Merge remote-tracking branch 'qt-air-review/master'

26 files changed, 364 insertions, 77 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index 8f212e7..458898a 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-fb3b4700aa5abbb2db471b4f0eb7946ce4850cc4
+a2bd2bb1b19949c6807da38e25bfa7d210bb4b17
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 5f97e57..bc11b4d 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,26 +1,3 @@
-2011-08-26  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
-
-        [Qt] libwebcore.a source is compiled without -fvisibility=hidden
-        -fvisibility-inlines-hidden
-        https://bugs.webkit.org/show_bug.cgi?id=65470
-
-        Patch by Holger Freyther <zecke@selfish.org>
-        Rubberstamped by Andreas Kling.
-
-        (qtwebkit-2.2 only by now)
-
-        WTF_USE_EXPORT_MACROS is still not enabled on trunk because there are
-        pending issues with WebKit2, but it appears to be safe to enable this
-        on QtWebKit, so this change is being added to the qtwebkit-2.2 branch.
-
-        The patch also adds CONFIG += hide_symbols and on Unix, +=
-        bsymbolic_functions, which should help reduce the library binary size.
-
-        Testing this is quite easy, so if there's any problem we'll soon
-        know. :-)
-
-        * Source/WebKit.pri:
-
 2011-08-06  Aron Rosenberg  <arosenberg@logitech.com>
 
         Reviewed by Benjamin Poulain.
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
index 6b074b2..5aec2e3 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
@@ -34,29 +34,6 @@
 
         * wtf/Platform.h:
 
-2011-08-26  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
-
-        [Qt] libwebcore.a source is compiled without -fvisibility=hidden
-        -fvisibility-inlines-hidden
-        https://bugs.webkit.org/show_bug.cgi?id=65470
-
-        Patch by Holger Freyther <zecke@selfish.org>
-        Rubberstamped by Andreas Kling.
-
-        (qtwebkit-2.2 only by now)
-
-        WTF_USE_EXPORT_MACROS is still not enabled on trunk because there are
-        pending issues with WebKit2, but it appears to be safe to enable this
-        on QtWebKit, so this change is being added to the qtwebkit-2.2 branch.
-
-        The patch also adds CONFIG += hide_symbols and on Unix, +=
-        bsymbolic_functions, which should help reduce the library binary size.
-
-        Testing this is quite easy, so if there's any problem we'll soon
-        know. :-)
-
-        * wtf/Platform.h:
-
 2011-07-08  Chang Shu  <cshu@webkit.org>
 
         Rename "makeSecure" to "fill" and remove the support for displaying last character
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
index be0a451..a8298c4 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
@@ -1221,11 +1221,7 @@
    since most ports try to support sub-project independence, adding new headers
    to WTF causes many ports to break, and so this way we can address the build
    breakages one port at a time. */
-#if PLATFORM(QT)
-#define WTF_USE_EXPORT_MACROS 1
-#else
 #define WTF_USE_EXPORT_MACROS 0
-#endif
 
