Merge branch '4.6' of scm.dev.nokia.troll.no:qt/qt into 4.6

177 files changed, 3879 insertions, 1253 deletions

diff --git a/configure b/configure
index 6a4b079..f89da70 100755
--- a/configure
+++ b/configure
@@ -6383,7 +6383,7 @@ else
 fi
 
 if [ "$CFG_SCRIPT" = "auto" ]; then
-    CFG_SCRIPT="$canBuildWebKit"
+    CFG_SCRIPT="yes"
 fi
 
 if [ "$CFG_SCRIPT" = "yes" ]; then
diff --git a/demos/browser/browsermainwindow.cpp b/demos/browser/browsermainwindow.cpp
index 1ad2311..fba3ac5 100644
--- a/demos/browser/browsermainwindow.cpp
+++ b/demos/browser/browsermainwindow.cpp
@@ -740,7 +740,7 @@ void BrowserMainWindow::closeEvent(QCloseEvent *event)
     if (m_tabWidget->count() > 1) {
         int ret = QMessageBox::warning(this, QString(),
                            tr("Are you sure you want to close the window?"
-                              "  There are %1 tab open").arg(m_tabWidget->count()),
+                              "  There are %1 tabs open").arg(m_tabWidget->count()),
                            QMessageBox::Yes | QMessageBox::No,
                            QMessageBox::No);
         if (ret == QMessageBox::No) {
diff --git a/doc/src/frameworks-technologies/statemachine.qdoc b/doc/src/frameworks-technologies/statemachine.qdoc
index 2b137dd..ed8bc85 100644
--- a/doc/src/frameworks-technologies/statemachine.qdoc
+++ b/doc/src/frameworks-technologies/statemachine.qdoc
@@ -304,6 +304,35 @@
   For parallel state groups, the QState::finished() signal is emitted when \e
   all the child states have entered final states.
 
+  \section1 Targetless Transitions
+
+  A transition need not have a target state. A transition without a target can
+  be triggered the same way as any other transition; the difference is that
+  when a targetless transition is triggered, it doesn't cause any state
+  changes. This allows you to react to a signal or event when your machine is
+  in a certain state, without having to leave that state. Example:
+
+  \code
+    QStateMachine machine;
+    QState *s1 = new QState(&machine);
+
+    QPushButton button;
+    QSignalTransition *trans = new QSignalTransition(&button, SIGNAL(clicked()));
+    s1->addTransition(trans);
+
+    QMessageBox msgBox;
+    msgBox.setText("The button was clicked; carry on.");
+    QObject::connect(trans, SIGNAL(triggered()), &msgBox, SLOT(exec()));
+
+    machine.setInitialState(s1);
+  \endcode
+
+  The message box will be displayed each time the button is clicked, but the
+  state machine will remain in its current state (s1). If the target state
+  were explicitly set to s1, however, s1 would be exited and re-entered each
+  time (e.g. the QAbstractState::entered() and QAbstractState::exited()
+  signals would be emitted).
+
   \section1 Events, Transitions and Guards
 
   A QStateMachine runs its own event loop. For signal transitions
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/interpreter/Interpreter.cpp
index bfb0307..4200023 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/interpreter/Interpreter.cpp
@@ -885,13 +885,21 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     }
 
     Register* oldEnd = m_registerFile.end();
+#ifdef  QT_BUILD_SCRIPT_LIB //with QtScript, we do not necesserly start from scratch
+    Register* newEnd = oldEnd + globalRegisterOffset + codeBlock->m_numCalleeRegisters;
+#else
     Register* newEnd = m_registerFile.start() + globalRegisterOffset + codeBlock->m_numCalleeRegisters;
+#endif
     if (!m_registerFile.grow(newEnd)) {
         *exception = createStackOverflowError(callFrame);
         return jsNull();
     }
 
+#ifdef QT_BUILD_SCRIPT_LIB //with QtScript, we do not necesserly start from scratch
+    CallFrame* newCallFrame = CallFrame::create(oldEnd + globalRegisterOffset);
+#else
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
+#endif
 
     // a 0 codeBlock indicates a built-in caller
     newCallFrame->r(codeBlock->thisRegister()) = JSValue(thisObj);
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 9065b3a..e2c1ef5 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,9 @@
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        GTK BUILD FIX: add ENABLE_ORIENTATION_EVENTS support to configure.ac
+
+        * configure.ac: Added support for ENABLE_ORIENTATION_EVENTS.
+
 2009-09-23  Xan Lopez  <xlopez@igalia.com>
 
         Reviewed by Gustavo Noronha.
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 4899919..f6a644a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,252 @@
+2009-09-28  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add ARM version detection for Windows CE.
+
+        * wtf/Platform.h:
+
+2009-09-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add MarkStackSymbian.cpp to build JavascriptCore for Symbian.
+
+        Re-use Windows shrinkAllocation implementation because Symbian doesn't
+        support releasing part of memory region.
+        
+        Use fastMalloc and fastFree to implement allocateStack and releaseStack
+        for Symbian port.
+
+        * JavaScriptCore.pri:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackSymbian.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2009-09-25  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix unaligned data access in YARR_JIT on ARMv5 and below.
+        https://bugs.webkit.org/show_bug.cgi?id=29695
+
+        On ARMv5 and below all data access should be naturally aligned.
+        In the YARR_JIT there is a case when character pairs are
+        loaded from the input string, but this data access is not
+        naturally aligned. This fix introduces load32WithUnalignedHalfWords
+        and branch32WithUnalignedHalfWords functions which contain
+        naturally aligned memory loads - half word loads - on ARMv5 and below.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for JavaScriptCore.  Also there are some
+        wtf project files that get built apparently.
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Ada Chan  <adachan@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+        
+        SunSpider says 0.5% faster.
+        
+        0.8% speedup on bench-alloc-nonretained.js.
+        2.5% speedup on v8-splay.js.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChain::ScopeChain):
+        (JSC::ScopeChain::globalObject): Added a globalObject data member to ScopeChainNode.
+        Replaced accessor function for globalObject() with data member. Replaced
+        globalThisObject() accessor with direct access to globalThis, to match.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h: Inlined array and object construction.
+
+2009-09-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add ARM version detection rules for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29715
+
+        * wtf/Platform.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark "Do It!" Rowe.
+
+        Some GCC versions don't like C++-style comments in preprocessor
+        directives, change to C-style to shut them up.
+
+        * wtf/Platform.h:
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Division is needlessly slow in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=29723
+
+        Add codegen for op_div on x86-64
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateDouble):
+        (JSC::JIT::addressFor):
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateNumber):
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        JavaScriptCore/JavaScriptCore.gyp directory)
+
+        JavaScriptCore.xcodeproj
+        JavaScriptCore.sln
+        JavaScriptCore.vcproj
+        JavaScriptCore_Debug.rules
+        JavaScriptCore_Release.rules
+        JavaScriptCore_Release - no tcmalloc.rules
+        JavaScriptCore_Purify.rules
+        JavaScriptCore.mk
+        JavaScriptCore_Debug_rules.mk
+        JavaScriptCore_Release_rules.mk
+        JavaScriptCore_Release - no tcmalloc_rules.mk
+        JavaScriptCore_Purify_rules.mk
+        JavaScriptCore.scons
+        JavaScriptCore_main.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Replace platform-dependent code with WTF::currentTime()
+        https://bugs.webkit.org/show_bug.cgi?id=29148
+
+        * jsc.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7215058> FastMalloc scavenging thread should be named
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerThread): Set the thread name.
+        * wtf/Platform.h: Move the knowledge of whether pthread_setname_np exists to here as HAVE(PTHREAD_SETNAME_NP).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Use HAVE(PTHREAD_SETNAME_NP).
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed clear to removeAll, as suggested by Darin Adler.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::removeAll):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix FastMalloc to build with assertions enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::ReleaseToSpans):
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::IsHeld):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Removed some unnecessary parameter names.
+
+        * wtf/HashCountedSet.h:
+
+2009-09-24  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        On Windows JSChar is typedef'ed to wchar_t.
+
+        When building with WINSCW for Symbian we need to do the
+        same typedef.
+
+        * API/JSStringRef.h:
+
 2009-09-23  Geoffrey Garen  <ggaren@apple.com>
 
         A piece of my last patch that I forgot.
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index 7a815e3..73791e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -128,12 +128,16 @@ SOURCES += \
     yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
-win32-*|wince* {
-    SOURCES += jit/ExecutableAllocatorWin.cpp \
-               runtime/MarkStackWin.cpp
+symbian {
+    SOURCES += runtime/MarkStackSymbian.cpp
 } else {
-    SOURCES += jit/ExecutableAllocatorPosix.cpp \
-               runtime/MarkStackPosix.cpp
+    win32-*|wince* {
+        SOURCES += jit/ExecutableAllocatorWin.cpp \
+                  runtime/MarkStackWin.cpp
+    } else {
+        SOURCES += jit/ExecutableAllocatorPosix.cpp \
+                  runtime/MarkStackPosix.cpp
+    }
 }
 
