count(), 4);
 
+    // Check that model changes are propagated
+    QDeclarativeText *text = findItem<QDeclarativeText>(canvas->rootObject(), "myName", 1);
+    QVERIFY(text);
+    QCOMPARE(text->text(), QString("two"));
+
+    testModel.modifyItem(1, "Item two", "_2");
+    text = findItem<QDeclarativeText>(canvas->rootObject(), "myName", 1);
+    QVERIFY(text);
+    QCOMPARE(text->text(), QString("Item two"));
+
+    text = findItem<QDeclarativeText>(canvas->rootObject(), "myNumber", 1);
+    QVERIFY(text);
+    QCOMPARE(text->text(), QString("_2"));
+
     delete testObject;
     delete canvas;
 }
@@ -387,6 +404,33 @@ QDeclarativeView *tst_QDeclarativeRepeater::createView()
 }
 
 template<typename T>
+T *tst_QDeclarativeRepeater::findItem(QGraphicsObject *parent, const QString &objectName, int index)
+{
+    const QMetaObject &mo = T::staticMetaObject;
+    //qDebug() << parent->childItems().count() << "children";
+    for (int i = 0; i < parent->childItems().count(); ++i) {
+        QDeclarativeItem *item = qobject_cast<QDeclarativeItem*>(parent->childItems().at(i));
+        if(!item)
+            continue;
+        //qDebug() << "try" << item;
+        if (mo.cast(item) && (objectName.isEmpty() || item->objectName() == objectName)) {
+            if (index != -1) {
+                QDeclarativeExpression e(qmlContext(item), item, "index");
+                if (e.evaluate().toInt() == index)
+                    return static_cast<T*>(item);
+            } else {
+                return static_cast<T*>(item);
+            }
+        }
+        item = findItem<T>(item, objectName, index);
+        if (item)
+            return static_cast<T*>(item);
+    }
+
+    return 0;
+}
+
+template<typename T>
 T *tst_QDeclarativeRepeater::findItem(QGraphicsObject *parent, const QString &objectName)
 {
     const QMetaObject &mo = T::staticMetaObject;
diff --git a/tests/auto/declarative/qdeclarativetextinput/tst_qdeclarativetextinput.cpp b/tests/auto/declarative/qdeclarativetextinput/tst_qdeclarativetextinput.cpp
index 3143580..a55b42e 100644
--- a/tests/auto/declarative/qdeclarativetextinput/tst_qdeclarativetextinput.cpp
+++ b/tests/auto/declarative/qdeclarativetextinput/tst_qdeclarativetextinput.cpp
@@ -396,7 +396,6 @@ void tst_qdeclarativetextinput::positionAt()
 #endif
 
     // Check without autoscroll...
-    QEXPECT_FAIL("", "QTBUG-11127", Abort);
     textinputObject->setAutoScroll(false);
     pos = textinputObject->positionAt(textinputObject->width()/2);
     diff = abs(fm.width(textinputObject->text().left(pos))-textinputObject->width()/2);
diff --git a/tests/auto/declarative/qdeclarativeworkerscript/data/BaseWorker.qml b/tests/auto/declarative/qdeclarativeworkerscript/data/BaseWorker.qml
index d275ca8..e06afa2 100644
--- a/tests/auto/declarative/qdeclarativeworkerscript/data/BaseWorker.qml
+++ b/tests/auto/declarative/qdeclarativeworkerscript/data/BaseWorker.qml
@@ -13,7 +13,7 @@ WorkerScript {
 
     function compareLiteralResponse(expected) {
         var e = eval('(' + expected + ')')
-        return worker.response == e
+        return JSON.stringify(worker.response) == JSON.stringify(e)
     }
 
     onMessage: {
diff --git a/tests/auto/declarative/qdeclarativeworkerscript/tst_qdeclarativeworkerscript.cpp b/tests/auto/declarative/qdeclarativeworkerscript/tst_qdeclarativeworkerscript.cpp
index 52c11e9..8e98874 100644
--- a/tests/auto/declarative/qdeclarativeworkerscript/tst_qdeclarativeworkerscript.cpp
+++ b/tests/auto/declarative/qdeclarativeworkerscript/tst_qdeclarativeworkerscript.cpp
@@ -170,13 +170,15 @@ void tst_QDeclarativeWorkerScript::messaging_sendJsObject()
     QDeclarativeWorkerScript *worker = qobject_cast<QDeclarativeWorkerScript*>(component.create());
     QVERIFY(worker != 0);
 
-    QString jsObject = "{'name': 'zyz', 'spell power': 3101, 'haste': 1125}";
+    // Properties are in alphabetical order to enable string-based comparison after
+    // QVariant roundtrip, since the properties will be stored in a QVariantMap.
+    QString jsObject = "{'haste': 1125, 'name': 'zyz', 'spell power': 3101}";
 
     QScriptEngine *engine = QDeclarativeEnginePrivate::getScriptEngine(qmlEngine(worker));
     QScriptValue sv = engine->newObject();
+    sv.setProperty("haste", 1125);
     sv.setProperty("name", "zyz");
     sv.setProperty("spell power", 3101);
-    sv.setProperty("haste", 1125);
 
     QVERIFY(QMetaObject::invokeMethod(worker, "testSend", Q_ARG(QVariant, qVariantFromValue(sv))));
     waitForEchoMessage(worker);
diff --git a/tests/auto/declarative/qmlvisual/qdeclarativetextinput/LineEdit.qml b/tests/auto/declarative/qmlvisual/qdeclarativetextinput/LineEdit.qml
index 69f57c6..e863262 100644
--- a/tests/auto/declarative/qmlvisual/qdeclarativetextinput/LineEdit.qml
+++ b/tests/auto/declarative/qmlvisual/qdeclarativetextinput/LineEdit.qml
@@ -30,13 +30,14 @@ Item {
         y: 5
         //Below function implements all scrolling logic
         onCursorPositionChanged: {
-            if(cursorRect.x < leftMargin - textInp.x){//Cursor went off the front
-                textInp.x = leftMargin - Math.max(0, cursorRect.x);
-            }else if(cursorRect.x > parent.width - leftMargin - rightMargin - textInp.x){//Cusor went off the end
-                textInp.x = leftMargin - Math.max(0, cursorRect.x - (parent.width - leftMargin - rightMargin));
+            if(cursorRectangle.x < leftMargin - textInp.x){//Cursor went off the front
+                textInp.x = leftMargin - Math.max(0, cursorRectangle.x);
+            }else if(cursorRectangle.x > parent.width - leftMargin - rightMargin - textInp.x){//Cusor went off the end
+                textInp.x = leftMargin - Math.max(0, cursorRectangle.x - (parent.width - leftMargin - rightMargin));
             }
         }
 
+        autoScroll: false //It is preferable to implement your own scrolling
         text:""
         horizontalAlignment: TextInput.AlignLeft
         font.pixelSize:15
diff --git a/tests/auto/mediaobject/dummy/dummy.pro b/tests/auto/mediaobject/dummy/dummy.pro
index cf1010e..88b864b 100644
--- a/tests/auto/mediaobject/dummy/dummy.pro
+++ b/tests/auto/mediaobject/dummy/dummy.pro
@@ -1,7 +1,7 @@
 TEMPLATE = lib
 
 isEmpty(QT_MAJOR_VERSION) {
-   VERSION=4.6.3
+   VERSION=4.6.4
 } else {
    VERSION=$${QT_MAJOR_VERSION}.$${QT_MINOR_VERSION}.$${QT_PATCH_VERSION}
 }
diff --git a/tests/auto/qgraphicsgridlayout/tst_qgraphicsgridlayout.cpp b/tests/auto/qgraphicsgridlayout/tst_qgraphicsgridlayout.cpp
index 8127f84..b9a5c66 100644
--- a/tests/auto/qgraphicsgridlayout/tst_qgraphicsgridlayout.cpp
+++ b/tests/auto/qgraphicsgridlayout/tst_qgraphicsgridlayout.cpp
@@ -741,31 +741,73 @@ void tst_QGraphicsGridLayout::setColumnFixedWidth()
 // public qreal columnSpacing(int column) const
 void tst_QGraphicsGridLayout::columnSpacing()
 {
-    QGraphicsScene scene;
-    QGraphicsView view(&scene);
-    QGraphicsWidget *widget = new QGraphicsWidget(0, Qt::Window);
-    QGraphicsGridLayout *layout = new QGraphicsGridLayout();
-    scene.addItem(widget);
-    widget->setLayout(layout);
-    populateLayout(layout, 3, 2);
-    layout->setContentsMargins(0, 0, 0, 0);
-    layout->setSpacing(0);
-    QCOMPARE(layout->columnSpacing(0), 0.0);
+    {
+        QGraphicsScene scene;
+        QGraphicsView view(&scene);
+        QGraphicsWidget *widget = new QGraphicsWidget(0, Qt::Window);
+        QGraphicsGridLayout *layout = new QGraphicsGridLayout();
+        scene.addItem(widget);
+        widget->setLayout(layout);
+        populateLayout(layout, 3, 2);
+        layout->setContentsMargins(0, 0, 0, 0);
+        layout->setSpacing(0);
+        QCOMPARE(layout->columnSpacing(0), 0.0);
+
+        layout->setColumnSpacing(0, 20);
+        view.show();
+        widget->show();
+        widget->resize(widget->effectiveSizeHint(Qt::PreferredSize));
+        QApplication::processEvents();
 