 #if PLATFORM(QT) || PLATFORM(GTK)
 #define WTF_USE_UNIX_DOMAIN_SOCKETS 1
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index ee257a7..a781b1f 100644
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,147 @@
+2011-08-30  Abhishek Arya  <inferno@chromium.org>
+
+        Removed m_owner accessed in custom scrollbars.
+        https://bugs.webkit.org/show_bug.cgi?id=64737
+
+        Reviewed by David Hyatt.
+
+        Problem does not reproduce in DRT, even with Eventhandler tricks
+        and gc(). So, adding a manual test.
+
+        * manual-tests/custom-scrollbar-renderer-removed-crash.html: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::clearOwningRendererForCustomScrollbars):
+        * page/FrameView.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed): when this renderbox is getting
+        destroyed, clear the custom scrollbar in this frameview having this renderbox
+        as its owning renderer.
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle): fix the null check.
+
+2011-09-04  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Range::processAncestorsAndTheirSiblings.
+        https://bugs.webkit.org/show_bug.cgi?id=67556
+
+        Reviewed by Ryosuke Niwa.
+
+        Create a temporary RefPtr Node vector to keep all the ancestor's
+        childs so that we don't access removed child nodes.
+
+        Test: fast/dom/Range/range-delete-contents-event-fire-crash.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        (WebCore::Range::processAncestorsAndTheirSiblings):
+
+2011-08-30  Adam Barth  <abarth@webkit.org>
+
+        Flaky crash with JavaScript URLs
+        https://bugs.webkit.org/show_bug.cgi?id=66360
+
+        Reviewed by Nate Chapin.
+
+        This patch teaches DocumentWriter::begin to make a copy of the URL
+        before beginning a new document to avoid a crash.
+
+        Test: fast/loader/javascript-url-iframe-crash.html
+
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::begin):
+
+2011-08-30  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Emit last progress notification before calling dispatchDidFinishLoad
+        https://bugs.webkit.org/show_bug.cgi?id=28851
+
+        Reviewed by Adam Barth.
+
+        Original patch by Xan Lopez. Change FrameLoader to dispatch the notifications in
+        a more natural sequence.
+
+        Test: http/tests/loading/progress-finished-callback.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2011-08-22  Nate Chapin  <japhet@chromium.org>
+
+        Unload events can crash us when they blank out
+        a parent frame.
+        https://bugs.webkit.org/show_bug.cgi?id=64741
+
+        Reviewed by Adam Barth.
+
+        Test: fast/loader/document-destruction-within-unload.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Prevent unload events
+            from going into infinite recursion.
+        (WebCore::FrameLoader::setDocumentLoader): Ensure we don't
+            let set m_documentLoader to a DocumentLoader with a null Frame*.
+        (WebCore::FrameLoader::detachChildren): Save off a vector of
+            children to detach, rather than doing it inline.
+
+2011-08-30  Abhishek Arya  <inferno@chromium.org>
+
+        Style not updated for table parts in :before, :after content.
+        https://bugs.webkit.org/show_bug.cgi?id=66141        
+
+        Reviewed by Dave Hyatt.
+
+        Tests: fast/table/table-before-child-style-update.html
+               fast/table/table-row-before-child-style-update.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2011-08-25  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect layout of :before and :after content, with display
+        table, table-row and table-cell.
+        https://bugs.webkit.org/show_bug.cgi?id=66699
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/table/table-after-child-in-table.html
+               fast/table/table-before-child-in-table.html
+               fast/table/table-cell-after-child-in-block.html
+               fast/table/table-cell-after-child-in-table.html
+               fast/table/table-cell-before-child-in-block.html
+               fast/table/table-cell-before-child-in-table.html
+               fast/table/table-row-after-child-in-block.html
+               fast/table/table-row-after-child-in-table.html
+               fast/table/table-row-before-child-in-block.html
+               fast/table/table-row-before-child-in-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        Fix the looping condition to detect :after child correctly.
+        isAnonymousBlock() does not apply to tables, instead
+        using isAnonymous().
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild): Don't add the new child
+        in the generatedContainer with :before, :after content.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): Don't add the new child
+        in the generatedContainer with :before, :after content.
+
+2011-08-29  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in InlineBox::deleteLine due to accessing removed
+        renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=66015
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/block/line-layout/inline-box-wrapper-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionLineBox): Make sure that the
+        previous inline box wrapper is destroyed properly, before
+        setting a new one.
+
 2011-08-30  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
         [Qt] Do not unconditionally use pkg-config in .pro files
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp b/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
index 0c247c2..4f8ad85 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
@@ -51,6 +51,8 @@ using namespace std;
 static WTF::RefCountedLeakCounter rangeCounter("Range");
 #endif
 
+typedef Vector<RefPtr<Node> > NodeVector;
+
 inline Range::Range(PassRefPtr<Document> ownerDocument)
     : m_ownerDocument(ownerDocument)
     , m_start(m_ownerDocument)
@@ -665,8 +667,6 @@ static inline unsigned lengthOfContentsInNode(Node* node)
 
 PassRefPtr<DocumentFragment> Range::processContents(ActionType action, ExceptionCode& ec)
 {
-    typedef Vector<RefPtr<Node> > NodeVector;
-
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
         fragment = DocumentFragment::create(m_ownerDocument.get());
@@ -880,9 +880,14 @@ PassRefPtr<Node> Range::processAncestorsAndTheirSiblings(ActionType action, Node
         // FIXME: This assertion may fail if DOM is modified during mutation event
         // FIXME: Share code with Range::processNodes
         ASSERT(!firstChildInAncestorToProcess || firstChildInAncestorToProcess->parentNode() == ancestor);
-        RefPtr<Node> next;
-        for (Node* child = firstChildInAncestorToProcess.get(); child; child = next.get()) {
-            next = direction == ProcessContentsForward ? child->nextSibling() : child->previousSibling();
+        
+        NodeVector nodes;
+        for (Node* child = firstChildInAncestorToProcess.get(); child;
+            child = (direction == ProcessContentsForward) ? child->nextSibling() : child->previousSibling())
+            nodes.append(child);
+
+        for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) {
+            Node* child = it->get();
             switch (action) {
             case DELETE_CONTENTS:
                 ancestor->removeChild(child, ec);
diff --git a/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp b/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
index 2fc02d1..cbce0d3 100644
--- a/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
@@ -106,12 +106,17 @@ PassRefPtr<Document> DocumentWriter::createDocument(const KURL& url)
     return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
 }
 
