Merge branch '4.6' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.6-integration

* '4.6' of scm.dev.nokia.troll.no:qt/oslo-staging-1:
  Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit/qtwebkit-4.6 ( c39615d8e78f083b23f34ac24cf7d3a7ce765122 )
  Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit/qtwebkit-4.6 ( bd724fb2f716336a8a4b54cd2edc96851a5a26a4 )

26 files changed, 481 insertions, 137 deletions

diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 9dac2f8..5bc2492 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        aa40cdb9595eb15a68e7be03322f973aa613a8f9
+        c39615d8e78f083b23f34ac24cf7d3a7ce765122
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 0a444bc..76374f3 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,197 @@
+2010-03-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed for the Qt 4.6 branch by Simon Hausmann.
+
+        Accept XHTML-MP content type as XHTML content
+        https://bugs.webkit.org/show_bug.cgi?id=34262
+
+        Enable processing XHTML-MP mime type as an XHTML document
+        even if XHTML-MP support is not enabled.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
+
+        Instead, keep one instance per RenderTheme around.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::findFrameLineWidth):
+
+2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
+        https://bugs.webkit.org/show_bug.cgi?id=34081
+
+        Defining StringImpl instances as globals will cause a crash on process exit as 
+        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
+        constructing one exiting thread.
+
+        * config.h:
+
+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
+
+        Test: fast/forms/misplaced-img-form-registration.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Tests: fast/forms/removed-image-as-property.html
+               fast/forms/reparented-image-as-property.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
+        to make observable changes to DOM.
+        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
+        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
+        which happens during parsing.
+        (WebCore::HTMLImageElement::removedFromTree): Ditto.
+
+        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
+        and insertedIntoDocument to private section, as they shouldn't be called directly.
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
+        handling misnested residual style tags
+
+        Test: fast/parser/residual-style-close-ref-clone.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
+        block stack a strong reference to the cloned residual style element. 
+
+2009-12-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7487164> First line of text cannot be selected
+        https://bugs.webkit.org/show_bug.cgi?id=32749
+
+        Test: fast/text/remove-zero-length-run.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
+            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
+            text boxes.
+        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
 2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 62a7f60a..003acbe 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -144,7 +144,9 @@
 #if PLATFORM(SYMBIAN)
 #undef WIN32
 #undef _WIN32
+#if COMPILER(WINSCW)
 #undef SKIP_STATIC_CONSTRUCTORS_ON_GCC
+#endif
 #define USE_SYSTEM_MALLOC 1
 #define U_HAVE_INT8_T 0
 #define U_HAVE_INT16_T 0
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 6024a5b..7750a80 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -3328,6 +3328,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3355,7 +3361,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 30d39e0..56f8ff4 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -91,7 +91,8 @@ void XMLTokenizer::pushCurrentNode(Node* n)
 
 void XMLTokenizer::popCurrentNode()
 {
-    ASSERT(m_currentNode);
+    if (!m_currentNode)
+        return;
     ASSERT(m_currentNodeStack.size());
 
     if (m_currentNode != m_doc)
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index a83e73a..3bd15c8 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -52,6 +52,23 @@ namespace WebCore {
     class PendingCallbacks;
     class ScriptElement;
 
+#if !USE(QXMLSTREAM)
+    class XMLParserContext : public RefCounted<XMLParserContext> {
+    public:
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        ~XMLParserContext();
+        xmlParserCtxtPtr context() const { return m_context; }
+
+    private:
+        XMLParserContext(xmlParserCtxtPtr context)
+            : m_context(context)
+        {
+        }
+        xmlParserCtxtPtr m_context;
+    };
+#endif
+
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
@@ -146,7 +163,8 @@ public:
         QXmlStreamReader m_stream;
         bool m_wroteText;
 #else
-        xmlParserCtxtPtr m_context;
+        xmlParserCtxtPtr context() const { return m_context ? m_context->context() : 0; };
+        RefPtr<XMLParserContext> m_context;
         OwnPtr<PendingCallbacks> m_pendingCallbacks;
         Vector<xmlChar> m_bufferedText;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 9aa0961..42c8b9b 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -465,7 +465,7 @@ static void errorFunc(void*, const char*, ...)
 