-    layout->setColumnSpacing(0, 20);
-    view.show();
-    widget->show();
-    widget->resize(widget->effectiveSizeHint(Qt::PreferredSize));
-    QApplication::processEvents();
+        QCOMPARE(layout->itemAt(0,0)->geometry().left(),   0.0);
+        QCOMPARE(layout->itemAt(0,0)->geometry().right(), 25.0);
+        QCOMPARE(layout->itemAt(0,1)->geometry().left(),  45.0);
+        QCOMPARE(layout->itemAt(0,1)->geometry().right(), 70.0);
+        QCOMPARE(layout->itemAt(0,2)->geometry().left(),  70.0);
+        QCOMPARE(layout->itemAt(0,2)->geometry().right(), 95.0);
 
-    QCOMPARE(layout->itemAt(0,0)->geometry().left(),   0.0);
-    QCOMPARE(layout->itemAt(0,0)->geometry().right(), 25.0);
-    QCOMPARE(layout->itemAt(0,1)->geometry().left(),  45.0);
-    QCOMPARE(layout->itemAt(0,1)->geometry().right(), 70.0);
-    QCOMPARE(layout->itemAt(0,2)->geometry().left(),  70.0);
-    QCOMPARE(layout->itemAt(0,2)->geometry().right(), 95.0);
+        delete widget;
+    }
+
+    {
+        // don't include items and spacings that was previously part of the layout
+        // (horizontal)
+        QGraphicsGridLayout *layout = new QGraphicsGridLayout;
+        populateLayout(layout, 3, 1);
+        layout->setContentsMargins(0, 0, 0, 0);
+        layout->setSpacing(0);
+        layout->setColumnSpacing(0, 10);
+        layout->setColumnSpacing(1, 10);
+        layout->setColumnSpacing(2, 10);
+        layout->setColumnSpacing(3, 10);
+        QCOMPARE(layout->preferredSize(), QSizeF(95, 25));
+        layout->removeAt(2);
+        QCOMPARE(layout->preferredSize(), QSizeF(60, 25));
+        layout->removeAt(1);
+        QCOMPARE(layout->preferredSize(), QSizeF(25, 25));
+        delete layout;
+    }
+    {
+        // don't include items and spacings that was previously part of the layout
+        // (vertical)
+        QGraphicsGridLayout *layout = new QGraphicsGridLayout;
+        populateLayout(layout, 2, 2);
+        layout->setContentsMargins(0, 0, 0, 0);
+        layout->setSpacing(0);
+        layout->setColumnSpacing(0, 10);
+        layout->setColumnSpacing(1, 10);
+        layout->setRowSpacing(0, 10);
+        layout->setRowSpacing(1, 10);
+        QCOMPARE(layout->preferredSize(), QSizeF(60, 60));
+        layout->removeAt(3);
+        QCOMPARE(layout->preferredSize(), QSizeF(60, 60));
+        layout->removeAt(2);
+        QCOMPARE(layout->preferredSize(), QSizeF(60, 25));
+        layout->removeAt(1);
+        QCOMPARE(layout->preferredSize(), QSizeF(25, 25));
+        delete layout;
+    }
 
-    delete widget;
 }
 
 // public int columnStretchFactor(int column) const
diff --git a/tests/auto/qimagereader/tst_qimagereader.cpp b/tests/auto/qimagereader/tst_qimagereader.cpp
index 7e57973..fe2a719 100644
--- a/tests/auto/qimagereader/tst_qimagereader.cpp
+++ b/tests/auto/qimagereader/tst_qimagereader.cpp
@@ -1912,14 +1912,14 @@ void tst_QImageReader::testIgnoresFormatAndExtension()
     QFETCH(QString, expected);
 
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
-    QString fileNameBase = "images/" + name + ".";
+    QString fileNameBase = prefix + name + ".";
 
     foreach (const QByteArray &f, formats) {
         if (f == extension)
             continue;
         QFile tmp(QDir::tempPath() + "/" + name + "_" + expected + "." + f);
 
-        QFile::copy(fileNameBase + extension, QFileInfo(tmp).absoluteFilePath());
+        QVERIFY(QFile::copy(fileNameBase + extension, QFileInfo(tmp).absoluteFilePath()));
 
         QString format;
         QImage image;
diff --git a/tests/auto/qlocalsocket/example/client/client.pro b/tests/auto/qlocalsocket/example/client/client.pro
index eb7e6e6..84f20d6 100644
--- a/tests/auto/qlocalsocket/example/client/client.pro
+++ b/tests/auto/qlocalsocket/example/client/client.pro
@@ -1,14 +1,8 @@
-######################################################################
-# Automatically generated by qmake (2.01a) Wed Jun 6 17:07:12 2007
-######################################################################
-
 TEMPLATE = app
 TARGET = 
 DEPENDPATH += .
 INCLUDEPATH += .
 CONFIG += console
-include(../../src/src.pri)
-# Input
 QT = core network
 
 SOURCES += main.cpp
diff --git a/tests/auto/qlocalsocket/example/server/server.pro b/tests/auto/qlocalsocket/example/server/server.pro
index 438462d..bfd14d2 100644
--- a/tests/auto/qlocalsocket/example/server/server.pro
+++ b/tests/auto/qlocalsocket/example/server/server.pro
@@ -1,7 +1,3 @@
-######################################################################
-# Automatically generated by qmake (2.01a) Wed Jun 6 15:16:48 2007
-######################################################################
-
 TEMPLATE = app
 TARGET = 
 DEPENDPATH += .
@@ -11,8 +7,6 @@ CONFIG += console
 
 QT = core network
 
-include(../../src/src.pri)
-
 # Input
 SOURCES += main.cpp
 
diff --git a/tests/auto/qlocalsocket/tst_qlocalsocket.cpp b/tests/auto/qlocalsocket/tst_qlocalsocket.cpp
index 44f3c12..9c09917 100644
--- a/tests/auto/qlocalsocket/tst_qlocalsocket.cpp
+++ b/tests/auto/qlocalsocket/tst_qlocalsocket.cpp
@@ -115,7 +115,8 @@ private slots:
     void writeToClientAndDisconnect();
     void debug();
     void bytesWrittenSignal();
-
+    void syncDisconnectNotify();
+    void asyncDisconnectNotify();
 
 #ifdef Q_OS_SYMBIAN
 private:
@@ -683,25 +684,11 @@ public:
         QString testLine = "test";
         LocalSocket socket;
         QSignalSpy spyReadyRead(&socket, SIGNAL(readyRead()));
-        int tries = 0;
-        do {
-            socket.connectToServer("qlocalsocket_threadtest");
-            if (socket.error() != QLocalSocket::ServerNotFoundError
-                && socket.error() != QLocalSocket::ConnectionRefusedError)
-                break;
-            QTest::qWait(100);
-            ++tries;
-        } while ((socket.error() == QLocalSocket::ServerNotFoundError
-                  || socket.error() == QLocalSocket::ConnectionRefusedError)
-             && tries < 1000);
-        if (tries == 0 && socket.state() != QLocalSocket::ConnectedState) {
-            QVERIFY(socket.waitForConnected(7000));
-            QVERIFY(socket.state() == QLocalSocket::ConnectedState);
-        }
+        socket.connectToServer("qlocalsocket_threadtest");
+        QVERIFY(socket.waitForConnected(1000));
 
         // We should *not* have this signal yet!
-        if (tries == 0)
-            QCOMPARE(spyReadyRead.count(), 0);
+        QCOMPARE(spyReadyRead.count(), 0);
         socket.waitForReadyRead();
         QCOMPARE(spyReadyRead.count(), 1);
         QTextStream in(&socket);
@@ -715,6 +702,8 @@ class Server : public QThread
 
 public:
     int clients;
+    QMutex mutex;
+    QWaitCondition wc;
     void run()
     {
         QString testLine = "test";
@@ -722,6 +711,9 @@ public:
         server.setMaxPendingConnections(10);
         QVERIFY2(server.listen("qlocalsocket_threadtest"),
                  server.errorString().toLatin1().constData());
+        mutex.lock();
+        wc.wakeAll();
+        mutex.unlock();
         int done = clients;
         while (done > 0) {
             bool timedOut = true;
@@ -746,14 +738,9 @@ void tst_QLocalSocket::threadedConnection_data()
     QTest::addColumn<int>("threads");
     QTest::newRow("1 client") << 1;
     QTest::newRow("2 clients") << 2;
-#ifdef Q_OS_WINCE
-    QTest::newRow("4 clients") << 4;
-#endif
-#ifndef Q_OS_WIN
     QTest::newRow("5 clients") << 5;
-    QTest::newRow("10 clients") << 10;
-#endif
 #ifndef Q_OS_WINCE
+    QTest::newRow("10 clients") << 10;
     QTest::newRow("20 clients") << 20;
 #endif
 }
@@ -770,7 +757,9 @@ void tst_QLocalSocket::threadedConnection()
     server.setStackSize(0x14000);
 #endif
     server.clients = threads;
+    server.mutex.lock();
     server.start();
+    server.wc.wait(&server.mutex);
 