 # AllInOneFile.cpp helps gcc analize and optimize code
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index 43648c4..d726ecd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -62,6 +62,33 @@ static bool isVFPPresent()
 
 const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
 
+#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+{
+    ARMWord op2;
+
+    ASSERT(address.scale >= 0 && address.scale <= 3);
+    op2 = m_assembler.lsl(address.index, static_cast<int>(address.scale));
+
+    if (address.offset >= 0 && address.offset + 0x2 <= 0xff) {
+        m_assembler.add_r(ARMRegisters::S0, address.base, op2);
+        m_assembler.ldrh_u(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset));
+        m_assembler.ldrh_u(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset + 0x2));
+    } else if (address.offset < 0 && address.offset >= -0xff) {
+        m_assembler.add_r(ARMRegisters::S0, address.base, op2);
+        m_assembler.ldrh_d(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset));
+        m_assembler.ldrh_d(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset - 0x2));
+    } else {
+        m_assembler.ldr_un_imm(ARMRegisters::S0, address.offset);
+        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
+        m_assembler.ldrh_r(dest, address.base, ARMRegisters::S0);
+        m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::OP2_IMM | 0x2);
+        m_assembler.ldrh_r(ARMRegisters::S0, address.base, ARMRegisters::S0);
+    }
+    m_assembler.orr_r(dest, dest, m_assembler.lsl(ARMRegisters::S0, 16));
+}
+#endif
+
 }
 
 #endif // ENABLE(ASSEMBLER) && PLATFORM(ARM_TRADITIONAL)
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
index 0c696c9..aa8cbb0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -198,6 +198,15 @@ public:
         m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
+#if defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_REQUIRE_NATURAL_ALIGNMENT
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
+#else
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+#endif
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 dataLabel(this);
@@ -364,6 +373,12 @@ public:
         return branch32(cond, ARMRegisters::S1, right);
     }
 
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        load32WithUnalignedHalfWords(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
     {
         UNUSED_PARAM(cond);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index 999056b..a549604 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -375,6 +375,11 @@ public:
         load32(setupArmAddress(address), dest);
     }
 
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
     void load32(void* address, RegisterID dest)
     {
         move(ImmPtr(address), addressTempRegister);
@@ -717,6 +722,13 @@ public:
         return branch32(cond, addressTempRegister, right);
     }
 
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32WithUnalignedHalfWords(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
     Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
     {
         load32(left.m_ptr, dataTempRegister);
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 61e0e17..5ebefa7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -306,6 +306,11 @@ public:
         m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
     }
 
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         m_assembler.movl_mr_disp32(address.offset, address.base, dest);
@@ -604,6 +609,11 @@ public:
         return Jump(m_assembler.jCC(x86Condition(cond)));
     }
 
+    Jump branch32WithUnalignedHalfWords(Condition cond, BaseIndex left, Imm32 right)
+    {
+        return branch32(cond, left, right);
+    }
+
     Jump branch16(Condition cond, BaseIndex left, RegisterID right)
     {
         m_assembler.cmpw_rm(right, left.offset, left.base, left.index, left.scale);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
index b9fa484..e903b79 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
             , m_exception(exception)
-            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
+            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argCount, function->scope().node(), exception);
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index 92ec06e..b4d49db 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -51,14 +51,14 @@ namespace JSC  {
         // Differs from dynamicGlobalObject() during function calls across web browser frames.
         JSGlobalObject* lexicalGlobalObject() const
         {
-            return scopeChain()->globalObject();
+            return scopeChain()->globalObject;
         }
 
         // Differs from lexicalGlobalObject because this will have DOM window shell rather than
         // the actual DOM window, which can't be "this" for security reasons.
         JSObject* globalThisValue() const
         {
-            return scopeChain()->globalThisObject();
+            return scopeChain()->globalThis;
         }
 
         // FIXME: Elsewhere, we use JSGlobalData* rather than JSGlobalData&.
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 8a8fb3c..2aaa325 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -385,7 +385,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     printf("-----------------------------------------------------------------------------\n");
 
     CodeBlock* codeBlock = callFrame->codeBlock();
-    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject()->globalData()->interpreter->registerFile();
+    RegisterFile* registerFile = &callFrame->scopeChain()->globalObject->globalData()->interpreter->registerFile();
     const Register* it;
     const Register* end;
     JSValue v;
@@ -629,7 +629,7 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, scopeChain->globalObject);
 
     JSGlobalObject* lastGlobalObject = m_registerFile.globalObject();
     JSGlobalObject* globalObject = callFrame->dynamicGlobalObject();
@@ -689,7 +689,7 @@ JSValue Interpreter::execute(FunctionExecutable* functionExecutable, CallFrame*
         return jsNull();
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
@@ -819,7 +819,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         }
     }
 
-    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
+    DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject);
 
     EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
 
@@ -1242,7 +1242,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = (++vPC)->u.operand;
         int regExp = (++vPC)->u.operand;
-        callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
+        callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2981,7 +2981,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
         JSValue thisValue = argv[0].jsValue();
-        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+        JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
             JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
@@ -3429,7 +3429,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             if (prototype.isObject())
                 structure = asObject(prototype)->inheritorID();
             else
-                structure = callDataScopeChain->globalObject()->emptyObjectStructure();
+                structure = callDataScopeChain->globalObject->emptyObjectStructure();
             JSObject* newObject = new (globalData) JSObject(structure);
 
             callFrame->r(thisRegister) = JSValue(newObject); // "this" value
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index bf3a418..ea8434e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -195,7 +195,7 @@ void JIT::privateCompileMainPass()
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
         DEFINE_BINARY_OP(op_del_by_val)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE32)
         DEFINE_BINARY_OP(op_div)
 #endif
         DEFINE_BINARY_OP(op_in)
@@ -230,7 +230,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_create_arguments)
         DEFINE_OP(op_debug)
         DEFINE_OP(op_del_by_id)
-#if USE(JSVALUE32_64)
+#if !USE(JSVALUE32)
         DEFINE_OP(op_div)
 #endif
         DEFINE_OP(op_end)
@@ -379,7 +379,7 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_construct)
         DEFINE_SLOWCASE_OP(op_construct_verify)
         DEFINE_SLOWCASE_OP(op_convert_this)
-#if USE(JSVALUE32_64)
+#if !USE(JSVALUE32)
         DEFINE_SLOWCASE_OP(op_div)
 #endif
         DEFINE_SLOWCASE_OP(op_eq)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 5c58e9d..3b35935 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -379,14 +379,18 @@ namespace JSC {
 
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
+        bool isOperandConstantImmediateDouble(unsigned src);
+        
+        void emitLoadDouble(unsigned index, FPRegisterID value);
+        void emitLoadInt32ToDouble(unsigned index, FPRegisterID value);
+
+        Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
 #if USE(JSVALUE32_64)
         Address tagFor(unsigned index, RegisterID base = callFrameRegister);
         Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
-        Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
         bool getOperandConstantImmediateInt(unsigned op1, unsigned op2, unsigned& op, int32_t& constant);
-        bool isOperandConstantImmediateDouble(unsigned src);
 
         void emitLoadTag(unsigned index, RegisterID tag);
         void emitLoadPayload(unsigned index, RegisterID payload);
@@ -394,8 +398,6 @@ namespace JSC {
         void emitLoad(const JSValue& v, RegisterID tag, RegisterID payload);
         void emitLoad(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitLoad2(unsigned index1, RegisterID tag1, RegisterID payload1, unsigned index2, RegisterID tag2, RegisterID payload2);
-        void emitLoadDouble(unsigned index, FPRegisterID value);
-        void emitLoadInt32ToDouble(unsigned index, FPRegisterID value);
 
         void emitStore(unsigned index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
         void emitStore(unsigned index, const JSValue constant, RegisterID base = callFrameRegister);
@@ -499,6 +501,7 @@ namespace JSC {
         JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
         JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
         void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
+        void emitJumpSlowCaseIfNotImmediateNumber(RegisterID);
         void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
 
 #if !USE(JSVALUE64)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index 3be13cb..fb44386 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -1978,9 +1978,11 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
         addDouble(fpRegT2, fpRegT1);
     else if (opcodeID == op_sub)
         subDouble(fpRegT2, fpRegT1);
-    else {
-        ASSERT(opcodeID == op_mul);
+    else if (opcodeID == op_mul)
         mulDouble(fpRegT2, fpRegT1);
+    else {
+        ASSERT(opcodeID == op_div);
+        divDouble(fpRegT2, fpRegT1);
     }
     moveDoubleToPtr(fpRegT1, regT0);
     subPtr(tagTypeNumberRegister, regT0);
@@ -2082,6 +2084,103 @@ void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>
         compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, types);
 }
 