-void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOrigin* origin)
 {
     // We need to take a reference to the security origin because |clear|
     // might destroy the document that owns it.
     RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
 
+    // We grab a local copy of the URL because it's easy for callers to supply
+    // a URL that will be deallocated during the execution of this function.
+    // For example, see <https://bugs.webkit.org/show_bug.cgi?id=66360>.
+    KURL url = urlReference;
+
     // Create a new document before clearing the frame, because it may need to
     // inherit an aliased security context.
     RefPtr<Document> document = createDocument(url);
diff --git a/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
index 1b046b3..4bef249 100644
--- a/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
@@ -1880,6 +1880,20 @@ void FrameLoader::setDocumentLoader(DocumentLoader* loader)
         m_documentLoader->detachFromFrame();
 
     m_documentLoader = loader;
+
+    // The following abomination is brought to you by the unload event.
+    // The detachChildren() call above may trigger a child frame's unload event,
+    // which could do something obnoxious like call document.write("") on
+    // the main frame, which results in detaching children while detaching children.
+    // This can cause the new m_documentLoader to be detached from its Frame*, but still
+    // be alive. To make matters worse, DocumentLoaders with a null Frame* aren't supposed
+    // to happen when they're still alive (and many places below us on the stack think the
+    // DocumentLoader is still usable). Ergo, we reattach loader to its Frame, and pretend
+    // like nothing ever happened.
+    if (m_documentLoader && !m_documentLoader->frame()) {
+        ASSERT(!m_documentLoader->isLoading());
+        m_documentLoader->setFrame(m_frame);
+    }
 }
 
 void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
@@ -2506,14 +2520,15 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             if (m_stateMachine.creatingInitialEmptyDocument() || !m_stateMachine.committedFirstRealDocumentLoad())
                 return;
 
+            if (Page* page = m_frame->page())
+                page->progress()->progressCompleted(m_frame);
+
             const ResourceError& error = dl->mainDocumentError();
             if (!error.isNull())
                 m_client->dispatchDidFailLoad(error);
             else
                 m_client->dispatchDidFinishLoad();
 
-            if (Page* page = m_frame->page())
-                page->progress()->progressCompleted(m_frame);
             return;
         }
         
@@ -2589,12 +2604,14 @@ void FrameLoader::frameLoadCompleted()
 
 void FrameLoader::detachChildren()
 {
-    // FIXME: Is it really necessary to do this in reverse order?
-    Frame* previous;
-    for (Frame* child = m_frame->tree()->lastChild(); child; child = previous) {
-        previous = child->tree()->previousSibling();
-        child->loader()->detachFromParent();
-    }
+    typedef Vector<RefPtr<Frame> > FrameVector;
+    FrameVector childrenToDetach;
+    childrenToDetach.reserveCapacity(m_frame->tree()->childCount());
+    for (Frame* child = m_frame->tree()->lastChild(); child; child = child->tree()->previousSibling())
+        childrenToDetach.append(child);
+    FrameVector::iterator end = childrenToDetach.end();
+    for (FrameVector::iterator it = childrenToDetach.begin(); it != end; it++)
+        (*it)->loader()->detachFromParent();
 }
 
 void FrameLoader::closeAndRemoveChild(Frame* child)
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
index 3dadbf3..ef72fb7 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
@@ -2277,6 +2277,23 @@ bool FrameView::hasCustomScrollbars() const
     return false;
 }
 
+void FrameView::clearOwningRendererForCustomScrollbars(RenderBox* box)
+{
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = current->get();
+        if (widget->isScrollbar()) {
+            Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
+            if (scrollbar->isCustomScrollbar()) {
+                RenderScrollbar* customScrollbar = toRenderScrollbar(scrollbar);
+                if (customScrollbar->owningRenderer() == box)
+                    customScrollbar->clearOwningRenderer();
+            }
+        }
+    }
+}
+
 FrameView* FrameView::parentFrameView() const
 {
     if (Widget* parentView = parent()) {
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FrameView.h b/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
index fafebfe..b151cfc 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
@@ -267,6 +267,8 @@ public:
 
     virtual bool shouldSuspendScrollAnimations() const;
 