     QList<Client*> clients;
     for (int i = 0; i < threads; ++i) {
@@ -784,9 +773,7 @@ void tst_QLocalSocket::threadedConnection()
     server.wait();
     while (!clients.isEmpty()) {
         QVERIFY(clients.first()->wait(3000));
-        Client *client =clients.takeFirst();
-        client->terminate();
-        delete client;
+        delete clients.takeFirst();
     }
 }
 
@@ -994,6 +981,7 @@ void tst_QLocalSocket::writeToClientAndDisconnect()
 
     QLocalServer server;
     QLocalSocket client;
+    QSignalSpy readChannelFinishedSpy(&client, SIGNAL(readChannelFinished()));
 
     QVERIFY(server.listen("writeAndDisconnectServer"));
     client.connectToServer("writeAndDisconnectServer");
@@ -1006,10 +994,12 @@ void tst_QLocalSocket::writeToClientAndDisconnect()
     memset(buffer, 0, sizeof(buffer));
     QCOMPARE(clientSocket->write(buffer, sizeof(buffer)), (qint64)sizeof(buffer));
     clientSocket->waitForBytesWritten();
-    clientSocket->disconnectFromServer();
-    QVERIFY(client.waitForReadyRead());
+    clientSocket->close();
+    server.close();
+
+    QTRY_COMPARE(readChannelFinishedSpy.count(), 1);
     QCOMPARE(client.read(buffer, sizeof(buffer)), (qint64)sizeof(buffer));
-    QVERIFY(client.waitForDisconnected());
+    client.waitForDisconnected();
     QCOMPARE(client.state(), QLocalSocket::UnconnectedState);
 }
 
@@ -1065,6 +1055,41 @@ void tst_QLocalSocket::bytesWrittenSignal()
     QVERIFY(writeThread.wait(2000));
 }
 
+void tst_QLocalSocket::syncDisconnectNotify()
+{
+#ifdef Q_OS_SYMBIAN
+    unlink("syncDisconnectNotify");
+#endif
+
+    QLocalServer server;
+    QVERIFY(server.listen("syncDisconnectNotify"));
+    QLocalSocket client;
+    client.connectToServer("syncDisconnectNotify");
+    QVERIFY(server.waitForNewConnection());
+    QLocalSocket* serverSocket = server.nextPendingConnection();
+    QVERIFY(serverSocket);
+    delete serverSocket;
+    QCOMPARE(client.waitForReadyRead(), false);
+}
+
+void tst_QLocalSocket::asyncDisconnectNotify()
+{
+#ifdef Q_OS_SYMBIAN
+    unlink("asyncDisconnectNotify");
+#endif
+
+    QLocalServer server;
+    QVERIFY(server.listen("asyncDisconnectNotify"));
+    QLocalSocket client;
+    QSignalSpy disconnectedSpy(&client, SIGNAL(disconnected()));
+    client.connectToServer("asyncDisconnectNotify");
+    QVERIFY(server.waitForNewConnection());
+    QLocalSocket* serverSocket = server.nextPendingConnection();
+    QVERIFY(serverSocket);
+    delete serverSocket;
+    QTRY_VERIFY(!disconnectedSpy.isEmpty());
+}
+
 #ifdef Q_OS_SYMBIAN
 void tst_QLocalSocket::unlink(QString name)
 {
diff --git a/tests/auto/qnetworkdiskcache/tst_qnetworkdiskcache.cpp b/tests/auto/qnetworkdiskcache/tst_qnetworkdiskcache.cpp
index 5bbe8f6..245a5c6 100644
--- a/tests/auto/qnetworkdiskcache/tst_qnetworkdiskcache.cpp
+++ b/tests/auto/qnetworkdiskcache/tst_qnetworkdiskcache.cpp
@@ -642,7 +642,7 @@ void tst_QNetworkDiskCache::crashWhenParentingCache()
     QNetworkAccessManager *manager = new QNetworkAccessManager();
     QNetworkDiskCache *diskCache = new QNetworkDiskCache(manager); // parent to qnam!
     // we expect the temp dir to be cleaned at some point anyway
-    diskCache->setCacheDirectory(QDir::tempPath() + "/cacheDir_" + QCoreApplication::applicationPid());
+    diskCache->setCacheDirectory(QString("%1/cacheDir_%2").arg(QDir::tempPath()).arg(QCoreApplication::applicationPid()));
     manager->setCache(diskCache);
 
     QUrl url("http://127.0.0.1:" + QString::number(server.serverPort()));
diff --git a/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp b/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
index 09070e6..11813d8 100644
--- a/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
+++ b/tests/auto/qscriptextqobject/tst_qscriptextqobject.cpp
@@ -287,6 +287,8 @@ public:
         { m_qtFunctionInvoked = 15; m_actuals << v; return v; }
     Q_INVOKABLE QVariantMap myInvokableWithVariantMapArg(const QVariantMap &vm)
         { m_qtFunctionInvoked = 16; m_actuals << vm; return vm; }
+    Q_INVOKABLE QVariantList myInvokableWithVariantListArg(const QVariantList &lst)
+        { m_qtFunctionInvoked = 62; m_actuals.append(QVariant(lst)); return lst; }
     Q_INVOKABLE QList<int> myInvokableWithListOfIntArg(const QList<int> &lst)
         { m_qtFunctionInvoked = 17; m_actuals << qVariantFromValue(lst); return lst; }
     Q_INVOKABLE QObject* myInvokableWithQObjectStarArg(QObject *obj)
@@ -535,6 +537,10 @@ private slots:
     void emitAfterReceiverDeleted();
     void inheritedSlots();
     void enumerateMetaObject();
+    void nestedArrayAsSlotArgument_data();
+    void nestedArrayAsSlotArgument();
+    void nestedObjectAsSlotArgument_data();
+    void nestedObjectAsSlotArgument();
 
 private:
     QScriptEngine *m_engine;
@@ -3164,5 +3170,139 @@ void tst_QScriptExtQObject::enumerateMetaObject()
     }
 }
 