 static bool didInit = false;
 
-static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
+PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerPtr handlers, void* userData)
 {
     if (!didInit) {
         xmlInitParser();
@@ -482,12 +482,12 @@ static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* user
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
     xmlSwitchEncoding(parser, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
-    return parser;
+    return adoptRef(new XMLParserContext(parser));
 }
 
 
 // Chunk should be encoded in UTF-8
-static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -518,8 +518,8 @@ static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* user
     parser->str_xmlns = xmlDictLookup(parser->dict, BAD_CAST "xmlns", 5);
     parser->str_xml_ns = xmlDictLookup(parser->dict, XML_XML_NAMESPACE, 36);
     parser->_private = userData;
-
-    return parser;
+    
+    return adoptRef(new XMLParserContext(parser));
 }
 
 // --------------------------------
@@ -609,6 +609,13 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         m_defaultNamespaceURI = parentElement->namespaceURI();
 }
 
+XMLParserContext::~XMLParserContext()
+{
+    if (m_context->myDoc)
+        xmlFreeDoc(m_context->myDoc);
+    xmlFreeParserCtxt(m_context);
+}
+
 XMLTokenizer::~XMLTokenizer()
 {
     clearCurrentNodeStack();
@@ -616,15 +623,16 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-    if (m_context)
-        xmlFreeParserCtxt(m_context);
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
 {
     if (!m_context)
         initializeParserContext();
-    
+
+    // Protect the libxml context from deletion during a callback
+    RefPtr<XMLParserContext> context = m_context;
+
     // libXML throws an error if you try to switch the encoding for an empty string.
     if (parseString.length()) {
         // Hack around libxml2's lack of encoding overide support by manually
@@ -633,15 +641,15 @@ void XMLTokenizer::doWrite(const String& parseString)
         // and switch encodings, causing the parse to fail.
         const UChar BOM = 0xFEFF;
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-        xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
+        xmlSwitchEncoding(context->context(), BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
         XMLTokenizerScope scope(m_doc->docLoader());
-        xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
+        xmlParseChunk(context->context(), reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
     if (m_doc->decoder() && m_doc->decoder()->sawError()) {
         // If the decoder saw an error, report it as fatal (stops parsing)
-        handleError(fatal, "Encoding error", lineNumber(), columnNumber());
+        handleError(fatal, "Encoding error", context->context()->input->line, context->context()->input->col);
     }
 
     return;
@@ -1277,9 +1285,9 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 
     XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
-        m_context = createMemoryParser(&sax, this, chunk);
+        m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else
-        m_context = createStringParser(&sax, this);
+        m_context = XMLParserContext::createStringParser(&sax, this);
 }
 
 void XMLTokenizer::doEnd()
@@ -1300,12 +1308,9 @@ void XMLTokenizer::doEnd()
         // Tell libxml we're done.
         {
             XMLTokenizerScope scope(m_doc->docLoader());
-            xmlParseChunk(m_context, 0, 0, 1);
+            xmlParseChunk(context(), 0, 0, 1);
         }
 
-        if (m_context->myDoc)
-            xmlFreeDoc(m_context->myDoc);
-        xmlFreeParserCtxt(m_context);
         m_context = 0;
     }
 }
@@ -1334,18 +1339,19 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
 
 int XMLTokenizer::lineNumber() const
 {
-    return m_context ? m_context->input->line : 1;
+    return context() ? context()->input->line : 1;
 }
 
 int XMLTokenizer::columnNumber() const
 {
-    return m_context ? m_context->input->col : 1;
+    return context() ? context()->input->col : 1;
 }
 
 void XMLTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    xmlStopParser(m_context);
+    if (context())
+        xmlStopParser(context());
 }
 
 void XMLTokenizer::resumeParsing()
@@ -1384,17 +1390,17 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
 
-    xmlParseContent(tokenizer.m_context);
+    xmlParseContent(tokenizer.context());
 
     tokenizer.endDocument();
 