+void JIT::emit_op_div(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    if (isOperandConstantImmediateDouble(op1)) {
+        emitGetVirtualRegister(op1, regT0);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT0);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitLoadInt32ToDouble(op1, fpRegT0);
+    } else {
+        emitGetVirtualRegister(op1, regT0);
+        if (!types.first().definitelyIsNumber())
+            emitJumpSlowCaseIfNotImmediateNumber(regT0);
+        Jump notInt = emitJumpIfNotImmediateInteger(regT0);
+        convertInt32ToDouble(regT0, fpRegT0);
+        Jump skipDoubleLoad = jump();
+        notInt.link(this);
+        addPtr(tagTypeNumberRegister, regT0);
+        movePtrToDouble(regT0, fpRegT0);
+        skipDoubleLoad.link(this);
+    }
+    
+    if (isOperandConstantImmediateDouble(op2)) {
+        emitGetVirtualRegister(op2, regT1);
+        addPtr(tagTypeNumberRegister, regT1);
+        movePtrToDouble(regT1, fpRegT1);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitLoadInt32ToDouble(op2, fpRegT1);
+    } else {
+        emitGetVirtualRegister(op2, regT1);
+        if (!types.second().definitelyIsNumber())
+            emitJumpSlowCaseIfNotImmediateNumber(regT1);
+        Jump notInt = emitJumpIfNotImmediateInteger(regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
+        Jump skipDoubleLoad = jump();
+        notInt.link(this);
+        addPtr(tagTypeNumberRegister, regT1);
+        movePtrToDouble(regT1, fpRegT1);
+        skipDoubleLoad.link(this);
+    }
+    divDouble(fpRegT1, fpRegT0);
+
+    JumpList doubleResult;
+    Jump end;
+    bool attemptIntConversion = (!isOperandConstantImmediateInt(op1) || getConstantOperand(op1).asInt32() > 1) && isOperandConstantImmediateInt(op2);
+    if (attemptIntConversion) {
+        m_assembler.cvttsd2si_rr(fpRegT0, regT0);
+        doubleResult.append(branchTest32(Zero, regT0));
+        m_assembler.ucomisd_rr(fpRegT1, fpRegT0);
+        
+        doubleResult.append(m_assembler.jne());
+        doubleResult.append(m_assembler.jp());
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+        end = jump();
+    }
+
+    // Double result.
+    doubleResult.link(this);
+    moveDoubleToPtr(fpRegT0, regT0);
+    subPtr(tagTypeNumberRegister, regT0);
+
+    if (attemptIntConversion)
+        end.link(this);
+    emitPutVirtualRegister(dst, regT0);
+}
+
+void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+    if (types.first().definitelyIsNumber() && types.second().definitelyIsNumber()) {
+#ifndef NDEBUG
+        breakpoint();
+#endif
+        return;
+    }
+    if (!isOperandConstantImmediateDouble(op1) && !isOperandConstantImmediateInt(op1)) {
+        if (!types.first().definitelyIsNumber())
+            linkSlowCase(iter);
+    }
+    if (!isOperandConstantImmediateDouble(op2) && !isOperandConstantImmediateInt(op2)) {
+        if (!types.second().definitelyIsNumber())
+            linkSlowCase(iter);
+    }
+    // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+    JITStubCall stubCall(this, cti_op_div);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
 void JIT::emit_op_sub(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index e69e273..f26457a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -65,6 +65,11 @@ ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID ds
     peek(dst, argumentStackOffset);
 }
 
+ALWAYS_INLINE bool JIT::isOperandConstantImmediateDouble(unsigned src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
+}
+
 ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 {
     ASSERT(m_codeBlock->isConstantRegisterIndex(src));
@@ -305,6 +310,11 @@ ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
 #endif
 #endif
 
+inline JIT::Address JIT::addressFor(unsigned index, RegisterID base)
+{
+    return Address(base, (index * sizeof(Register)));
+}
+
 #if USE(JSVALUE32_64)
 
 inline JIT::Address JIT::tagFor(unsigned index, RegisterID base)
@@ -317,11 +327,6 @@ inline JIT::Address JIT::payloadFor(unsigned index, RegisterID base)
     return Address(base, (index * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
 }
 
-inline JIT::Address JIT::addressFor(unsigned index, RegisterID base)
-{
-    return Address(base, (index * sizeof(Register)));
-}
-
 inline void JIT::emitLoadTag(unsigned index, RegisterID tag)
 {
     RegisterID mappedTag;
@@ -579,11 +584,6 @@ ALWAYS_INLINE bool JIT::getOperandConstantImmediateInt(unsigned op1, unsigned op
     return false;
 }
 
-ALWAYS_INLINE bool JIT::isOperandConstantImmediateDouble(unsigned src)
-{
-    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
-}
-
 /* Deprecated: Please use JITStubCall instead. */
 
 ALWAYS_INLINE void JIT::emitPutJITStubArg(RegisterID tag, RegisterID payload, unsigned argumentNumber)
@@ -732,6 +732,24 @@ ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateNumber(RegisterID reg)
 {
     return branchTestPtr(Zero, reg, tagTypeNumberRegister);
 }
+
+inline void JIT::emitLoadDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        loadDouble(&inConstantPool, value);
+    } else
+        loadDouble(addressFor(index), value);
+}
+
+inline void JIT::emitLoadInt32ToDouble(unsigned index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        Register& inConstantPool = m_codeBlock->constantRegister(index);
+        convertInt32ToDouble(AbsoluteAddress(&inConstantPool), value);
+    } else
+        convertInt32ToDouble(addressFor(index), value);
+}
 #endif
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
@@ -769,6 +787,11 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateIntegers(RegisterID reg1,
     addSlowCase(emitJumpIfNotImmediateIntegers(reg1, reg2, scratch));
 }
 
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotImmediateNumber(reg));
+}
+
 #if !USE(JSVALUE64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
index 055a536..065b7ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -1182,7 +1182,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
         if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(codeBlock, methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
     }
@@ -1738,7 +1738,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
     if (stackFrame.args[3].jsValue().isObject())
         structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
     else
-        structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
+        structure = constructor->scope().node()->globalObject->emptyObjectStructure();
     return new (stackFrame.globalData) JSObject(structure);
 }
 
@@ -2641,7 +2641,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
     Register* newCallFrame = callFrame->registers() + registerOffset;
     Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
     JSValue thisValue = argv[0].jsValue();
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject;
 
     if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
         JSValue exceptionValue;
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index 92b1e58..ee4e393 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -24,6 +24,7 @@
 
 #include "BytecodeGenerator.h"
 #include "Completion.h"
+#include "CurrentTime.h"
 #include "InitializeThreading.h"
 #include "JSArray.h"
 #include "JSFunction.h"
@@ -118,53 +119,23 @@ public:
     long getElapsedMS(); // call stop() first
 
 private:
-#if PLATFORM(QT)
-    uint m_startTime;
-    uint m_stopTime;
-#elif PLATFORM(WIN_OS)
-    DWORD m_startTime;
-    DWORD m_stopTime;
-#else
-    // Windows does not have timeval, disabling this class for now (bug 7399)
-    timeval m_startTime;
-    timeval m_stopTime;
-#endif
+    double m_startTime;
+    double m_stopTime;
 };
 
 void StopWatch::start()
 {
-#if PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    m_startTime = t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    m_startTime = timeGetTime();
-#else
-    gettimeofday(&m_startTime, 0);
-#endif
+    m_startTime = currentTime();
 }
 
 void StopWatch::stop()
 {
-#if PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    m_stopTime = t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    m_stopTime = timeGetTime();
-#else
-    gettimeofday(&m_stopTime, 0);
-#endif
+    m_stopTime = currentTime();
 }
 
 long StopWatch::getElapsedMS()
 {
-#if PLATFORM(WIN_OS) || PLATFORM(QT)
-    return m_stopTime - m_startTime;
-#else
-    timeval elapsedTime;
-    timersub(&m_stopTime, &m_startTime, &elapsedTime);
-
-    return elapsedTime.tv_sec * 1000 + lroundf(elapsedTime.tv_usec / 1000.0f);
-#endif
+    return static_cast<long>((m_stopTime - m_startTime) * 1000);
 }
 
 class GlobalObject : public JSGlobalObject {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index d5eb20f..f28b3bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -92,7 +92,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
         return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    ScopeChain scopeChain(globalObject, globalObject->globalData(), exec->globalThisValue());
+    ScopeChain scopeChain(globalObject, globalObject->globalData(), globalObject, exec->globalThisValue());
     return new (exec) JSFunction(exec, function, scopeChain.node());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index 101f543..7671c96 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -1066,26 +1066,4 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
 