+void tst_QScriptExtQObject::nestedArrayAsSlotArgument_data()
+{
+    QTest::addColumn<QString>("program");
+    QTest::addColumn<QVariantList>("expected");
+
+    QTest::newRow("[[]]")
+        << QString::fromLatin1("[[]]")
+        << (QVariantList() << (QVariant(QVariantList())));
+    QTest::newRow("[[123]]")
+        << QString::fromLatin1("[[123]]")
+        << (QVariantList() << (QVariant(QVariantList() << 123)));
+    QTest::newRow("[[], 123]")
+        << QString::fromLatin1("[[], 123]")
+        << (QVariantList() << QVariant(QVariantList()) << 123);
+
+    // Cyclic
+    QTest::newRow("var a=[]; a.push(a)")
+        << QString::fromLatin1("var a=[]; a.push(a); a")
+        << (QVariantList() << QVariant(QVariantList()));
+    QTest::newRow("var a=[]; a.push(123, a)")
+        << QString::fromLatin1("var a=[]; a.push(123, a); a")
+        << (QVariantList() << 123 << QVariant(QVariantList()));
+    QTest::newRow("var a=[]; var b=[]; a.push(b); b.push(a)")
+        << QString::fromLatin1("var a=[]; var b=[]; a.push(b); b.push(a); a")
+        << (QVariantList() << QVariant(QVariantList() << QVariant(QVariantList())));
+    QTest::newRow("var a=[]; var b=[]; a.push(123, b); b.push(456, a)")
+        << QString::fromLatin1("var a=[]; var b=[]; a.push(123, b); b.push(456, a); a")
+        << (QVariantList() << 123 << QVariant(QVariantList() << 456 << QVariant(QVariantList())));
+}
+
+void tst_QScriptExtQObject::nestedArrayAsSlotArgument()
+{
+    QFETCH(QString, program);
+    QFETCH(QVariantList, expected);
+    QScriptValue a = m_engine->evaluate(program);
+    QVERIFY(!a.isError());
+    QVERIFY(a.isArray());
+    // Slot that takes QVariantList
+    {
+        QVERIFY(!m_engine->evaluate("myObject.myInvokableWithVariantListArg")
+                .call(QScriptValue(), QScriptValueList() << a).isError());
+        QCOMPARE(m_myObject->qtFunctionInvoked(), 62);
+        QCOMPARE(m_myObject->qtFunctionActuals().size(), 1);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).type(), QVariant::List);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).toList(), expected);
+    }
+    // Slot that takes QVariant
+    {
+        m_myObject->resetQtFunctionInvoked();
+        QVERIFY(!m_engine->evaluate("myObject.myInvokableWithVariantArg")
+                .call(QScriptValue(), QScriptValueList() << a).isError());
+        QCOMPARE(m_myObject->qtFunctionInvoked(), 15);
+        QCOMPARE(m_myObject->qtFunctionActuals().size(), 1);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).type(), QVariant::List);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).toList(), expected);
+    }
+}
+
+void tst_QScriptExtQObject::nestedObjectAsSlotArgument_data()
+{
+    QTest::addColumn<QString>("program");
+    QTest::addColumn<QVariantMap>("expected");
+
+    {
+        QVariantMap m;
+        m["a"] = QVariantMap();
+        QTest::newRow("{ a:{} }")
+            << QString::fromLatin1("({ a:{} })")
+            << m;
+    }
+    {
+        QVariantMap m, m2;
+        m2["b"] = 10;
+        m2["c"] = 20;
+        m["a"] = m2;
+        QTest::newRow("{ a:{b:10, c:20} }")
+            << QString::fromLatin1("({ a:{b:10, c:20} })")
+            << m;
+    }
+    {
+        QVariantMap m;
+        m["a"] = 10;
+        m["b"] = QVariantList() << 20 << 30;
+        QTest::newRow("{ a:10, b:[20, 30]}")
+            << QString::fromLatin1("({ a:10, b:[20,30]})")
+            << m;
+    }
+
+    // Cyclic
+    {
+        QVariantMap m;
+        m["p"] = QVariantMap();
+        QTest::newRow("var o={}; o.p=o")
+            << QString::fromLatin1("var o={}; o.p=o; o")
+            << m;
+    }
+    {
+        QVariantMap m;
+        m["p"] = 123;
+        m["q"] = QVariantMap();
+        QTest::newRow("var o={}; o.p=123; o.q=o")
+            << QString::fromLatin1("var o={}; o.p=123; o.q=o; o")
+            << m;
+    }
+}
+
+void tst_QScriptExtQObject::nestedObjectAsSlotArgument()
+{
+    QFETCH(QString, program);
+    QFETCH(QVariantMap, expected);
+    QScriptValue o = m_engine->evaluate(program);
+    QVERIFY(!o.isError());
+    QVERIFY(o.isObject());
+    // Slot that takes QVariantMap
+    {
+        QVERIFY(!m_engine->evaluate("myObject.myInvokableWithVariantMapArg")
+                .call(QScriptValue(), QScriptValueList() << o).isError());
+        QCOMPARE(m_myObject->qtFunctionInvoked(), 16);
+        QCOMPARE(m_myObject->qtFunctionActuals().size(), 1);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).type(), QVariant::Map);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).toMap(), expected);
+    }
+    // Slot that takes QVariant
+    {
+        m_myObject->resetQtFunctionInvoked();
+        QVERIFY(!m_engine->evaluate("myObject.myInvokableWithVariantArg")
+                .call(QScriptValue(), QScriptValueList() << o).isError());
+        QCOMPARE(m_myObject->qtFunctionInvoked(), 15);
+        QCOMPARE(m_myObject->qtFunctionActuals().size(), 1);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).type(), QVariant::Map);
+        QCOMPARE(m_myObject->qtFunctionActuals().at(0).toMap(), expected);
+    }
+}
+
 QTEST_MAIN(tst_QScriptExtQObject)
 #include "tst_qscriptextqobject.moc"
diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
index aa9fa15..8aa4e711 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.cpp
@@ -1270,7 +1270,7 @@ void tst_QScriptValue::toVariant_old()
     QCOMPARE(opaque.toVariant(), var);
 
     QScriptValue object = eng.newObject();
-    QCOMPARE(object.toVariant(), QVariant(QString("[object Object]")));
+    QCOMPARE(object.toVariant(), QVariant(QVariantMap()));
 
     QScriptValue qobject = eng.newQObject(this);
     {
@@ -2296,7 +2296,7 @@ void tst_QScriptValue::getSetScriptClass()
         QCOMPARE(obj.scriptClass(), (QScriptClass*)&testClass);
         QVERIFY(obj.isObject());
         QVERIFY(!obj.isVariant());
-        QVERIFY(!obj.toVariant().isValid());
+        QCOMPARE(obj.toVariant(), QVariant(QVariantMap()));
     }
     {
         QScriptValue obj = eng.newQObject(this);
@@ -3472,4 +3472,89 @@ void tst_QScriptValue::objectId()
     QVERIFY(obj.strictlyEquals(eng.globalObject()));
 }
 
+void tst_QScriptValue::nestedObjectToVariant_data()
+{
+    QTest::addColumn<QString>("program");
+    QTest::addColumn<QVariant>("expected");
+
+    // Array literals
+    QTest::newRow("[[]]")
+        << QString::fromLatin1("[[]]")
+        << QVariant(QVariantList() << (QVariant(QVariantList())));
+    QTest::newRow("[[123]]")
+        << QString::fromLatin1("[[123]]")
+        << QVariant(QVariantList() << (QVariant(QVariantList() << 123)));
+    QTest::newRow("[[], 123]")
+        << QString::fromLatin1("[[], 123]")
+        << QVariant(QVariantList() << QVariant(QVariantList()) << 123);
+
+    // Cyclic arrays
+    QTest::newRow("var a=[]; a.push(a)")
+        << QString::fromLatin1("var a=[]; a.push(a); a")
+        << QVariant(QVariantList() << QVariant(QVariantList()));
+    QTest::newRow("var a=[]; a.push(123, a)")
+        << QString::fromLatin1("var a=[]; a.push(123, a); a")
+        << QVariant(QVariantList() << 123 << QVariant(QVariantList()));
+    QTest::newRow("var a=[]; var b=[]; a.push(b); b.push(a)")
+        << QString::fromLatin1("var a=[]; var b=[]; a.push(b); b.push(a); a")
+        << QVariant(QVariantList() << QVariant(QVariantList() << QVariant(QVariantList())));
+    QTest::newRow("var a=[]; var b=[]; a.push(123, b); b.push(456, a)")
+        << QString::fromLatin1("var a=[]; var b=[]; a.push(123, b); b.push(456, a); a")
+        << QVariant(QVariantList() << 123 << QVariant(QVariantList() << 456 << QVariant(QVariantList())));
+
+    // Object literals
+    {
+        QVariantMap m;
+        m["a"] = QVariantMap();
+        QTest::newRow("{ a:{} }")
+            << QString::fromLatin1("({ a:{} })")
+            << QVariant(m);
+    }
+    {
+        QVariantMap m, m2;
+        m2["b"] = 10;
+        m2["c"] = 20;
+        m["a"] = m2;
+        QTest::newRow("{ a:{b:10, c:20} }")
+            << QString::fromLatin1("({ a:{b:10, c:20} })")
+            << QVariant(m);
+    }
+    {
+        QVariantMap m;
+        m["a"] = 10;
+        m["b"] = QVariantList() << 20 << 30;
+        QTest::newRow("{ a:10, b:[20, 30]}")
+            << QString::fromLatin1("({ a:10, b:[20,30]})")
+            << QVariant(m);
+    }
+
+    // Cyclic objects
+    {
+        QVariantMap m;
+        m["p"] = QVariantMap();
+        QTest::newRow("var o={}; o.p=o")
+            << QString::fromLatin1("var o={}; o.p=o; o")
+            << QVariant(m);
+    }
+    {
+        QVariantMap m;
+        m["p"] = 123;
+        m["q"] = QVariantMap();
+        QTest::newRow("var o={}; o.p=123; o.q=o")
+            << QString::fromLatin1("var o={}; o.p=123; o.q=o; o")
+            << QVariant(m);
+    }
+}
+
+void tst_QScriptValue::nestedObjectToVariant()
+{
+    QScriptEngine eng;
+    QFETCH(QString, program);
+    QFETCH(QVariant, expected);
+    QScriptValue o = eng.evaluate(program);
+    QVERIFY(!o.isError());
+    QVERIFY(o.isObject());
+    QCOMPARE(o.toVariant(), expected);
+}
+
 QTEST_MAIN(tst_QScriptValue)
diff --git a/tests/auto/qscriptvalue/tst_qscriptvalue.h b/tests/auto/qscriptvalue/tst_qscriptvalue.h
index aae35b2..8bfaa6a 100644
--- a/tests/auto/qscriptvalue/tst_qscriptvalue.h
+++ b/tests/auto/qscriptvalue/tst_qscriptvalue.h
@@ -225,6 +225,8 @@ private slots:
     void engineDeleted();
     void valueOfWithClosure();
     void objectId();
+    void nestedObjectToVariant_data();
+    void nestedObjectToVariant();
 