     // Check if all the chunk has been processed.
-    long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
+    long bytesProcessed = xmlByteConsumed(tokenizer.context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
-    return tokenizer.m_context->wellFormed || xmlCtxtGetLastError(tokenizer.m_context) == 0;
+    return tokenizer.context()->wellFormed || xmlCtxtGetLastError(tokenizer.context()) == 0;
 }
 
 // --------------------------------
@@ -1437,12 +1443,9 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     memset(&sax, 0, sizeof(sax));
     sax.startElementNs = attributesStartElementNsHandler;
     sax.initialized = XML_SAX2_MAGIC;
-    xmlParserCtxtPtr parser = createStringParser(&sax, &state);
+    RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
-    xmlParseChunk(parser, reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
-    if (parser->myDoc)
-        xmlFreeDoc(parser->myDoc);
-    xmlFreeParserCtxt(parser);
+    xmlParseChunk(parser->context(), reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index ace0f2f..a74ff83 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -515,11 +515,13 @@ bool HTMLFormElement::isURLAttribute(Attribute* attr) const
 
 void HTMLFormElement::registerImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) == notFound);
     imgElements.append(e);
 }
 
 void HTMLFormElement::removeImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) != notFound);
     removeFromVector(imgElements, e);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index d353073..3db6811 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -209,6 +209,30 @@ void HTMLImageElement::removedFromDocument()
     HTMLElement::removedFromDocument();
 }
 
+void HTMLImageElement::insertedIntoTree(bool deep)
+{
+    if (!m_form) {
+        // m_form can be non-null if it was set in constructor.
+        for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
+            if (ancestor->hasTagName(formTag)) {
+                m_form = static_cast<HTMLFormElement*>(ancestor);
+                m_form->registerImgElement(this);
+                break;
+            }
+        }
+    }
+
+    HTMLElement::insertedIntoTree(deep);
+}
+
+void HTMLImageElement::removedFromTree(bool deep)
+{
+    if (m_form)
+        m_form->removeImgElement(this);
+    m_form = 0;
+    HTMLElement::removedFromTree(deep);
+}
+
 int HTMLImageElement::width(bool ignorePendingStylesheets) const
 {
     if (!renderer()) {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
index f58574d..14e5fa3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
@@ -45,8 +45,6 @@ public:
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
 
     virtual bool canStartSelection() const { return false; }
 
@@ -105,6 +103,11 @@ public:
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
 private:
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void insertedIntoTree(bool deep);
+    virtual void removedFromTree(bool deep);
+
     HTMLImageLoader m_imageLoader;
     String usemap;
     bool ismap;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index f25c908..652bc40 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -701,12 +701,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             m_autocomplete = Off;
             registerForActivationCallbackIfNeeded();
         } else {
-            if (m_autocomplete == Off)
-                unregisterForActivationCallbackIfNeeded();
+            bool needsToUnregister = m_autocomplete == Off;
+
             if (attr->isEmpty())
                 m_autocomplete = Uninitialized;
             else
                 m_autocomplete = On;
+
+            if (needsToUnregister)
+                unregisterForActivationCallbackIfNeeded();
         }
     } else if (attr->name() == typeAttr) {
         setInputType(attr->value());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 1cb47ae..99c66de 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -1275,7 +1275,8 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
             prevMaxElem->next = elem;
             ASSERT(newNodePtr);
             prevMaxElem->node = newNodePtr;
-            prevMaxElem->didRefNode = false;
+            newNodePtr->ref();
+            prevMaxElem->didRefNode = true;
         } else
             delete elem;
     }
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index a85dcf5..7d857d4 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -1260,9 +1260,11 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
 
     ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
     HTMLPlugInElement* element = static_cast<HTMLPlugInElement*>(renderer->node());
-    
-    // FIXME: OK to always make a new frame? When does the old frame get removed?
-    return loadSubframe(element, completedURL, frameName, m_outgoingReferrer);
+
+    // If the plug-in element already contains a subframe, requestFrame will re-use it. Otherwise,
+    // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
+    // in the widget to be torn down.
+    return requestFrame(element, completedURL, frameName);
 }
 
 bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
index 609a1b0..758863c 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
@@ -200,9 +200,7 @@ static void initializeSupportedNonImageMimeTypes()
         "text/",
         "application/xml",
         "application/xhtml+xml",
-#if ENABLE(XHTMLMP)
         "application/vnd.wap.xhtml+xml",
-#endif
         "application/rss+xml",
         "application/atom+xml",
 #if ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index 37a6408..298d840 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -126,6 +126,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 RenderThemeQt::RenderThemeQt(Page* page)
     : RenderTheme()
     , m_page(page)
+    , m_lineEdit(0)
 {
     QPushButton button;
     button.setAttribute(Qt::WA_MacSmallSize);
@@ -142,6 +143,7 @@ RenderThemeQt::RenderThemeQt(Page* page)
 RenderThemeQt::~RenderThemeQt()
 {
     delete m_fallbackStyle;
+    delete m_lineEdit;
 }
 
 // for some widget painting, we need to fallback to Windows style
@@ -207,11 +209,13 @@ bool RenderThemeQt::supportsControlTints() const
     return true;
 }
 
-static int findFrameLineWidth(QStyle* style)
+int RenderThemeQt::findFrameLineWidth(QStyle* style) const
 {
-    QLineEdit lineEdit;
+    if (!m_lineEdit)
+        m_lineEdit = new QLineEdit();
+
     QStyleOptionFrameV2 opt;
-    return style->pixelMetric(QStyle::PM_DefaultFrameWidth, &opt, &lineEdit);
+    return style->pixelMetric(QStyle::PM_DefaultFrameWidth, &opt, m_lineEdit);
 }
 
 static QRect inflateButtonRect(const QRect& originalRect, QStyle* style)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
index 13fb42f..64921b1 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
@@ -27,6 +27,7 @@
 #include <QStyle>
 
 QT_BEGIN_NAMESPACE
+class QLineEdit;
 class QPainter;
 class QWidget;
 QT_END_NAMESPACE
@@ -140,6 +141,8 @@ private:
     void setButtonPadding(RenderStyle*) const;
     void setPopupPadding(RenderStyle*) const;
 
+    int findFrameLineWidth(QStyle* style) const;
+
     QStyle* fallbackStyle() const;
 
     Page* m_page;
@@ -150,6 +153,7 @@ private:
     QString m_buttonFontFamily;
 
     QStyle* m_fallbackStyle;
+    mutable QLineEdit* m_lineEdit;
 };
 
 class StylePainter {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index 40c3d75..88a05e5 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -1047,8 +1047,15 @@ void RenderText::positionLineBox(InlineBox* box)
     if (!s->len()) {
         // We want the box to be destroyed.
         s->remove();
+        if (m_firstTextBox == s)
+            m_firstTextBox = s->nextTextBox();
+        else
+            s->prevTextBox()->setNextLineBox(s->nextTextBox());
+        if (m_lastTextBox == s)
+            m_lastTextBox = s->prevTextBox();
+        else
+            s->nextTextBox()->setPreviousLineBox(s->prevTextBox());
         s->destroy(renderArena());
-        m_firstTextBox = m_lastTextBox = 0;
         return;
     }
 
@@ -1349,7 +1356,7 @@ void RenderText::checkConsistency() const
 #ifdef CHECK_CONSISTENCY
     const InlineTextBox* prev = 0;
     for (const InlineTextBox* child = m_firstTextBox; child != 0; child = child->nextTextBox()) {
-        ASSERT(child->object() == this);
+        ASSERT(child->renderer() == this);
         ASSERT(child->prevTextBox() == prev);
         prev = child;
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index a80c5d3..490ada1 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -65,6 +65,7 @@ public:
     void _q_doLoadFinished(bool success);
 
     void _q_updateMicroFocus();
+    void _q_pageDestroyed();
 
     QGraphicsWebView* q;
     QWebPage* page;
@@ -97,6 +98,12 @@ void QGraphicsWebViewPrivate::_q_updateMicroFocus()
 #endif
 }
 