 #endif
 
-JSArray* constructEmptyArray(ExecState* exec)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
-}
-
-JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
-}
-
-JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
-{
-    MarkedArgumentBuffer values;
-    values.append(singleItemValue);
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
-}
-
-JSArray* constructArray(ExecState* exec, const ArgList& values)
-{
-    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index 4f2f86a..7d28aab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -116,11 +116,6 @@ namespace JSC {
 
     JSArray* asArray(JSValue);
 
-    JSArray* constructEmptyArray(ExecState*);
-    JSArray* constructEmptyArray(ExecState*, unsigned initialLength);
-    JSArray* constructArray(ExecState*, JSValue singleItemValue);
-    JSArray* constructArray(ExecState*, const ArgList& values);
-
     inline JSArray* asArray(JSCell* cell)
     {
         ASSERT(cell->inherits(&JSArray::info));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index 8d71ac3..9907a8f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -129,7 +129,7 @@ void JSGlobalObject::init(JSObject* thisValue)
     ASSERT(JSLock::currentThreadIsHoldingLock());
 
     d()->globalData = Heap::heap(this)->globalData();
-    d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), thisValue);
+    d()->globalScopeChain = ScopeChain(this, d()->globalData.get(), this, thisValue);
 
     JSGlobalObject::globalExec()->init(0, 0, d()->globalScopeChain.node(), CallFrame::noCaller(), 0, 0, 0);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 5f7137f..cda07e1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -22,6 +22,7 @@
 #ifndef JSGlobalObject_h
 #define JSGlobalObject_h
 
+#include "JSArray.h"
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
 #include "NativeFunctionWrapper.h"
@@ -343,14 +344,6 @@ namespace JSC {
         return symbolTableGet(propertyName, slot, slotIsWriteable);
     }
 
-    inline JSGlobalObject* ScopeChainNode::globalObject() const
-    {
-        const ScopeChainNode* n = this;
-        while (n->next)
-            n = n->next;
-        return asGlobalObject(n->object);
-    }
-
     inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
@@ -405,6 +398,33 @@ namespace JSC {
         return globalData().dynamicGlobalObject;
     }
 
+    inline JSObject* constructEmptyObject(ExecState* exec)
+    {
+        return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
+    }
+
+    inline JSArray* constructEmptyArray(ExecState* exec)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure());
+    }
+
+    inline JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
+    }
+
+    inline JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
+    {
+        MarkedArgumentBuffer values;
+        values.append(singleItemValue);
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+    }
+
+    inline JSArray* constructArray(ExecState* exec, const ArgList& values)
+    {
+        return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
+    }
+
     class DynamicGlobalObjectScope : public Noncopyable {
     public:
         DynamicGlobalObjectScope(CallFrame* callFrame, JSGlobalObject* dynamicGlobalObject) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index 74af4b1..db2a9b2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -513,11 +513,6 @@ void JSObject::allocatePropertyStorage(size_t oldSize, size_t newSize)
     allocatePropertyStorageInline(oldSize, newSize);
 }
 
-JSObject* constructEmptyObject(ExecState* exec)
-{
-    return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
-}
-
 bool JSObject::getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
     unsigned attributes = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 3fd1e3c..24b1ad6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -264,8 +264,6 @@ namespace JSC {
         RefPtr<Structure> m_inheritorID;
     };
     
-JSObject* constructEmptyObject(ExecState*);
-
 inline JSObject* asObject(JSCell* cell)
 {
     ASSERT(cell->isObject());
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
index 5bc85fa..ba00057e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStack.h
@@ -153,7 +153,7 @@ namespace JSC {
                 ASSERT(0 == (size % MarkStack::pageSize()));
                 if (size == m_allocated)
                     return;
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) || PLATFORM(SYMBIAN)
                 // We cannot release a part of a region with VirtualFree.  To get around this,
                 // we'll release the entire region and reallocate the size that we want.
                 releaseStack(m_data, m_allocated);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
index 43f8b29..8e78ff3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackPosix.cpp
@@ -29,44 +29,22 @@
 #include "MarkStack.h"
 
 #include <unistd.h>
-#if defined (__SYMBIAN32__)
-#include "wtf/FastMalloc.h"
-#include <e32base.h>
-#include <e32std.h>
-#include <e32hal.h>
-#include <hal.h>
-#else
 #include <sys/mman.h>
-#endif
 
 namespace JSC {
 
 void MarkStack::initializePagesize()
 {
-#if defined (__SYMBIAN32__)
-    TInt page_size;
-    UserHal::PageSizeInBytes(page_size);
-    MarkStack::s_pageSize = page_size;
-#else
     MarkStack::s_pageSize = getpagesize();
-#endif
 }
 
 void* MarkStack::allocateStack(size_t size)
 {
-#if defined (__SYMBIAN32__)
-    return fastMalloc(size);
-#else
     return mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
-#endif
 }
 void MarkStack::releaseStack(void* addr, size_t size)
 {
-#if defined (__SYMBIAN32__)
-    fastFree(addr);
-#else
     munmap(addr, size);
-#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
new file mode 100644
index 0000000..a0ce8f6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MarkStackSymbian.cpp
@@ -0,0 +1,44 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "MarkStack.h"
+
+#include <e32hal.h>
+
+namespace JSC {
+
+void MarkStack::initializePagesize()
+{
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    MarkStack::s_pageSize = page_size;
+}
+
+void* MarkStack::allocateStack(size_t size)
+{
+    return fastMalloc(size);
+}
+
+void MarkStack::releaseStack(void* addr, size_t size)
+{
+    return fastFree(addr);
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
index 960c525..981794b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.cpp
@@ -36,8 +36,8 @@ void ScopeChainNode::print() const
     ScopeChainIterator scopeEnd = end();
     for (ScopeChainIterator scopeIter = begin(); scopeIter != scopeEnd; ++scopeIter) {
         JSObject* o = *scopeIter;
-        PropertyNameArray propertyNames(globalObject()->globalExec());
-        o->getPropertyNames(globalObject()->globalExec(), propertyNames);
+        PropertyNameArray propertyNames(globalObject->globalExec());
+        o->getPropertyNames(globalObject->globalExec(), propertyNames);
         PropertyNameArray::const_iterator propEnd = propertyNames.end();
 
         fprintf(stderr, "----- [scope %p] -----\n", o);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index c5e16c9..0b15b67 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -33,14 +33,16 @@ namespace JSC {
     
     class ScopeChainNode : public FastAllocBase {
     public:
-        ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
+        ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
             : next(next)
             , object(object)
             , globalData(globalData)
+            , globalObject(globalObject)
             , globalThis(globalThis)
             , refCount(1)
         {
             ASSERT(globalData);
+            ASSERT(globalObject);
         }
 #ifndef NDEBUG
         // Due to the number of subtle and timing dependent bugs that have occurred due
@@ -51,6 +53,7 @@ namespace JSC {
             next = 0;
             object = 0;
             globalData = 0;
+            globalObject = 0;
             globalThis = 0;
         }
 #endif
@@ -58,6 +61,7 @@ namespace JSC {
         ScopeChainNode* next;
         JSObject* object;
         JSGlobalData* globalData;
+        JSGlobalObject* globalObject;
         JSObject* globalThis;
         int refCount;
 
@@ -82,9 +86,6 @@ namespace JSC {
         ScopeChainIterator begin() const;
         ScopeChainIterator end() const;
 
-        JSGlobalObject* globalObject() const; // defined in JSGlobalObject.h
-        JSObject* globalThisObject() const { return globalThis; }
-
 #ifndef NDEBUG        
         void print() const;
 #endif
@@ -93,7 +94,7 @@ namespace JSC {
     inline ScopeChainNode* ScopeChainNode::push(JSObject* o)
     {
         ASSERT(o);
-        return new ScopeChainNode(this, o, globalData, globalThis);
+        return new ScopeChainNode(this, o, globalData, globalObject, globalThis);
     }
 
     inline ScopeChainNode* ScopeChainNode::pop()
@@ -163,8 +164,8 @@ namespace JSC {
         {
         }
 
-        ScopeChain(JSObject* o, JSGlobalData* globalData, JSObject* globalThis)
-            : m_node(new ScopeChainNode(0, o, globalData, globalThis))
+        ScopeChain(JSObject* o, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
+            : m_node(new ScopeChainNode(0, o, globalData, globalObject, globalThis))
         {
         }
 
@@ -203,7 +204,7 @@ namespace JSC {
         void pop() { m_node = m_node->pop(); }
         void clear() { m_node->deref(); m_node = 0; }
         
-        JSGlobalObject* globalObject() const { return m_node->globalObject(); }
+        JSGlobalObject* globalObject() const { return m_node->globalObject; }
 
         void markAggregate(MarkStack&) const;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
index 30ba6e9..2a056c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -35,18 +35,10 @@
 