 private:
     typedef void (tst_QScriptValue::*InitDataFunction)();
diff --git a/tests/auto/qtextboundaryfinder/tst_qtextboundaryfinder.cpp b/tests/auto/qtextboundaryfinder/tst_qtextboundaryfinder.cpp
index c60af5e..a562fbe 100644
--- a/tests/auto/qtextboundaryfinder/tst_qtextboundaryfinder.cpp
+++ b/tests/auto/qtextboundaryfinder/tst_qtextboundaryfinder.cpp
@@ -71,6 +71,10 @@ private slots:
     void isAtWordStart();
     void fastConstructor();
     void isAtBoundaryLine();
+    void toNextBoundary_data();
+    void toNextBoundary();
+    void toPreviousBoundary_data();
+    void toPreviousBoundary();
 };
 
 tst_QTextBoundaryFinder::tst_QTextBoundaryFinder()
@@ -292,25 +296,120 @@ void tst_QTextBoundaryFinder::fastConstructor()
 
 void tst_QTextBoundaryFinder::isAtBoundaryLine()
 {
-    // idx          0       1       2       3       4       5
-    // break?       -       -       -       +       -       +
+    // idx       0       1       2       3       4       5      6
+    // break?    -       -       -       -       +       -      +
     QChar s[] = { 0x0061, 0x00AD, 0x0062, 0x0009, 0x0063, 0x0064 };
     QString text(s, sizeof(s)/sizeof(s[0]));
-    qDebug() << "text = " << text << ", length = " << text.length();
+//    qDebug() << "text = " << text << ", length = " << text.length();
     QTextBoundaryFinder finder(QTextBoundaryFinder::Line, text.constData(), text.length(), /*buffer*/0, /*buffer size*/0);
     finder.setPosition(0);
-    QVERIFY(!finder.isAtBoundary());
+    QVERIFY(finder.isAtBoundary());
     finder.setPosition(1);
     QVERIFY(!finder.isAtBoundary());
     finder.setPosition(2);
     QVERIFY(!finder.isAtBoundary());
     finder.setPosition(3);
-    QVERIFY(finder.isAtBoundary());
-    finder.setPosition(4);
     QVERIFY(!finder.isAtBoundary());
+    finder.setPosition(4);
+    QVERIFY(finder.isAtBoundary());
     finder.setPosition(5);
+    QVERIFY(!finder.isAtBoundary());
+    finder.setPosition(6);
     QVERIFY(finder.isAtBoundary());
 }
 
+Q_DECLARE_METATYPE(QList<int>)
+
+void tst_QTextBoundaryFinder::toNextBoundary_data()
+{
+    QTest::addColumn<QString>("text");
+    QTest::addColumn<int>("type");
+    QTest::addColumn< QList<int> >("boundaries");
+
+    QList<int> boundaries;
+    boundaries << 0 << 3 << 4 << 7 << 8 << 11 << 12 << 13 << 16 << 17 << 20 << 21 << 24 << 25;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Word) \
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 0 << 13 << 25;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Sentence) \
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 0 << 4 << 8 << 13 << 17 << 21 << 25;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Line) \
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 0 << 5 << 9 << 15 << 17 << 21 << 28;
+    QTest::newRow("Line") << QString::fromUtf8("Diga-nos qualé a sua opinião") << int(QTextBoundaryFinder::Line)
+            << boundaries;
+
+}
+
+void tst_QTextBoundaryFinder::toNextBoundary()
+{
+    QFETCH(QString, text);
+    QFETCH(int, type);
+    QFETCH(QList<int>, boundaries);
+
+    QList<int> foundBoundaries;
+    QTextBoundaryFinder boundaryFinder(QTextBoundaryFinder::BoundaryType(type), text);
+    boundaryFinder.toStart();
+    for(int next = 0; next != -1; next = boundaryFinder.toNextBoundary())
+        foundBoundaries << next;
+    QCOMPARE(boundaries, foundBoundaries);
+}
+
+void tst_QTextBoundaryFinder::toPreviousBoundary_data()
+{
+    QTest::addColumn<QString>("text");
+    QTest::addColumn<int>("type");
+    QTest::addColumn< QList<int> >("boundaries");
+
+    QList<int> boundaries;
+    boundaries << 25 << 24 << 21 << 20 << 17 << 16 << 13 << 12 << 11 << 8 << 7 << 4 << 3 << 0;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Word)
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 25 << 13 << 0;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Sentence)
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 25 << 21 << 17 << 13 << 8 << 4 << 0;
+    QTest::newRow("Line") << QString("Aaa bbb ccc. Ddd eee fff.") << int(QTextBoundaryFinder::Line)
+            << boundaries;
+
+    boundaries.clear();
+    boundaries << 28 << 21 << 17 << 15 << 9 << 5 << 0;
+    QTest::newRow("Line") << QString::fromUtf8("Diga-nos qualé a sua opinião") << int(QTextBoundaryFinder::Line)
+            << boundaries;
+
+}
+
+void tst_QTextBoundaryFinder::toPreviousBoundary()
+{
+    QFETCH(QString, text);
+    QFETCH(int, type);
+    QFETCH(QList<int>, boundaries);
+
+    QList<int> foundBoundaries;
+    QTextBoundaryFinder boundaryFinder(QTextBoundaryFinder::BoundaryType(type), text);
+    boundaryFinder.toEnd();
+    for (int previous = boundaryFinder.position();
+         previous != -1;
+         previous = boundaryFinder.toPreviousBoundary())
+    {
+        foundBoundaries << previous;
+    }
+    QCOMPARE(boundaries, foundBoundaries);
+}
+
+
+
+
 QTEST_MAIN(tst_QTextBoundaryFinder)
 #include "tst_qtextboundaryfinder.moc"
diff --git a/tests/auto/selftests/expected_badxml.txt b/tests/auto/selftests/expected_badxml.txt
index 046f1b2..bc9d203 100644
--- a/tests/auto/selftests/expected_badxml.txt
+++ b/tests/auto/selftests/expected_badxml.txt
@@ -1,5 +1,5 @@
 ********* Start testing of tst_BadXml *********
-Config: Using QTest library 4.6.3, Qt 4.6.3
+Config: Using QTest library 4.6.4, Qt 4.6.4
 PASS   : tst_BadXml::initTestCase()
 QDEBUG : tst_BadXml::badDataTag(end cdata ]]> text ]]> more text) a message
 FAIL!  : tst_BadXml::badDataTag(end cdata ]]> text ]]> more text) a failure
diff --git a/tests/auto/selftests/expected_xunit.txt b/tests/auto/selftests/expected_xunit.txt
index 02cfa6f..ac8c0db 100644
--- a/tests/auto/selftests/expected_xunit.txt
+++ b/tests/auto/selftests/expected_xunit.txt
@@ -1,5 +1,5 @@
 ********* Start testing of tst_Xunit *********
-Config: Using QTest library 4.6.3, Qt 4.6.3
+Config: Using QTest library 4.6.4, Qt 4.6.4
 PASS   : tst_Xunit::initTestCase()
 WARNING: tst_Xunit::testFunc1() just a QWARN() !
 PASS   : tst_Xunit::testFunc1()
diff --git a/tests/auto/uic/baseline/config_fromuic3.ui.h b/tests/auto/uic/baseline/config_fromuic3.ui.h
index 7e0189e..a97e8bc 100644
--- a/tests/auto/uic/baseline/config_fromuic3.ui.h
+++ b/tests/auto/uic/baseline/config_fromuic3.ui.h
@@ -45,7 +45,7 @@
 ** Form generated from reading UI file 'config_fromuic3.ui'
 **
 ** Created: Thu Dec 17 12:48:42 2009
-**      by: Qt User Interface Compiler version 4.6.3
+**      by: Qt User Interface Compiler version 4.6.4
 **
 ** WARNING! All changes made in this file will be lost when recompiling UI file!
 ********************************************************************************/
diff --git a/tools/qdoc3/ditaxmlgenerator.cpp b/tools/qdoc3/ditaxmlgenerator.cpp
index 197bc13..e80f948 100644
--- a/tools/qdoc3/ditaxmlgenerator.cpp
+++ b/tools/qdoc3/ditaxmlgenerator.cpp
@@ -501,19 +501,18 @@ QString DitaXmlGenerator::format()
 }
 
 /*!
-  Create a new GUID, write it to the XML stream
-  as an "id" attribute, and return it.
+  Calls lookupGuid() to get a GUID for \a text, then writes
+  it to the XML stream as an "id" attribute, and returns it.
  */
 QString DitaXmlGenerator::writeGuidAttribute(QString text)
 {
-    QString guid = QUuid::createUuid().toString();
-    name2guidMap.insert(text,guid);
+    QString guid = lookupGuid(text);
     writer.writeAttribute("id",guid);
     return guid;
 }
 