+void QGraphicsWebViewPrivate::_q_pageDestroyed()
+{
+    page = 0;
+    q->setPage(0);
+}
+
 void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
 {
     q->scroll(qreal(dx), qreal(dy), QRectF(rectToScroll));
@@ -454,6 +461,8 @@ void QGraphicsWebView::setPage(QWebPage* page)
             this, SIGNAL(linkClicked(QUrl)));
     connect(d->page, SIGNAL(microFocusChanged()),
             this, SLOT(_q_updateMicroFocus()));
+    connect(d->page, SIGNAL(destroyed()),
+            this, SLOT(_q_pageDestroyed()));
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index f983ae4..1b02f35 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -135,6 +135,7 @@ protected:
 private:
     Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
     Q_PRIVATE_SLOT(d, void _q_updateMicroFocus())
+    Q_PRIVATE_SLOT(d, void _q_pageDestroyed())
 
     QGraphicsWebViewPrivate* const d;
     friend class QGraphicsWebViewPrivate;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index e4c2afc..710e11b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -324,15 +324,12 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     }
 }
 
-static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy)
+static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy, const QPoint& pos)
 {
     if (!frame || !frame->document() || !frame->eventHandler())
         return false;
 
-    Node* node = frame->document()->focusedNode();
-    if (!node)
-        node = frame->document()->elementFromPoint(frame->eventHandler()->currentMousePosition().x(),
-                                                   frame->eventHandler()->currentMousePosition().y());
+    Node* node = frame->document()->elementFromPoint(pos.x(), pos.y());
     if (!node)
         return false;
 
@@ -363,6 +360,10 @@ static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy)
     return (scrolledHorizontal || scrolledVertical);
 }
 
+
+
+
+
 /*!
     \class QWebFrame
     \since 4.4
@@ -1047,27 +1048,24 @@ void QWebFrame::scroll(int dx, int dy)
 }
 
 /*!
-  \since 4.7
   \internal
   Scrolls nested frames starting at this frame, \a dx pixels to the right 
   and \a dy pixels downward. Both \a dx and \a dy may be negative. First attempts
-  to scroll elements with CSS overflow followed by this frame. If this 
+  to scroll elements with CSS overflow at position pos, followed by this frame. If this 
   frame doesn't scroll, attempts to scroll the parent
-
-  \sa QWebFrame::scroll
 */
-bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy)
+void QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy, const QPoint& pos)
 {
     Frame* frame = QWebFramePrivate::core(qFrame);
-    bool scrolledHorizontal = false;
-    bool scrolledVertical = false;
-    bool scrolledOverflow = webframe_scrollOverflow(frame, dx, dy);
-
-    if (!scrolledOverflow) {
-        if (!frame || !frame->view())
-            return false;
 
+    if (!frame || !frame->view())
+        return;
+    
+    if (!webframe_scrollOverflow(frame, dx, dy, pos)) {
         do {
+            bool scrolledHorizontal = false;
+            bool scrolledVertical = false;
+            
             IntSize scrollOffset = frame->view()->scrollOffset();
             IntPoint maxScrollOffset = frame->view()->maximumScrollPosition();
 
@@ -1083,12 +1081,12 @@ bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int d
 