 #if PLATFORM(DARWIN)
 #include <mach/mach.h>
-#endif
-
-#if HAVE(SYS_TIME_H)
-#include <sys/time.h>
-#endif
-
-#if PLATFORM(WIN_OS)
+#elif PLATFORM(WIN_OS)
 #include <windows.h>
-#endif
-
-#if PLATFORM(QT)
-#include <QDateTime>
+#else
+#include "CurrentTime.h"
 #endif
 
 using namespace std;
@@ -75,14 +67,6 @@ static inline unsigned getCPUTime()
     time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
     
     return time;
-#elif HAVE(SYS_TIME_H)
-    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
-#elif PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    return t.toTime_t() * 1000 + t.time().msec();
 #elif PLATFORM(WIN_OS)
     union {
         FILETIME fileTime;
@@ -97,7 +81,8 @@ static inline unsigned getCPUTime()
     
     return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
 #else
-#error Platform does not have getCurrentTime function
+    // FIXME: We should return the time the current thread has spent executing.
+    return currentTime() * 1000;
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index afb0220..a9472c9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -2283,6 +2283,10 @@ static void sleep(unsigned seconds)
 
 void TCMalloc_PageHeap::scavengerThread()
 {
+#if HAVE(PTHREAD_SETNAME_NP)
+  pthread_setname_np("JavaScriptCore: FastMalloc scavenger");
+#endif
+
   while (1) {
       if (!shouldContinueScavenging()) {
           pthread_mutex_lock(&m_scavengeMutex);
@@ -2388,7 +2392,7 @@ ALWAYS_INLINE void TCMalloc_Central_FreeList::ReleaseToSpans(void* object) {
   // The following check is expensive, so it is disabled by default
   if (false) {
     // Check that object does not occur in list
-    int got = 0;
+    unsigned got = 0;
     for (void* p = span->objects; p != NULL; p = *((void**) p)) {
       ASSERT(p != object);
       got++;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 1fda9c1..165eb41 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -49,24 +49,24 @@ namespace WTF {
         const_iterator begin() const;
         const_iterator end() const;
         
-        iterator find(const ValueType& value);
-        const_iterator find(const ValueType& value) const;
-        bool contains(const ValueType& value) const;
-        unsigned count(const ValueType& value) const;
+        iterator find(const ValueType&);
+        const_iterator find(const ValueType&) const;
+        bool contains(const ValueType&) const;
+        unsigned count(const ValueType&) const;
 
         // increases the count if an equal value is already present
         // the return value is a pair of an interator to the new value's location, 
         // and a bool that is true if an new entry was added
-        std::pair<iterator, bool> add(const ValueType &value);
+        std::pair<iterator, bool> add(const ValueType&);
         
         // reduces the count of the value, and removes it if count
         // goes down to zero
-        void remove(const ValueType& value);
-        void remove(iterator it);
+        void remove(const ValueType&);
+        void remove(iterator);
  
         // removes the value, regardless of its count
-        void clear(iterator it);
-        void clear(const ValueType& value);
+        void removeAll(iterator);
+        void removeAll(const ValueType&);
 
         // clears the whole set
         void clear();
@@ -171,13 +171,13 @@ namespace WTF {
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::clear(const ValueType& value)
+    inline void HashCountedSet<Value, HashFunctions, Traits>::removeAll(const ValueType& value)
     {
-        clear(find(value));
+        removeAll(find(value));
     }
     
     template<typename Value, typename HashFunctions, typename Traits>
-    inline void HashCountedSet<Value, HashFunctions, Traits>::clear(iterator it)
+    inline void HashCountedSet<Value, HashFunctions, Traits>::removeAll(iterator it)
     {
         if (it == end())
             return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index bd82d8f..576e986 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -229,8 +229,7 @@
 #define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
 
 #if   defined(arm) \
-   || defined(__arm__) \
-   || defined(__MARM__)
+   || defined(__arm__)
 #define WTF_PLATFORM_ARM 1
 #if defined(__ARMEB__)
 #define WTF_PLATFORM_BIG_ENDIAN 1
@@ -238,8 +237,8 @@
 #define WTF_PLATFORM_MIDDLE_ENDIAN 1
 #endif
 #define ARM_ARCH_VERSION 3
-#if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__) || defined(ARMV4I) \
-    || defined(_ARMV4I_) || defined(armv4i)
+#if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__) || defined(__MARM_ARMV4__) \
+    || defined(_ARMV4I_)
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 4
 #endif
@@ -255,16 +254,20 @@
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 6
 #endif
-#if defined(__ARM_ARCH_7A__) || defined(__ARMV7__)
+#if defined(__ARM_ARCH_7A__)
 #undef ARM_ARCH_VERSION
 #define ARM_ARCH_VERSION 7
 #endif
+/* On ARMv5 and below the natural alignment is required. */
+#if !defined(ARM_REQUIRE_NATURAL_ALIGNMENT) && ARM_ARCH_VERSION <= 5
+#define ARM_REQUIRE_NATURAL_ALIGNMENT 1
+#endif
 /* Defines two pseudo-platforms for ARM and Thumb-2 instruction set. */
 #if !defined(WTF_PLATFORM_ARM_TRADITIONAL) && !defined(WTF_PLATFORM_ARM_THUMB2)
 #  if defined(thumb2) || defined(__thumb2__)
 #    define WTF_PLATFORM_ARM_TRADITIONAL 0
 #    define WTF_PLATFORM_ARM_THUMB2 1
-#  elif PLATFORM_ARM_ARCH(4) || PLATFORM_ARM_ARCH(5)
+#  elif PLATFORM_ARM_ARCH(4)
 #    define WTF_PLATFORM_ARM_TRADITIONAL 1
 #    define WTF_PLATFORM_ARM_THUMB2 0
 #  else
@@ -420,7 +423,7 @@
 #endif
 #define HAVE_READLINE 1
 #define HAVE_RUNLOOP_TIMER 1
-#endif // PLATFORM(MAC) && !PLATFORM(IPHONE)
+#endif /* PLATFORM(MAC) && !PLATFORM(IPHONE) */
 
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
 #define WTF_PLATFORM_CF 1
@@ -497,6 +500,7 @@
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
 #define HAVE_MADV_FREE_REUSE 1
 #define HAVE_MADV_FREE 1
+#define HAVE_PTHREAD_SETNAME_NP 1
 #endif
 
 #if PLATFORM(IPHONE)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
index 74c02f3..b8fce7e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSpinLock.h
@@ -215,6 +215,13 @@ struct TCMalloc_SpinLock {
   inline void Unlock() {
     if (pthread_mutex_unlock(&private_lock_) != 0) CRASH();
   }
+  bool IsHeld() {
+    if (pthread_mutex_trylock(&private_lock_))
+      return true;
+
+    Unlock();
+    return false;
+  }
 };
 
 #define SPINLOCK_INITIALIZER { PTHREAD_MUTEX_INITIALIZER }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index c241bd9..e4fb419 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -186,7 +186,7 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
 
 void setThreadNameInternal(const char* threadName)
 {
-#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#if HAVE(PTHREAD_SETNAME_NP)
     pthread_setname_np(threadName);
 #else
     UNUSED_PARAM(threadName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
index 4390b5b..d777424 100644
--- a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -549,11 +549,11 @@ class RegexGenerator : private MacroAssembler {
         }
 
         if (mask) {
-            load32(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
+            load32WithUnalignedHalfWords(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
             or32(Imm32(mask), character);
             state.jumpToBacktrack(branch32(NotEqual, character, Imm32(chPair | mask)), this);
         } else
-            state.jumpToBacktrack(branch32(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
+            state.jumpToBacktrack(branch32WithUnalignedHalfWords(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
     }
 
     void generatePatternCharacterFixed(TermGenerationState& state)
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index e13219b..cbec79c 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-24092009 branch/tag
+        qtwebkit-4.6-snapshot-29092009-2 branch/tag
 