+    void clearOwningRendererForCustomScrollbars(RenderBox*);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
index 39c0469..df30adb 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
@@ -665,10 +665,10 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     // Make sure we don't append things after :after-generated content if we have it.
     if (!beforeChild) {
         RenderObject* lastRenderer = lastChild();
-        if (isAfterContent(lastRenderer))
+        while (lastRenderer && lastRenderer->isAnonymous() && !isAfterContent(lastRenderer))
+            lastRenderer = lastRenderer->lastChild();
+        if (lastRenderer && isAfterContent(lastRenderer))
             beforeChild = lastRenderer;
-        else if (lastRenderer && lastRenderer->isAnonymousBlock() && isAfterContent(lastRenderer->lastChild()))
-            beforeChild = lastRenderer->lastChild();
     }
 
     // If the requested beforeChild is not one of our children, then this is because
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
index 9c2aa48..f052ee7 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
@@ -204,6 +204,11 @@ void RenderBox::destroy()
     if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    // If this renderer is owning renderer for the frameview's custom scrollbars,
+    // we need to clear it from the scrollbar. See webkit bug 64737.
+    if (style() && style()->hasPseudoStyle(SCROLLBAR) && frame() && frame()->view())
+        frame()->view()->clearOwningRendererForCustomScrollbars(this);
+
     RenderBoxModelObject::destroy();
 }
 
@@ -1372,6 +1377,8 @@ void RenderBox::positionLineBox(InlineBox* box)
         box->destroy(renderArena());
     } else if (isReplaced()) {
         setLocation(lroundf(box->x()), lroundf(box->y()));
+        if (m_inlineBoxWrapper)
+            deleteLineBoxWrapper();
         m_inlineBoxWrapper = box;
     }
 }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
index ff9ff15..a6c2da9 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -388,6 +388,21 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
             if (!beforeAfterParent)
                 return;
 
+            // When beforeAfterParent is not equal to child (e.g. in tables),
+            // we need to create new styles inheriting from pseudoElementStyle 
+            // on all the intermediate parents (leaving their display same).
+            if (beforeAfterParent != child) {
+                RenderObject* curr = beforeAfterParent;
+                while (curr && curr != child) {
+                    ASSERT(curr->isAnonymous());
+                    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+                    newStyle->inheritFrom(pseudoElementStyle);
+                    newStyle->setDisplay(curr->style()->display());
+                    curr->setStyle(newStyle);
+                    curr = curr->parent();
+                }
+            }
+
             // Note that if we ever support additional types of generated content (which should be way off
             // in the future), this code will need to be patched.
             for (RenderObject* genChild = beforeAfterParent->firstChild(); genChild; genChild = genChild->nextSibling()) {
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
index 962024c..7a75b2e 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -149,7 +149,7 @@ ScrollbarPart RenderScrollbar::partForStyleResolve()
 
 PassRefPtr<RenderStyle> RenderScrollbar::getScrollbarPseudoStyle(ScrollbarPart partType, PseudoId pseudoId)
 {
-    if (!m_owner)
+    if (!owningRenderer())
         return 0;
 
     s_styleResolvePart = partType;
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
index 2edcfc4..dd44577 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
@@ -90,7 +90,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous() && last->isTableCell()) {
+        if (last && last->isAnonymous() && last->isTableCell() && !isAfterContent(last) && !isBeforeContent(last)) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -98,7 +98,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         }
 
         // If beforeChild is inside an anonymous cell, insert into the cell.
-        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous()) {
+        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous() && !isAfterContent(last->parent()) && !isBeforeContent(last->parent())) {
             last->parent()->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
index 6b080b8..3f84404 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
@@ -96,7 +96,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous()) {
+        if (last && last->isAnonymous() && !isAfterContent(last) && !isBeforeContent(last)) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -108,7 +108,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* lastBox = last;
         while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableRow())
             lastBox = lastBox->parent();
-        if (lastBox && lastBox->isAnonymous()) {
+        if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox) && !isBeforeContent(lastBox)) {
             lastBox->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
index 97444cd..5a00374 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
@@ -143,6 +143,11 @@ void RenderWidget::destroy()
     if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    // If this renderer is owning renderer for the frameview's custom scrollbars,
+    // we need to clear it from the scrollbar. See webkit bug 64737.
+    if (style() && style()->hasPseudoStyle(SCROLLBAR) && frame() && frame()->view())
+        frame()->view()->clearOwningRendererForCustomScrollbars(this);
+
     if (hasLayer()) {
         layer()->clearClipRects();
         setHasLayer(false);
diff --git a/src/3rdparty/webkit/Source/WebKit.pri b/src/3rdparty/webkit/Source/WebKit.pri
index be1c7b7..5bd9577 100644
--- a/src/3rdparty/webkit/Source/WebKit.pri
+++ b/src/3rdparty/webkit/Source/WebKit.pri
@@ -2,9 +2,6 @@
 