 /*!
-  Looks up \a text in the GUID map. It it finds \a text,
+  Looks up \a text in the GUID map. If it finds \a text,
   it returns the associated GUID. Otherwise it inserts
   \a text into the map with a new GUID, and it returns
   the new GUID.
@@ -1424,7 +1423,7 @@ DitaXmlGenerator::generateClassLikeNode(const InnerNode* inner, CodeMarker* mark
         generateHeader(inner);
 
         writer.writeStartElement(CXXCLASS);
-        writeGuidAttribute(fullTitle);
+        writer.writeAttribute("id",cn->guid());
         writer.writeStartElement(APINAME);
         writer.writeCharacters(fullTitle);
         writer.writeEndElement(); // </apiName>
@@ -1436,6 +1435,12 @@ DitaXmlGenerator::generateClassLikeNode(const InnerNode* inner, CodeMarker* mark
         writer.writeStartElement(CXXCLASSACCESSSPECIFIER);
         writer.writeAttribute("value",inner->accessString());
         writer.writeEndElement(); // <cxxClassAccessSpecifier>
+        if (cn->isAbstract()) {
+            writer.writeStartElement(CXXCLASSABSTRACT);
+            writer.writeAttribute("name","abstract");
+            writer.writeAttribute("value","abstract");
+            writer.writeEndElement(); // </cxxClassAbstract>
+        }
         writeDerivations(cn, marker);
         writeLocation(cn, marker);
         writer.writeEndElement(); // <cxxClassDefinition>
@@ -1452,6 +1457,26 @@ DitaXmlGenerator::generateClassLikeNode(const InnerNode* inner, CodeMarker* mark
     
         writer.writeEndElement(); // </apiDesc>
         writer.writeEndElement(); // </cxxClassDetail>
+
+        sections = marker->sections(inner, CodeMarker::Detailed, CodeMarker::Okay);
+        s = sections.begin();
+        while (s != sections.end()) {
+            if ((*s).name == "Member Function Documentation") {
+                writeFunctions((*s),cn,marker);
+            }
+            else if ((*s).name == "Member Type Documentation") {
+                writeNestedClasses((*s),cn,marker);
+                writeEnumerations((*s),cn,marker);
+                writeTypedefs((*s),cn,marker);
+            }
+            else if ((*s).name == "Member Variable Documentation") {
+                writeDataMembers((*s),cn,marker);
+            }
+            else if ((*s).name == "Property Documentation") {
+                writeProperties((*s),cn,marker);
+            }
+            ++s;
+        }
         writer.writeEndElement(); // </cxxClass>
     }
 
@@ -4475,6 +4500,31 @@ void DitaXmlGenerator::generatePageIndex(const QString& fileName, CodeMarker* ma
 
 #endif
 
+/*!
+  Return the full qualification of the node \a n, but without
+  the name of \a n itself. e.g. A::B::C
+ */
+QString DitaXmlGenerator::fullQualification(const Node* n)
+{
+    QString fq;
+    InnerNode* in = n->parent();
+    while (in) {
+        if ((in->type() == Node::Class) ||
+            (in->type() == Node::Namespace)) {
+            if (in->name().isEmpty())
+                break;
+            if (fq.isEmpty())
+                fq = in->name();
+            else
+                fq = in->name() + "::" + fq;
+        }
+        else
+            break;
+        in = in->parent();
+    }
+    return fq;
+}
+
 void DitaXmlGenerator::writeDerivations(const ClassNode* cn, CodeMarker* marker)
 {
     QList<RelatedClass>::ConstIterator r;
@@ -4490,10 +4540,8 @@ void DitaXmlGenerator::writeDerivations(const ClassNode* cn, CodeMarker* marker)
             writer.writeAttribute("value",(*r).accessString());
             writer.writeEndElement(); // </cxxClassDerivationAccessSpecifier>
             writer.writeStartElement(CXXCLASSBASECLASS);
-            QString fullTitle = marker->plainFullName((*r).node);
-            QString guid = lookupGuid(fullTitle);
-            writer.writeAttribute("href",guid);
-            writer.writeCharacters(fullTitle);
+            writer.writeAttribute("href",(*r).node->ditaXmlHref());
+            writer.writeCharacters(marker->plainFullName((*r).node));
             writer.writeEndElement(); // </cxxClassBaseClass>
             writer.writeEndElement(); // </cxxClassDerivation>
              ++r;
@@ -4502,19 +4550,173 @@ void DitaXmlGenerator::writeDerivations(const ClassNode* cn, CodeMarker* marker)
      }
 }
 
-void DitaXmlGenerator::writeLocation(const ClassNode* cn, CodeMarker* marker)
+void DitaXmlGenerator::writeLocation(const Node* n, CodeMarker* marker)
 {
-    writer.writeStartElement(CXXCLASSAPIITEMLOCATION);
-    writer.writeStartElement(CXXCLASSDECLARATIONFILE);
+    QString s1, s2, s3;
+    if (n->type() == Node::Class) {
+        s1 = CXXCLASSAPIITEMLOCATION;
+        s2 = CXXCLASSDECLARATIONFILE;
+        s3 = CXXCLASSDECLARATIONFILELINE;
+    }
+    else if (n->type() == Node::Function) {
+        s1 = CXXFUNCTIONAPIITEMLOCATION;
+        s2 = CXXFUNCTIONDECLARATIONFILE;
+        s3 = CXXFUNCTIONDECLARATIONFILELINE;
+    }
+    writer.writeStartElement(s1);
+    writer.writeStartElement(s2);
     writer.writeAttribute("name","filePath");
-    writer.writeAttribute("value",cn->location().filePath());
-    writer.writeEndElement(); // </cxxClassDeclarationFile>
-    writer.writeStartElement(CXXCLASSDECLARATIONFILELINE);
+    writer.writeAttribute("value",n->location().filePath());
+    writer.writeEndElement(); // </cxx<s2>DeclarationFile>
+    writer.writeStartElement(s3);
     writer.writeAttribute("name","lineNumber");
     QString lineNr;
-    writer.writeAttribute("value",lineNr.setNum(cn->location().lineNo()));
-    writer.writeEndElement(); // </cxxClassDeclarationFileLine>
-    writer.writeEndElement(); // </cxxClassApiItemLocation>
+    writer.writeAttribute("value",lineNr.setNum(n->location().lineNo()));
+    writer.writeEndElement(); // </cxx<s3>DeclarationFileLine>
+    writer.writeEndElement(); // </cxx<s1>ApiItemLocation>
+}
+
+void DitaXmlGenerator::writeFunctions(const Section& s, 
+                                      const ClassNode* cn, 
+                                      CodeMarker* marker)
+{
+    NodeList::ConstIterator m = s.members.begin();
+    while (m != s.members.end()) {
+        if ((*m)->type() == Node::Function) {
+            const FunctionNode* fn = reinterpret_cast<const FunctionNode*>(*m);
+            QString name = fn->name();
+            writer.writeStartElement(CXXFUNCTION);
+            writeGuidAttribute(name);
+            writer.writeStartElement(APINAME);
+            writer.writeCharacters(name);
+            writer.writeEndElement(); // </apiName>
+            generateBrief(fn,marker);
+            writer.writeStartElement(CXXFUNCTIONDETAIL);
+            writer.writeStartElement(CXXFUNCTIONDEFINITION);
+            writer.writeStartElement(CXXFUNCTIONACCESSSPECIFIER);
+            writer.writeAttribute("value",fn->accessString());
+            writer.writeEndElement(); // <cxxFunctionAccessSpecifier>
+
+            if (fn->isStatic()) {
+                writer.writeStartElement(CXXFUNCTIONSTORAGECLASSSPECIFIERSTATIC);
+                writer.writeAttribute("name","static");
+                writer.writeAttribute("value","static");
+                writer.writeEndElement(); // <cxxFunctionStorageClassSpecifierStatic>
+            }
+            
+            if (fn->isConst()) {
+                writer.writeStartElement(CXXFUNCTIONCONST);
+                writer.writeAttribute("name","const");
+                writer.writeAttribute("value","const");
+                writer.writeEndElement(); // <cxxFunctionConst>
+            }
+
+            if (fn->virtualness() != FunctionNode::NonVirtual) {
+                writer.writeStartElement(CXXFUNCTIONVIRTUAL);
+                writer.writeAttribute("name","virtual");
+                writer.writeAttribute("value","virtual");
+                writer.writeEndElement(); // <cxxFunctionVirtual>
+                if (fn->virtualness() == FunctionNode::PureVirtual) {
+                    writer.writeStartElement(CXXFUNCTIONPUREVIRTUAL);
+                    writer.writeAttribute("name","pure virtual");
+                    writer.writeAttribute("value","pure virtual");
+                    writer.writeEndElement(); // <cxxFunctionPureVirtual>
+                }
+            }
+            
+            if (fn->name() == cn->name()) {
+                writer.writeStartElement(CXXFUNCTIONCONSTRUCTOR);
+                writer.writeAttribute("name","constructor");
+                writer.writeAttribute("value","constructor");
+                writer.writeEndElement(); // <cxxFunctionConstructor>
+            }
+            else if (fn->name()[0] == QChar('~')) {
+                writer.writeStartElement(CXXFUNCTIONDESTRUCTOR);
+                writer.writeAttribute("name","destructor");
+                writer.writeAttribute("value","destructor");
+                writer.writeEndElement(); // <cxxFunctionDestructor>
+            }
+            else {
+                writer.writeStartElement(CXXFUNCTIONDECLAREDTYPE);
+                writer.writeCharacters(fn->returnType());
+                writer.writeEndElement(); // <cxxFunctionDeclaredType>
+            }
+            QString fq = fullQualification(fn);
+            if (!fq.isEmpty()) {
+                writer.writeStartElement(CXXFUNCTIONSCOPEDNAME);
+                writer.writeCharacters(fq);
+                writer.writeEndElement(); // <cxxFunctionScopedName>
+            }
+            writer.writeStartElement(CXXFUNCTIONPROTOTYPE);
+            writer.writeCharacters(fn->signature(true));
+            writer.writeEndElement(); // <cxxFunctionPrototype>
+
+            QString fnl = fn->signature(false);
+            int idx = fnl.indexOf(' ');
+            if (idx < 0)
+                idx = 0;
+            else
+                ++idx;
+            fnl = fn->parent()->name() + "::" + fnl.mid(idx);
+            writer.writeStartElement(CXXFUNCTIONNAMELOOKUP);
+            writer.writeCharacters(fnl);
+            writer.writeEndElement(); // <cxxFunctionNameLookup>
+
+            //writer.writeStartElement(CXXFUNCTIONREIMPLEMENTED);
+            //writer.writeAttribute("href", zzz);
+            //writer.writeCharacters();
+            //writer.writeEndElement(); // </cxxFunctionReimplemented>
+            
+            writeLocation(fn, marker);
+            writer.writeEndElement(); // <cxxFunctionDefinition>
+            writer.writeStartElement(APIDESC);
+
+            if (!fn->doc().isEmpty()) {
+                generateBody(fn, marker);
+                //        generateAlsoList(inner, marker);
+            }
+
+            writer.writeEndElement(); // </apiDesc>
+            writer.writeEndElement(); // </cxxFunctionDetail>
+            writer.writeEndElement(); // </cxxFunction>
+
+            if (fn->metaness() == FunctionNode::Ctor ||
+                fn->metaness() == FunctionNode::Dtor ||
+                fn->overloadNumber() != 1) {
+            }
+        }
+        ++m;
+    }
+}
+
+void DitaXmlGenerator::writeNestedClasses(const Section& s, 
+                                          const ClassNode* cn, 
+                                          CodeMarker* marker)
+{
+}
+
+void DitaXmlGenerator::writeEnumerations(const Section& s, 
+                                         const ClassNode* cn, 
+                                         CodeMarker* marker)
+{
+}
+
+void DitaXmlGenerator::writeTypedefs(const Section& s, 
+                                     const ClassNode* cn, 
+                                     CodeMarker* marker)
+{
+}
+
+void DitaXmlGenerator::writeDataMembers(const Section& s, 
+                                        const ClassNode* cn, 
+                                        CodeMarker* marker)
+{
+}
+
+void DitaXmlGenerator::writeProperties(const Section& s, 
+                                       const ClassNode* cn, 
+                                       CodeMarker* marker)
+{
 }
 