 and has the sha1 checksum
 
-        75c44947a340d74a9e0098a3dfffabce0c9512ef
+        999c28aa9f6ad9e0d6a26a794220e1cb45408a97
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 5d83c7b..036fb5e 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,1293 @@
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTK+ also on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
 2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index 758d99d..e91076b 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -76,11 +76,27 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasArray.idl',
+            'html/canvas/CanvasArrayBuffer.idl',
+            'html/canvas/CanvasBuffer.idl',
+            'html/canvas/CanvasByteArray.idl',
+            'html/canvas/CanvasFloatArray.idl',
+            'html/canvas/CanvasFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
+            'html/canvas/CanvasIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
+            'html/canvas/CanvasProgram.idl',
+            'html/canvas/CanvasRenderbuffer.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
+            'html/canvas/CanvasRenderingContext3D.idl',
+            'html/canvas/CanvasShader.idl',
+            'html/canvas/CanvasShortArray.idl',
+            'html/canvas/CanvasUnsignedByteArray.idl',
+            'html/canvas/CanvasUnsignedIntArray.idl',
+            'html/canvas/CanvasUnsignedShortArray.idl',
+            'html/canvas/CanvasTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -607,7 +623,17 @@
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasArrayCustom.h',
+            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
+            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
             'bindings/v8/custom/V8ClientRectListCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
@@ -1221,18 +1247,52 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
+            'html/canvas/CanvasArray.cpp',
+            'html/canvas/CanvasArray.h',
+            'html/canvas/CanvasArrayBuffer.cpp',
+            'html/canvas/CanvasArrayBuffer.h',
+            'html/canvas/CanvasBuffer.cpp',
+            'html/canvas/CanvasBuffer.h',
+            'html/canvas/CanvasByteArray.cpp',
+            'html/canvas/CanvasByteArray.h',
+            'html/canvas/CanvasFloatArray.cpp',
+            'html/canvas/CanvasFloatArray.h',
+            'html/canvas/CanvasFramebuffer.cpp',
+            'html/canvas/CanvasFramebuffer.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
+            'html/canvas/CanvasIntArray.cpp',
+            'html/canvas/CanvasIntArray.h',
+            'html/canvas/CanvasObject.cpp',
+            'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
+            'html/canvas/CanvasProgram.cpp',
+            'html/canvas/CanvasProgram.h',
+            'html/canvas/CanvasRenderbuffer.cpp',
+            'html/canvas/CanvasRenderbuffer.h',
             'html/canvas/CanvasRenderingContext.cpp',
             'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
+            'html/canvas/CanvasRenderingContext3D.cpp',
+            'html/canvas/CanvasRenderingContext3D.h',
+            'html/canvas/CanvasShader.cpp',
+            'html/canvas/CanvasShader.h',
+            'html/canvas/CanvasShortArray.cpp',
+            'html/canvas/CanvasShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
+            'html/canvas/CanvasTexture.cpp',
+            'html/canvas/CanvasTexture.h',
+            'html/canvas/CanvasUnsignedByteArray.cpp',
+            'html/canvas/CanvasUnsignedByteArray.h',
+            'html/canvas/CanvasUnsignedIntArray.cpp',
+            'html/canvas/CanvasUnsignedIntArray.h',
+            'html/canvas/CanvasUnsignedShortArray.cpp',
+            'html/canvas/CanvasUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1667,6 +1727,7 @@
             'page/Geolocation.cpp',
             'page/Geolocation.h',
             'page/Geoposition.h',
+            'page/HaltablePlugin.h',
             'page/History.cpp',
             'page/History.h',
             'page/Location.cpp',
@@ -1685,6 +1746,9 @@
             'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
+            'page/PluginHalter.cpp',
+            'page/PluginHalter.h',
+            'page/PluginHalterClient.h',
             'page/PositionCallback.h',
             'page/PositionError.h',
             'page/PositionErrorCallback.h',
@@ -2081,6 +2145,7 @@
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
             'platform/graphics/GraphicsLayer.h',
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index de3717d..540abad 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -113,6 +113,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 !contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
 
 # turn on SQLITE support if any of the dependent features are turned on
 !contains(DEFINES, ENABLE_SQLITE=.) {
@@ -1137,6 +1138,7 @@ SOURCES += \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/PluginHalter.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
@@ -1811,6 +1813,7 @@ HEADERS += \
     page/FrameView.h \
     page/Geolocation.h \
     page/Geoposition.h \
+    page/HaltablePlugin.h \
     page/History.h \
     page/Location.h \
     page/MouseEventWithHitTestResults.h \
@@ -1819,6 +1822,8 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
+    page/PluginHalter.h \
+    page/PluginHalterClient.h \
     page/PrintContext.h \
     page/Screen.h \
     page/SecurityOrigin.h \
@@ -2482,6 +2487,10 @@ contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
 }
 
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+}
+
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index e217023..14457c4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,4 +59,16 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     setDOMException(exec, ec);
 }
 
+void JSAttr::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->ownerElement()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index c80441d..583d971 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -254,7 +254,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 7bd95b4..1974ab0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,9 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
+
+#include "Element.h"
 #include "NamedNodeMap.h"
-#include "Node.h"
-#include "PlatformString.h"
-#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -47,4 +46,16 @@ JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyNa
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
+void JSNamedNodeMap::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->element()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index a18de49..1cbe8d2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -1596,7 +1596,24 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasArray";
+    return 1 if $type eq "CanvasArrayBuffer";
+    return 1 if $type eq "CanvasBooleanArray";
+    return 1 if $type eq "CanvasByteArray";
+    return 1 if $type eq "CanvasBuffer";
+    return 1 if $type eq "CanvasFloatArray";
+    return 1 if $type eq "CanvasFramebuffer";
     return 1 if $type eq "CanvasGradient";
+    return 1 if $type eq "CanvasIntArray";
+    return 1 if $type eq "CanvasObject";
+    return 1 if $type eq "CanvasProgram";
+    return 1 if $type eq "CanvasRenderbuffer";
+    return 1 if $type eq "CanvasShader";
+    return 1 if $type eq "CanvasShortArray";
+    return 1 if $type eq "CanvasTexture";
+    return 1 if $type eq "CanvasUnsignedByteArray";
+    return 1 if $type eq "CanvasUnsignedIntArray";
+    return 1 if $type eq "CanvasUnsignedShortArray";
     return 1 if $type eq "ClientRect";
     return 1 if $type eq "ClientRectList";
     return 1 if $type eq "CDATASection";
@@ -1725,6 +1742,19 @@ sub GetNativeType
 my %typeCanFailConversion = (
     "AtomicString" => 0,
     "Attr" => 1,
+    "CanvasArray" => 0,
+    "CanvasBuffer" => 0,
+    "CanvasByteArray" => 0,
+    "CanvasFloatArray" => 0,
+    "CanvasFramebuffer" => 0,
+    "CanvasGradient" => 0,
+    "CanvasIntArray" => 0,
+    "CanvasPixelArray" => 0,
+    "CanvasProgram" => 0,
+    "CanvasRenderbuffer" => 0,
+    "CanvasShader" => 0,
+    "CanvasShortArray" => 0,
+    "CanvasTexture" => 0,
     "CompareHow" => 0,
     "DataGridColumn" => 0,
     "DOMString" => 0,
@@ -1734,8 +1764,11 @@ my %typeCanFailConversion = (
     "Event" => 0,
     "EventListener" => 0,
     "EventTarget" => 0,
+    "HTMLCanvasElement" => 0,
     "HTMLElement" => 0,
+    "HTMLImageElement" => 0,
     "HTMLOptionElement" => 0,
+    "HTMLVideoElement" => 0,
     "Node" => 0,
     "NodeFilter" => 0,
     "MessagePort" => 0,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
index 9dafba9..6e62f6d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSImportRule.cpp
@@ -111,7 +111,10 @@ void CSSImportRule::insertedIntoParent()
         root = curr;
     }
 
-    m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
+    if (parentSheet->isUserStyleSheet())
+        m_cachedSheet = docLoader->requestUserCSSStyleSheet(absHref, parentSheet->charset());
+    else
+        m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
     if (m_cachedSheet) {
         // if the import rule is issued dynamically, the sheet may be
         // removed from the pending sheet count, so let the doc know
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
index f12d64f..7f82ca4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
@@ -89,4 +89,51 @@ void CSSSelectorList::deleteSelectors()
     }
 }
 