 contains(QT_CONFIG, qpa)|contains(QT_CONFIG, embedded): CONFIG += embedded
 
-contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
-unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-
 # Detect that we are building as a standalone package by the presence of
 # either the generated files directory or as part of the Qt package through
 # QTDIR_build
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
index 0bca4b2..4758de0 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,58 @@
+2011-08-31  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Unskip API test for load signals order
+        https://bugs.webkit.org/show_bug.cgi?id=67285
+
+        Reviewed by Andreas Kling.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadSignalsOrder):
+
+2011-08-30  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Emit last progress notification before calling dispatchDidFinishLoad
+        https://bugs.webkit.org/show_bug.cgi?id=28851
+
+        Reviewed by Adam Barth.
+
+        Add infrastructure to dump progressFinishedNotification callback in DRT.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::dumpProgressFinishedCallback):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-09-02  Jade Han  <jade.han@nokia.com>
+
+        [Qt][Symbian] REGRESSION(93235) Missing .def update
+        https://bugs.webkit.org/show_bug.cgi?id=67307
+
+        Reviewed by Laszlo Gombos.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2011-08-12  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Add test for correct order of load signals in QWebPage
+        https://bugs.webkit.org/show_bug.cgi?id=66016
+
+        Reviewed by Benjamin Poulain.
+
+        Add API test to ensure the order of load signals: loadStarted() needs to be emitted
+        first, then loadProgress(100), followed by loadFinished().
+
+        The test is skipped since this right now is broken, the bug
+        https://bugs.webkit.org/show_bug.cgi?id=28851 tracks one possible way to fix.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (SpyForLoadSignalsOrder::SpyForLoadSignalsOrder):
+        (SpyForLoadSignalsOrder::isFinished):
+        (SpyForLoadSignalsOrder::onLoadProgress):
+        (tst_QWebPage::loadSignalsOrder_data):
+        (tst_QWebPage::loadSignalsOrder):
+
 2011-08-25  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
         Unreviewed QtWebKit.pro fix for when building inside Qt
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 2fc8e84..5d4bf6d 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -677,6 +677,11 @@ void DumpRenderTreeSupportQt::dumpFrameLoader(bool b)
     FrameLoaderClientQt::dumpFrameLoaderCallbacks = b;
 }
 
+void DumpRenderTreeSupportQt::dumpProgressFinishedCallback(bool b)
+{
+    FrameLoaderClientQt::dumpProgressFinishedCallback = b;
+}
+
 void DumpRenderTreeSupportQt::dumpUserGestureInFrameLoader(bool b)
 {
     FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = b;
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 7040ea1..f485cb5 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -163,6 +163,7 @@ public:
     static QString plainText(const QVariant& rng);
 
     static void dumpFrameLoader(bool b);
+    static void dumpProgressFinishedCallback(bool);
     static void dumpUserGestureInFrameLoader(bool b);
     static void dumpResourceLoadCallbacks(bool b);
     static void dumpResourceResponseMIMETypes(bool b);
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 8971fc4..5e0a2e6 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -170,6 +170,7 @@ static QString drtDescriptionSuitableForTestResult(const RefPtr<WebCore::Node> n
 namespace WebCore {
 
 bool FrameLoaderClientQt::dumpFrameLoaderCallbacks = false;
+bool FrameLoaderClientQt::dumpProgressFinishedCallback = false;
 bool FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = false;
 bool FrameLoaderClientQt::dumpResourceLoadCallbacks = false;
 bool FrameLoaderClientQt::sendRequestReturnsNullOnRedirect = false;
@@ -586,6 +587,9 @@ void FrameLoaderClientQt::postProgressEstimateChangedNotification()
 