 QT_END_NAMESPACE
diff --git a/tools/qdoc3/ditaxmlgenerator.h b/tools/qdoc3/ditaxmlgenerator.h
index 070329b..71304b3 100644
--- a/tools/qdoc3/ditaxmlgenerator.h
+++ b/tools/qdoc3/ditaxmlgenerator.h
@@ -110,8 +110,28 @@ class DitaXmlGenerator : public PageGenerator
     virtual QString linkForNode(const Node *node, const Node *relative);
     virtual QString refForAtom(Atom *atom, const Node *node);
     
+    QString fullQualification(const Node* n);
+
     void writeDerivations(const ClassNode* cn, CodeMarker* marker);
-    void writeLocation(const ClassNode* cn, CodeMarker* marker);
+    void writeLocation(const Node* n, CodeMarker* marker);
+    void writeFunctions(const Section& s, 
+                        const ClassNode* cn, 
+                        CodeMarker* marker);
+    void writeNestedClasses(const Section& s, 
+                            const ClassNode* cn, 
+                            CodeMarker* marker);
+    void writeEnumerations(const Section& s, 
+                           const ClassNode* cn, 
+                           CodeMarker* marker);
+    void writeTypedefs(const Section& s, 
+                       const ClassNode* cn, 
+                       CodeMarker* marker);
+    void writeDataMembers(const Section& s, 
+                          const ClassNode* cn, 
+                          CodeMarker* marker);
+    void writeProperties(const Section& s, 
+                         const ClassNode* cn, 
+                         CodeMarker* marker);
 
  private:
     enum SubTitleSize { SmallSubTitle, LargeSubTitle };
diff --git a/tools/qdoc3/node.cpp b/tools/qdoc3/node.cpp
index 4664e9d..2a03fd2 100644
--- a/tools/qdoc3/node.cpp
+++ b/tools/qdoc3/node.cpp
@@ -101,6 +101,7 @@ Node::Node(Type type, InnerNode *parent, const QString& name)
 {
     if (par)
         par->addChild(this);
+    uuid = QUuid::createUuid();
 }
 
 /*!
@@ -199,6 +200,11 @@ Node::Status Node::inheritedStatus() const
 }
 
 /*!
+  Returns the thread safeness value for whatever this node
+  represents. But if this node has a parent and the thread
+  safeness value of the parent is the same as the thread
+  safeness value of this node, what is returned is the
+  value \c{UnspecifiedSafeness}. Why?
  */
 Node::ThreadSafeness Node::threadSafeness() const
 {
@@ -208,6 +214,9 @@ Node::ThreadSafeness Node::threadSafeness() const
 }
 
 /*!
+  If this node has a parent, the parent's thread safeness
+  value is returned. Otherwise, this node's thread safeness
+  value is returned. Why?
  */
 Node::ThreadSafeness Node::inheritedThreadSafeness() const
 {
@@ -217,6 +226,9 @@ Node::ThreadSafeness Node::inheritedThreadSafeness() const
 }
 
 /*!
+  Returns the sanitized file name without the path.
+  If the the file is an html file, the html suffix
+  is removed. Why?
  */
 QString Node::fileBase() const
 {
@@ -229,11 +241,32 @@ QString Node::fileBase() const
     return base.toLower();
 }
 
+/*! \fnQUuid Node::guid() const
+  Returns this node's Universally Unique IDentifier.
+  If its UUID has not yet been created, it is created
+  first.
+ */
+
+/*!
+  Composes a string to be used as an href attribute in DITA
+  XML. It is composed of the file name and the UUID separated
+  by a '#'
+ */
+QString Node::ditaXmlHref()
+{
+    QString href = fileBase();
+    if (!href.endsWith(".xml"))
+        href += ".xml";
+    return href + "#" + guid();
+}
+
 /*!
   \class InnerNode
  */
 
 /*!
+  The inner node destructor deletes the children and removes
+  this node from its related nodes.
  */
 InnerNode::~InnerNode()
 {
@@ -577,6 +610,7 @@ InnerNode::InnerNode(Type type, InnerNode *parent, const QString& name)
 }
 
 /*!
+  Appends an \a include file to the list of include files.
  */
 void InnerNode::addInclude(const QString& include)
 {
@@ -584,6 +618,7 @@ void InnerNode::addInclude(const QString& include)
 }
 
 /*!
+  Sets the list of include files to \a includes.
  */
 void InnerNode::setIncludes(const QStringList& includes)
 {
@@ -789,6 +824,7 @@ ClassNode::ClassNode(InnerNode *parent, const QString& name)
     : InnerNode(Class, parent, name)
 {
     hidden = false;
+    abstract = false;
     setPageType(ApiPage);
 }
 
@@ -1078,6 +1114,19 @@ FunctionNode::FunctionNode(Type type, InnerNode *parent, const QString& name, bo
 }
 
 /*!
+  Sets the \a virtualness of this function. If the \a virtualness
+  is PureVirtual, and if the parent() is a ClassNode, set the parent's
+  \e abstract flag to true.
+ */
+void FunctionNode::setVirtualness(Virtualness virtualness)
+{
+    vir = virtualness;
+    if ((virtualness == PureVirtual) && parent() &&
+        (parent()->type() == Node::Class))
+        parent()->setAbstract(true);
+}
+
+/*!
  */
 void FunctionNode::setOverload(bool overlode)
 {
diff --git a/tools/qdoc3/node.h b/tools/qdoc3/node.h
index 523394d..44cdac2 100644
--- a/tools/qdoc3/node.h
+++ b/tools/qdoc3/node.h
@@ -55,6 +55,7 @@
 #include "doc.h"
 #include "location.h"
 #include "text.h"
+#include <QUuid>
 