+
+template <typename Functor>
+static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
+{
+    ASSERT(selector);
+
+    do {
+        if (functor(selector))
+            return true;
+        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
+            if (forEachTagSelector(functor, simpleSelector))
+                return true;
+        }
+    } while ((selector = selector->tagHistory()));
+
+    return false;
+}
+
+template <typename Functor>
+static bool forEachSelector(Functor& functor, const CSSSelectorList* selectorList)
+{
+    for (CSSSelector* selector = selectorList->first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (forEachTagSelector(functor, selector))
+            return true;
+    }
+
+    return false;
+}
+
+class SelectorNeedsNamespaceResolutionFunctor {
+public:
+    bool operator()(CSSSelector* selector)
+    {
+        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
+            return true;
+        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
+            return true;
+        return false;
+    }
+};
+
+bool CSSSelectorList::selectorsNeedNamespaceResolution()
+{
+    SelectorNeedsNamespaceResolutionFunctor functor;
+    return forEachSelector(functor, this);
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.h b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.h
index 3518139..9e40ef8 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.h
@@ -31,25 +31,27 @@
 
 namespace WebCore {
     
-    class CSSSelectorList : public Noncopyable {
-    public:
-        CSSSelectorList() : m_selectorArray(0) { }
-        ~CSSSelectorList();
-
-        void adopt(CSSSelectorList& list);
-        void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
-        
-        CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
-        static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
-        bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
-        
-    private:
-        void deleteSelectors();
-
-        // End of the array is indicated by m_isLastInSelectorList bit in the last item.
-        CSSSelector* m_selectorArray;
-    };
-
-}
-
-#endif
+class CSSSelectorList : public Noncopyable {
+public:
+    CSSSelectorList() : m_selectorArray(0) { }
+    ~CSSSelectorList();
+
+    void adopt(CSSSelectorList& list);
+    void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
+    
+    CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
+    static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
+    bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
+
+    bool selectorsNeedNamespaceResolution();
+
+private:
+    void deleteSelectors();
+
+    // End of the array is indicated by m_isLastInSelectorList bit in the last item.
+    CSSSelector* m_selectorArray;
+};
+
+} // namespace WebCore
+
+#endif // CSSSelectorList_h
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
index ce50af6..1579999 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
@@ -40,20 +40,22 @@ CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, con
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
+    , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(Node *parentNode, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const String& charset)
     : StyleSheet(parentNode, href)
     , m_doc(parentNode->document())
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
+    , m_isUserStyleSheet(false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset)
     : StyleSheet(ownerRule, href)
     , m_namespaces(0)
     , m_charset(charset)
@@ -62,6 +64,7 @@ CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const Strin
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_doc = parentSheet ? parentSheet->doc() : 0;
+    m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
 }
 
 CSSStyleSheet::~CSSStyleSheet()
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
index 8646ee9..f534104 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.h
@@ -93,6 +93,9 @@ public:
     void setStrictParsing(bool b) { m_strictParsing = b; }
     bool useStrictParsing() const { return m_strictParsing; }
 
+    void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
+    bool isUserStyleSheet() const { return m_isUserStyleSheet; }
+
 private:
     CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
     CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset);
@@ -106,6 +109,7 @@ private:
     String m_charset;
     bool m_loadCompleted : 1;
     bool m_strictParsing : 1;
+    bool m_isUserStyleSheet : 1;
 };
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index 29f4be1..c01f34a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 5422bf0..174c0ee 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -1941,7 +1941,8 @@ CSSStyleSheet* Document::pageUserSheet()
         return 0;
     
     // Parse the sheet and cache it.
-    m_pageUserSheet = CSSStyleSheet::create(this);
+    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet->setIsUserStyleSheet(true);
     m_pageUserSheet->parseString(userSheetText, !inCompatMode());
     return m_pageUserSheet.get();
 }
@@ -1973,7 +1974,8 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
         const UserStyleSheetVector* sheets = it->second;
         for (unsigned i = 0; i < sheets->size(); ++i) {
             const UserStyleSheet* sheet = sheets->at(i).get();
-            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this));
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            parsedSheet->setIsUserStyleSheet(true);
             parsedSheet->parseString(sheet->source(), !inCompatMode());
             if (!m_pageGroupUserSheets)
                 m_pageGroupUserSheets.set(new Vector<RefPtr<CSSStyleSheet> >);
@@ -3011,7 +3013,7 @@ String Document::domain() const
     return securityOrigin()->domain();
 }
 
-void Document::setDomain(const String& newDomain)
+void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
@@ -3034,19 +3036,25 @@ void Document::setDomain(const String& newDomain)
     int oldLength = domain().length();
     int newLength = newDomain.length();
     // e.g. newDomain = webkit.org (10) and domain() = www.webkit.org (14)
-    if (newLength >= oldLength)
+    if (newLength >= oldLength) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     String test = domain();
     // Check that it's a subdomain, not e.g. "ebkit.org"
-    if (test[oldLength - newLength - 1] != '.')
+    if (test[oldLength - newLength - 1] != '.') {
+        ec = SECURITY_ERR;
         return;
+    }
 
     // Now test is "webkit.org" from domain()
     // and we check that it's the same thing as newDomain
     test.remove(0, oldLength - newLength);
-    if (test != newDomain)
+    if (test != newDomain) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     securityOrigin()->setDomainFromDOM(newDomain);
     if (m_frame)
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 454304b..2805562 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -672,7 +672,7 @@ public:
     String referrer() const;
 
     String domain() const;
-    void setDomain(const String& newDomain);
+    void setDomain(const String& newDomain, ExceptionCode&);
 
     String lastModified() const;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index 34a9771..822f860 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -155,7 +155,8 @@ module core {
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString domain;
+                 attribute [ConvertNullToNullString] DOMString domain
+                     setter raises (DOMException);
 #else
         readonly attribute DOMString domain;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index f04723f..50ff033 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -28,6 +28,8 @@
 
 #include "AXObjectCache.h"
 #include "Attr.h"
+#include "CSSParser.h"
+#include "CSSSelectorList.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
 #include "ClientRect.h"
@@ -280,42 +282,6 @@ static int adjustForLocalZoom(int value, RenderObject* renderer)
     return static_cast<int>(value / zoomFactor);
 }
 
-static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
-{
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return value;
-    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
-    if (zoomFactor > 1)
-        value++;
-    return static_cast<int>(value / zoomFactor);
-}
-
-static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
-{
-    // The result here is in floats, so we don't need the truncation hack from the integer version above.
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return point;
-    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
-}
-
-static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
-{
-    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
-    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
-    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
-    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
-}
-
-static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
-{
-    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
-    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
-    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
-    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
-}
-
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -1406,6 +1372,39 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
+{
+    if (selector.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    bool strictParsing = !document()->inCompatMode();
+    CSSParser p(strictParsing);
+
+    CSSSelectorList selectorList;
+    p.parseSelector(selector, document(), selectorList);
+
+    if (!selectorList.first()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
+    if (selectorList.selectorsNeedNamespaceResolution()) {
+        ec = NAMESPACE_ERR;
+        return false;
+    }
+
+    CSSStyleSelector::SelectorChecker selectorChecker(document(), strictParsing);
+    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (selectorChecker.checkSelector(selector, this))
+            return true;
+    }
+
+    return false;
+}
+
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index 4ecf932..d27976a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -231,6 +231,8 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index cbb36d9..d90f819 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -111,6 +111,10 @@ module core {
             raises(DOMException);
 
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // WebKit extension, pending specification.
+        boolean webkitMatchesSelector(in DOMString selectors)
+            raises(DOMException);
+
         // ElementTraversal API
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 4499328..2d612e1 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -202,6 +202,7 @@ namespace WebCore {
 
         d->eventListenerMap.clear();
     }
+#endif
 
     inline bool EventTarget::isFiringEventListeners()
     {
@@ -227,8 +228,6 @@ namespace WebCore {
         return d->eventListenerMap.contains(eventType);
     }
 
-#endif
-
 } // namespace WebCore
 
 #endif // EventTarget_h
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index 96e31f4..c29cb1c 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -56,8 +56,6 @@ void InputElement::dispatchFocusEvent(InputElement* inputElement, Element* eleme
     if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(inputElement, element);
-
     Document* document = element->document();
     if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
@@ -73,29 +71,12 @@ void InputElement::dispatchBlurEvent(InputElement* inputElement, Element* elemen
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(inputElement, element);
-
     if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
 
     frame->textFieldDidEndEditing(element);
 }
 
-bool InputElement::placeholderShouldBeVisible(const InputElement* inputElement, const Element* element)
-{
-    return inputElement->value().isEmpty()
-        && element->document()->focusedNode() != element
-        && !inputElement->placeholder().isEmpty();
-}
-
-void InputElement::updatePlaceholderVisibility(InputElement* inputElement, Element* element, bool placeholderValueChanged)
-{
-    ASSERT(inputElement->isTextField());
-    bool placeholderVisible = inputElement->placeholderShouldBeVisible();
-    if (element->renderer())
-        toRenderTextControlSingleLine(element->renderer())->updatePlaceholderVisibility(placeholderVisible, placeholderValueChanged);
-}
-
 void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
 {
     ASSERT(inputElement->isTextField());
@@ -138,10 +119,7 @@ void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
     // Renderer and our event handler are responsible for sanitizing values.
-    ASSERT(value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
-
-    if (inputElement->isTextField())
-        updatePlaceholderVisibility(inputElement, element);
+    ASSERT_UNUSED(inputElement, value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
index 746e4f2..e0e7110 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -44,16 +44,12 @@ public:
     virtual bool isSearchField() const = 0;
     virtual bool isTextField() const = 0;
 
-    virtual bool placeholderShouldBeVisible() const = 0;
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
     virtual String value() const = 0;
     virtual void setValue(const String&) = 0;
 
-    virtual String placeholder() const = 0;
-    virtual void setPlaceholder(const String&) = 0;
-
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
 