             if (scrolledHorizontal || scrolledVertical) {
                 frame->view()->scrollBy(IntSize(dx, dy));
-                return true;
+                return;
             }
+            
             frame = frame->tree()->parent(); 
         } while (frame && frame->view());
     }
-    return (scrolledHorizontal || scrolledVertical || scrolledOverflow);
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index a289ec0..97a4e4e 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -1248,8 +1248,8 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
 #if QT_VERSION >= 0x040600
         case QInputMethodEvent::Selection: {
             if (renderTextControl) {
-                renderTextControl->setSelectionStart(a.start);
-                renderTextControl->setSelectionEnd(a.start + a.length);
+                renderTextControl->setSelectionStart(qMin(a.start, (a.start + a.length)));
+                renderTextControl->setSelectionEnd(qMax(a.start, (a.start + a.length)));
             }
             break;
         }
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index a5441cd..64726c2 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,87 @@
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
+
+        Add a simple benchmark covering this area.
+
+        * tests/benchmarks/painting/tst_painting.cpp:
+        (tst_Painting::textAreas):
+
+2010-03-22  Yi Shen  <shenyi2006@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35933  
+        [Qt] [Symbian] Can not backward select (highlight) text using virtual keyboard
+        Make sure the selection start index is smaller than the selection end index.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2010-03-25  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher crashes on Mac OS and Linux when exiting with QGraphicsView mode enabled
+        https://bugs.webkit.org/show_bug.cgi?id=35251
+
+        Followed the way QWebView registers for the signal QWebPage::destroyed(), to prevent
+        QGraphicsWebView from referencing QWebPage after it was deleted.        
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_pageDestroyed):
+        (QGraphicsWebView::setPage):
+        * Api/qgraphicswebview.h:
+
+2010-03-23  David Leong  <david.leong@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Build fix for Symbian Def file.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-18  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] New API scrollRecursively has several problems.
+        https://bugs.webkit.org/show_bug.cgi?id=35873
+
+        Remove scrollRecursively from the Qt 4.7 API
+        Update the internal API to accept a hit test position 
+        for nested scrolling
+
+        * Api/qwebframe.cpp:
+        (webframe_scrollOverflow):
+        (qtwebkit_webframe_scrollRecursively):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-12-18  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add new API to QWebFrame to scrollRecursively starting with any css overflow 
+        then checking current frame and then ancestors
+        https://bugs.webkit.org/show_bug.cgi?id=32668
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::scrollOverflow):
+        (QWebFrame::scrollRecursively):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/qwebframe.qrc:
+        * tests/qwebframe/testiframe.html: Added.
+        * tests/qwebframe/testiframe2.html: Added.
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2010-03-21  Kristian Amlie  <kristian.amlie@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
index 5dd2e20..cfa8f7f 100644
--- a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -693,5 +693,5 @@ EXPORTS
 	_Z23qt_networkAccessAllowedb @ 692 NONAME
 	_Z25qt_resumeActiveDOMObjectsP9QWebFrame @ 693 NONAME
 	_Z26qt_suspendActiveDOMObjectsP9QWebFrame @ 694 NONAME
-	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameii @ 695 NONAME
-
+	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameii @ 695 NONAME ABSENT
+	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameiiRK6QPoint @ 715 NONAME
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
index f4531fd..fc5b8e3 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
@@ -19,6 +19,7 @@
 
 #include <QtTest/QtTest>
 
+#include <qwebelement.h>
 #include <qwebframe.h>
 #include <qwebview.h>
 #include <qpainter.h>
@@ -59,6 +60,7 @@ public Q_SLOTS:
 private Q_SLOTS:
     void paint_data();
     void paint();
+    void textAreas();
 
 private:
     QWebView* m_view;
@@ -105,5 +107,30 @@ void tst_Painting::paint()
     }
 }
 
+void tst_Painting::textAreas()
+{
+    m_view->load(QUrl("data:text/html;<html><body></body></html>"));
+    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)));
+
+    QWebElement bodyElement = m_page->mainFrame()->findFirstElement("body");
+
+    int count = 100;
+    while (count--) {
+        QString markup("<textarea cols='1' rows='1'></textarea>");
+        bodyElement.appendInside(markup);
+    }
+
+    /* force a layout */
+    QWebFrame* mainFrame = m_page->mainFrame();
+    mainFrame->toPlainText();
+
+    QPixmap pixmap(mainFrame->contentsSize());
+    QBENCHMARK {
+        QPainter painter(&pixmap);
+        mainFrame->render(&painter, QRect(QPoint(0, 0), mainFrame->contentsSize()));
+        painter.end();
+    }
+}
+
 QTEST_MAIN(tst_Painting)
 #include "tst_painting.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 609f8b4..8cc7953 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -606,7 +606,6 @@ private slots:
     void scrollPosition();
     void evaluateWillCauseRepaint();
     void qObjectWrapperWithSameIdentity();
-    void scrollRecursively();
 
 private:
     QString  evalJS(const QString&s) {
@@ -2825,71 +2824,5 @@ void tst_QWebFrame::qObjectWrapperWithSameIdentity()
     QCOMPARE(mainFrame->toPlainText(), QString("test2"));
 }
 
-bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy);
-
-void tst_QWebFrame::scrollRecursively()
-{
-    // The test content is 
-    // a nested frame set
-    // The main frame scrolls
-    // and has two children
-    // an iframe and a div overflow
-    // both scroll
-    QWebView webView;
-    QWebPage* webPage = webView.page();
-    QSignalSpy loadSpy(webPage, SIGNAL(loadFinished(bool)));
-    QUrl url = QUrl("qrc:///testiframe.html");
-    webPage->mainFrame()->load(url);
-    QTRY_COMPARE(loadSpy.count(), 1);
-
-    QList<QWebFrame*> children =  webPage->mainFrame()->childFrames();
-    QVERIFY(children.count() == 1);
-
-    // 1st test
-    // call scrollRecursively over mainframe
-    // verify scrolled
-    // verify scroll postion changed
-    QPoint scrollPosition(webPage->mainFrame()->scrollPosition());
-    QVERIFY(qtwebkit_webframe_scrollRecursively(webPage->mainFrame(), 10, 10));
-    QVERIFY(scrollPosition != webPage->mainFrame()->scrollPosition());
-
-    // 2nd test
-    // call scrollRecursively over child iframe
-    // verify scrolled
-    // verify child scroll position changed
-    // verify parent's scroll position did not change
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    QPoint childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), 10, 10));
-    QVERIFY(scrollPosition == webPage->mainFrame()->scrollPosition());
-    QVERIFY(childScrollPosition != children.at(0)->scrollPosition());
-
-    // 3rd test
-    // call scrollRecursively over div overflow
-    // verify scrolled == true
-    // verify parent and child frame's scroll postion did not change
-    QWebElement div = webPage->mainFrame()->documentElement().findFirst("#content1");
-    QMouseEvent evpres(QEvent::MouseMove, div.geometry().center(), Qt::NoButton, Qt::NoButton, Qt::NoModifier);
-    webPage->event(&evpres);
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(webPage->mainFrame(), 5, 5));
-    QVERIFY(childScrollPosition == children.at(0)->scrollPosition());
-    QVERIFY(scrollPosition == webPage->mainFrame()->scrollPosition());
-
-    // 4th test
-    // call scrollRecursively twice over childs iframe
-    // verify scrolled == true first time
-    // verify parent's scroll == true second time
-    // verify parent and childs scroll position changed
-    childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), -10, -10));
-    QVERIFY(childScrollPosition != children.at(0)->scrollPosition());
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), -10, -10));
-    QVERIFY(scrollPosition != webPage->mainFrame()->scrollPosition());
-
-}
-
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 0e04acc..55ee42a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1451,6 +1451,26 @@ void tst_QWebPage::inputMethods()
     variant = page->inputMethodQuery(Qt::ImCurrentSelection);
     QString selectionValue = variant.value<QString>();
     QCOMPARE(selectionValue, QString("eb"));
+
+    //Set selection with negative length
+    inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 6, -5, QVariant());
+    QInputMethodEvent eventSelection2("",inputAttributes);
+    page->event(&eventSelection2);
+
+    //ImAnchorPosition
+    variant = page->inputMethodQuery(Qt::ImAnchorPosition);
+    anchorPosition =  variant.toInt();
+    QCOMPARE(anchorPosition, 1);
+
+    //ImCursorPosition
+    variant = page->inputMethodQuery(Qt::ImCursorPosition);
+    cursorPosition =  variant.toInt();
+    QCOMPARE(cursorPosition, 6);
+
+    //ImCurrentSelection
+    variant = page->inputMethodQuery(Qt::ImCurrentSelection);
+    selectionValue = variant.value<QString>();
+    QCOMPARE(selectionValue, QString("tWebK"));
 #endif
 
     //ImSurroundingText