 QT_BEGIN_NAMESPACE
 
@@ -190,6 +191,8 @@ class Node
     void clearRelated() { rel = 0; }
 
     virtual QString fileBase() const;
+    QUuid guid() const { return uuid; }
+    QString ditaXmlHref();
 
  protected:
     Node(Type type, InnerNode *parent, const QString& name);
@@ -219,6 +222,7 @@ class Node
     QString u;
     QString sinc;
     QString tpl;
+    QUuid   uuid;
 };
 
 class FunctionNode;
@@ -261,6 +265,8 @@ class InnerNode : public Node
     QStringList secondaryKeys();
     const QStringList& pageKeywords() const { return pageKeywds; }
     virtual void addPageKeywords(const QString& t) { pageKeywds << t; }
+    virtual bool isAbstract() const { return false; }
+    virtual void setAbstract(bool ) { }
 
  protected:
     InnerNode(Type type, InnerNode *parent, const QString& name);
@@ -341,11 +347,14 @@ class ClassNode : public InnerNode
     void setServiceName(const QString& value) { sname = value; }
     QString qmlElement() const { return qmlelement; }
     void setQmlElement(const QString& value) { qmlelement = value; }
+    virtual bool isAbstract() const { return abstract; }
+    virtual void setAbstract(bool b) { abstract = b; }
 
  private:
     QList<RelatedClass> bas;
     QList<RelatedClass> der;
     bool hidden;
+    bool abstract;
     QString sname;
     QString qmlelement;
 };
@@ -582,7 +591,7 @@ class FunctionNode : public LeafNode
     void setReturnType(const QString& returnType) { rt = returnType; }
     void setParentPath(const QStringList& parentPath) { pp = parentPath; }
     void setMetaness(Metaness metaness) { met = metaness; }
-    void setVirtualness(Virtualness virtualness) { vir = virtualness; }
+    void setVirtualness(Virtualness virtualness);
     void setConst(bool conste) { con = conste; }
     void setStatic(bool statique) { sta = statique; }
     void setOverload(bool overlode);
diff --git a/tools/qml/deviceorientation_maemo.cpp b/tools/qml/deviceorientation_maemo.cpp
index 7948e2a..443edc8 100644
--- a/tools/qml/deviceorientation_maemo.cpp
+++ b/tools/qml/deviceorientation_maemo.cpp
@@ -40,100 +40,87 @@
 ****************************************************************************/
 
 #include "deviceorientation.h"
-#include <stdio.h>
-#include <stdlib.h>
+#include <QtDBus>
+
+#include <mce/mode-names.h>
+#include <mce/dbus-names.h>
 
 class MaemoOrientation : public DeviceOrientation
 {
     Q_OBJECT
 public:
     MaemoOrientation()
-        : DeviceOrientation(),m_current(Portrait), m_lastSeen(Portrait), m_lastSeenCount(0)
+        : o(UnknownOrientation)
     {
-        m_current = get();
-        if (m_current == UnknownOrientation) 
-            m_current = Portrait;
+        // enable the orientation sensor
+        QDBusConnection::systemBus().call(
+                QDBusMessage::createMethodCall(MCE_SERVICE, MCE_REQUEST_PATH,
+                                               MCE_REQUEST_IF, MCE_ACCELEROMETER_ENABLE_REQ));
+
+        // query the initial orientation
+        QDBusMessage reply = QDBusConnection::systemBus().call(
+                QDBusMessage::createMethodCall(MCE_SERVICE, MCE_REQUEST_PATH,
+                                               MCE_REQUEST_IF, MCE_DEVICE_ORIENTATION_GET));
+        if (reply.type() == QDBusMessage::ErrorMessage) {
+            qWarning("Unable to retrieve device orientation: %s", qPrintable(reply.errorMessage()));
+        } else {
+            o = toOrientation(reply.arguments().value(0).toString());
+        }
 
-        startTimer(100);
+        // connect to the orientation change signal
+        QDBusConnection::systemBus().connect(QString(), MCE_SIGNAL_PATH, MCE_SIGNAL_IF,
+                MCE_DEVICE_ORIENTATION_SIG,
+                this,
+                SLOT(deviceOrientationChanged(QString)));
     }
 
-    Orientation orientation() const {
-        return m_current;
+    ~MaemoOrientation()
+    {
+        // disable the orientation sensor
+        QDBusConnection::systemBus().call(
+                QDBusMessage::createMethodCall(MCE_SERVICE, MCE_REQUEST_PATH,
+                                               MCE_REQUEST_IF, MCE_ACCELEROMETER_DISABLE_REQ));
     }
 
-    void setOrientation(Orientation) { }
-
-protected:
-    virtual void timerEvent(QTimerEvent *)
+    inline Orientation orientation() const
     {
-        Orientation c = get();
-
-        if (c == m_lastSeen) {
-            m_lastSeenCount++;
-        } else {
-            m_lastSeenCount = 0;
-            m_lastSeen = c;
-        }
-
-        if (m_lastSeen != UnknownOrientation && m_lastSeen != m_current && m_lastSeenCount > 4) {
-            m_current = m_lastSeen;
-            emit orientationChanged();
-            printf("%d\n", m_current);
-        }
+        return o;
     }
 
-signals:
-    void changed();
-
-private:
-    Orientation m_current;
-    Orientation m_lastSeen;
-    int m_lastSeenCount;
-
-    Orientation get()
+    void setOrientation(Orientation o)
     {
-        Orientation o = UnknownOrientation;
-
-        int ax, ay, az;
-
-        read(&ax, &ay, &az);
+    }
 
-        if (abs(az) > 850) {
-            o = UnknownOrientation;
-        } else if (ax < -750) {
-            o = Portrait;
-        } else if (ax > 750) {
-            o = PortraitInverted;
-        } else if (ay < -750) {
-            o = Landscape;
-        } else if (ay > 750) {
-            o = LandscapeInverted;
-        }
+private Q_SLOTS:
+    void deviceOrientationChanged(const QString &newOrientation)
+    {
+        o = toOrientation(newOrientation);
 
-        return o;
+        emit orientationChanged();
+//        printf("%d\n", o);
     }
 
-    int read(int *ax,int *ay,int *az)
+private:
+    static Orientation toOrientation(const QString &nativeOrientation)
     {
-        static const char *accel_filename = "/sys/class/i2c-adapter/i2c-3/3-001d/coord";
-
-        FILE *fd;
-        int rs;
-        fd = fopen(accel_filename, "r");
-        if(fd==NULL){ printf("liqaccel, cannot open for reading\n"); return -1;}
-        rs=fscanf((FILE*) fd,"%i %i %i",ax,ay,az);
-        fclose(fd);
-        if(rs != 3){ printf("liqaccel, cannot read information\n"); return -2;}
-        return 0;
+        if (nativeOrientation == MCE_ORIENTATION_LANDSCAPE)
+            return Landscape;
+        else if (nativeOrientation == MCE_ORIENTATION_LANDSCAPE_INVERTED)
+            return LandscapeInverted;
+        else if (nativeOrientation == MCE_ORIENTATION_PORTRAIT)
+            return Portrait;
+        else if (nativeOrientation == MCE_ORIENTATION_PORTRAIT_INVERTED)
+            return PortraitInverted;
+        return UnknownOrientation;
     }
-};
 
+private:
+    Orientation o;
+};
 
 DeviceOrientation* DeviceOrientation::instance()
 {
-    static MaemoOrientation *o = 0;
-    if (!o)
-        o = new MaemoOrientation;
+    static MaemoOrientation *o = new MaemoOrientation;
     return o;
 }
 
diff --git a/tools/qml/main.cpp b/tools/qml/main.cpp
index 0cce1cc..a75023b 100644
--- a/tools/qml/main.cpp
+++ b/tools/qml/main.cpp
@@ -347,8 +347,9 @@ int main(int argc, char ** argv)
         wflags |= Qt::WindowStaysOnTopHint;
 
     QDeclarativeViewer *viewer = new QDeclarativeViewer(0, wflags);
+    viewer->setAttribute(Qt::WA_DeleteOnClose, true);
     if (!scriptopts.isEmpty()) {
-        QStringList options = 
+        QStringList options =
             scriptopts.split(QLatin1Char(','), QString::SkipEmptyParts);
 
         QDeclarativeViewer::ScriptOptions scriptOptions = 0;
@@ -451,7 +452,5 @@ int main(int argc, char ** argv)
     viewer->setUseGL(useGL);
     viewer->raise();
 
-    int rv = app.exec();
-    delete viewer;
-    exit(rv);
+    return app.exec();
 }
diff --git a/tools/qml/qml.pri b/tools/qml/qml.pri
index cff65be..58d8cc1 100644
--- a/tools/qml/qml.pri
+++ b/tools/qml/qml.pri
@@ -18,6 +18,7 @@ SOURCES += $$PWD/qmlruntime.cpp \
 
 RESOURCES = $$PWD/qmlruntime.qrc
 maemo5 {
+    QT += dbus
     SOURCES += $$PWD/deviceorientation_maemo.cpp
 } else {
     SOURCES += $$PWD/deviceorientation.cpp