 void FrameLoaderClientQt::postProgressFinishedNotification()
 {
+    if (dumpProgressFinishedCallback)
+        printf("postProgressFinishedNotification\n");
+
     // Send a mousemove event to:
     // (1) update the cursor to change according to whatever is underneath the mouse cursor right now;
     // (2) display the tool tip if the mouse hovers a node which has a tool tip.
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 1be365d..1b9d3b8 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -247,6 +247,7 @@ public:
     const KURL& lastRequestedUrl() const { return m_lastRequestedUrl; }
 
     static bool dumpFrameLoaderCallbacks;
+    static bool dumpProgressFinishedCallback;
     static bool dumpUserGestureInFrameLoaderCallbacks;
     static bool dumpResourceLoadCallbacks;
     static bool dumpResourceResponseMIMETypes;
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
index d948de4..0a1c6cb 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -878,3 +878,5 @@ EXPORTS
 	_ZN8QDRTNodeD1Ev @ 877 NONAME

 	_ZN8QDRTNodeD2Ev @ 878 NONAME

 	_ZN8QDRTNodeaSERKS_ @ 879 NONAME

+	_ZN23DumpRenderTreeSupportQt21injectInternalsObjectEP9QWebFrame @ 880 NONAME

+	_ZN23DumpRenderTreeSupportQt20resetInternalsObjectEP9QWebFrame @ 881 NONAME

diff --git a/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 893c284..6102102 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -28,6 +28,7 @@
 #include <QMainWindow>
 #include <QMenu>
 #include <QPushButton>
+#include <QStateMachine>
 #include <QStyle>
 #include <QtTest/QtTest>
 #include <QTextCharFormat>
@@ -155,6 +156,8 @@ private slots:
     void navigatorCookieEnabled();
     void deleteQWebViewTwice();
     void renderOnRepaintRequestedShouldNotRecurse();
+    void loadSignalsOrder_data();
+    void loadSignalsOrder();
 
 #ifdef Q_OS_MAC
     void macCopyUnicodeToClipboard();
@@ -3065,5 +3068,57 @@ void tst_QWebPage::renderOnRepaintRequestedShouldNotRecurse()
     QVERIFY(::waitForSignal(&r, SIGNAL(finished())));
 }
 
+class SpyForLoadSignalsOrder : public QStateMachine {
+    Q_OBJECT
+public:
+    SpyForLoadSignalsOrder(QWebPage* page, QObject* parent = 0)
+        : QStateMachine(parent)
+    {
+        connect(page, SIGNAL(loadProgress(int)), SLOT(onLoadProgress(int)));
+
+        QState* waitingForLoadStarted = new QState(this);
+        QState* waitingForLastLoadProgress = new QState(this);
+        QState* waitingForLoadFinished = new QState(this);
+        QFinalState* final = new QFinalState(this);
+
+        waitingForLoadStarted->addTransition(page, SIGNAL(loadStarted()), waitingForLastLoadProgress);
+        waitingForLastLoadProgress->addTransition(this, SIGNAL(lastLoadProgress()), waitingForLoadFinished);
+        waitingForLoadFinished->addTransition(page, SIGNAL(loadFinished(bool)), final);
+
+        setInitialState(waitingForLoadStarted);
+        start();
+    }
+    bool isFinished() const
+    {
+        return !isRunning();
+    }
+public Q_SLOTS:
+    void onLoadProgress(int progress)
+    {
+        if (progress == 100)
+            emit lastLoadProgress();
+    }
+signals:
+    void lastLoadProgress();
+};
+
+void tst_QWebPage::loadSignalsOrder_data()
+{
+    QTest::addColumn<QUrl>("url");
+    QTest::newRow("inline data") << QUrl("data:text/html,This is first page");
+    QTest::newRow("simple page") << QUrl("qrc:///resources/content.html");
+    QTest::newRow("frameset page") << QUrl("qrc:///resources/index.html");
+}
+
+void tst_QWebPage::loadSignalsOrder()
+{
+    QFETCH(QUrl, url);
+    QWebPage page;
+    SpyForLoadSignalsOrder loadSpy(&page);
+    waitForSignal(&loadSpy, SIGNAL(started()));
+    page.mainFrame()->load(url);
+    QTRY_VERIFY(loadSpy.isFinished());
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7c1b678..aeaa22c 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        fb3b4700aa5abbb2db471b4f0eb7946ce4850cc4
+        a2bd2bb1b19949c6807da38e25bfa7d210bb4b17