@@ -66,8 +62,6 @@ public:
 protected:
     static void dispatchFocusEvent(InputElement*, Element*);
     static void dispatchBlurEvent(InputElement*, Element*);
-    static bool placeholderShouldBeVisible(const InputElement*, const Element*);
-    static void updatePlaceholderVisibility(InputElement*, Element*, bool placeholderValueChanged = false);
     static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
     static void updateSelectionRange(InputElement*, Element*, int start, int end);
     static void aboutToUnload(InputElement*, Element*);
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index fe631c8..d4ec598 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -178,10 +178,8 @@ Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreA
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && 
-            m_attributes[i]->name().localName() == name)
-                return m_attributes[i].get();
-
+        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
+            return m_attributes[i].get();
         if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
             return m_attributes[i].get();
     }
@@ -206,10 +204,12 @@ void NamedNodeMap::clearAttributes()
 
 void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedNodeMap w/o an element in case someone still has a reference
-    // to if after the element gets deleted - but the map is now invalid
+    // This can't happen if the holder of the map is JavaScript, because we mark the
+    // element if the map is alive. So it has no impact on web page behavior. Because
+    // of that, we can simply clear all the attributes to avoid accessing stale
+    // pointers to do things like create Attr objects.
     m_element = 0;
-    detachAttributesFromElement();
+    clearAttributes();
 }
 
 void NamedNodeMap::setAttributes(const NamedNodeMap& other)
@@ -251,7 +251,7 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
         attr->m_element = m_element;
 
     // Notify the element that the attribute has been added, and dispatch appropriate mutation events
-    // Note that element may be null here if we are called from insertAttr() during parsing
+    // Note that element may be null here if we are called from insertAttribute() during parsing
     if (m_element) {
         m_element->attributeChanged(attribute.get());
         // Because of our updateStyleAttribute() style modification events are never sent at the right time, so don't bother sending them.
@@ -265,12 +265,13 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
-    unsigned index = len + 1;
-    for (unsigned i = 0; i < len; ++i)
+    unsigned index = len;
+    for (unsigned i = 0; i < len; ++i) {
         if (m_attributes[i]->name().matches(name)) {
             index = i;
             break;
         }
+    }
 
     if (index >= len)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 4fb96de..759900b 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -94,11 +94,11 @@ public:
     void addAttribute(PassRefPtr<Attribute>);
     void removeAttribute(const QualifiedName&);
 
+    Element* element() const { return m_element; }
+
 protected:
     virtual void clearAttributes();
 
-    Element* element() const { return m_element; }
-
 private:
     void detachAttributesFromElement();
     void detachFromElement();
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
index 3310ded..8166853 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 2240dd8..c899f3d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -1626,52 +1626,6 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return ClassNodeList::create(this, classNames, result.first->second.get());
 }
 
-template <typename Functor>
-static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
-{
-    ASSERT(selector);
-
-    do {
-        if (functor(selector))
-            return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
-        }
-    } while ((selector = selector->tagHistory()));
-
-    return false;
-}
-
-template <typename Functor>
-static bool forEachSelector(Functor& functor, const CSSSelectorList& selectorList)
-{
-    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
-        if (forEachTagSelector(functor, selector))
-            return true;
-    }
-
-    return false;
-}
-
-class SelectorNeedsNamespaceResolutionFunctor {
-public:
-    bool operator()(CSSSelector* selector)
-    {
-        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
-            return true;
-        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
-            return true;
-        return false;
-    }
-};
-
-static bool selectorNeedsNamespaceResolution(const CSSSelectorList& selectorList)
-{
-    SelectorNeedsNamespaceResolutionFunctor functor;
-    return forEachSelector(functor, selectorList);
-}
-
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1690,7 +1644,7 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
     }
 
     // throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1738,7 +1692,7 @@ PassRefPtr<NodeList> Node::querySelectorAll(const String& selectors, ExceptionCo
     }
 
     // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index 0503597..122130d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,7 +26,10 @@
 #include "RangeException.h"
 
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "DocumentFragment.h"
+#include "FrameView.h"
 #include "HTMLElement.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
@@ -1821,4 +1824,89 @@ void Range::expand(const String& unit, ExceptionCode& ec)
     setEnd(end.deepEquivalent().containerNode(), end.deepEquivalent().computeOffsetInContainerNode(), ec);
 }
 
+PassRefPtr<ClientRectList> Range::getClientRects() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Range::getBoundingClientRect() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result;
+    for (size_t i = 0; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    return ClientRect::create(result);
+}
+
+static void adjustFloatQuadsForScrollAndAbsoluteZoom(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
+{
+    FrameView* view = document->view();
+    if (!view)
+        return;
+
+    IntRect visibleContentRect = view->visibleContentRect();
+    for (size_t i = 0; i < quads.size(); ++i) {
+        quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+        adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
+    }
+}
+
+void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
+{
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+    Node* stopNode = pastLastNode();
+
+    HashSet<Node*> nodeSet;
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode())
+            nodeSet.add(node);
+    }
+
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode()) {
+            if (!nodeSet.contains(node->parentNode())) {
+                if (RenderBoxModelObject* renderBoxModelObject = static_cast<Element*>(node)->renderBoxModelObject()) {
+                    Vector<FloatQuad> elementQuads;
+                    renderBoxModelObject->absoluteQuads(elementQuads);
+                    adjustFloatQuadsForScrollAndAbsoluteZoom(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
+
+                    quads.append(elementQuads);
+                }
+            }
+        } else if (node->isTextNode()) {
+            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+                RenderText* renderText = toRenderText(renderer);
+                int startOffset = (node == startContainer) ? m_start.offset() : 0;
+                int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
+                
+                Vector<FloatQuad> textQuads;
+                renderText->absoluteQuadsForRange(textQuads, startOffset, endOffset);
+                adjustFloatQuadsForScrollAndAbsoluteZoom(textQuads, m_ownerDocument.get(), renderText);
+
+                quads.append(textQuads);
+            }
+        }
+    }
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 3382c84..e2e282b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,12 +25,15 @@
 #ifndef Range_h
 #define Range_h
 
+#include "FloatQuad.h"
 #include "RangeBoundaryPoint.h"
+#include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
+class ClientRect;
+class ClientRectList;
 class DocumentFragment;
 class NodeWithIndex;
 class Text;
@@ -117,6 +120,9 @@ public:
     // for details.
     void expand(const String&, ExceptionCode&);
 
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
@@ -135,6 +141,8 @@ private:
     enum ActionType { DELETE_CONTENTS, EXTRACT_CONTENTS, CLONE_CONTENTS };
     PassRefPtr<DocumentFragment> processContents(ActionType, ExceptionCode&);
 
+    void getBorderAndTextQuads(Vector<FloatQuad>&) const;
+
     RefPtr<Document> m_ownerDocument;
     RangeBoundaryPoint m_start;
     RangeBoundaryPoint m_end;
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 633bd90..9024e09 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -85,6 +85,13 @@ module ranges {
         void detach()
             raises(DOMException);
 
+#if defined(LANGUAGE_JAVASCRIPT) || LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API extensions
+
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
         // extensions
 
         DocumentFragment createContextualFragment(in DOMString html)
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 88d2279..c34a341 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -29,7 +29,8 @@
 
 namespace WebCore {
 
-    struct RegisteredEventListener {
+    class RegisteredEventListener {
+    public:
         RegisteredEventListener(PassRefPtr<EventListener> listener, bool useCapture)
             : listener(listener)
             , useCapture(useCapture)
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index 00db1c1..1ce074a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -315,10 +315,15 @@ PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& d
     unsigned end = start + min(charsLeft, maxChars);
     
     // Check we are not on an unbreakable boundary.
-    TextBreakIterator* it = characterBreakIterator(data.characters(), dataLength);
-    if (end < dataLength && !isTextBreak(it, end))
-        end = textBreakPreceding(it, end);
-        
+    // Some text break iterator implementations work best if the passed buffer is as small as possible, 
+    // see <https://bugs.webkit.org/show_bug.cgi?id=29092>. 
+    // We need at least two characters look-ahead to account for UTF-16 surrogates.
+    if (end < dataLength) {
+        TextBreakIterator* it = characterBreakIterator(data.characters() + start, (end + 2 > dataLength) ? dataLength - start : end - start + 2);
+        if (!isTextBreak(it, end - start))
+            end = textBreakPreceding(it, end - start) + start;
+    }
+    
     // If we have maxChars of unbreakable characters the above could lead to
     // an infinite loop.
     // FIXME: It would be better to just have the old value of end before calling
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 9823aba..695f46a 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -103,6 +103,30 @@ bool InsertParagraphSeparatorCommand::shouldUseDefaultParagraphElement(Node* enc
            enclosingBlock->hasTagName(h5Tag);
 }
 
+void InsertParagraphSeparatorCommand::getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors)
+{
+    ancestors.clear();
+    
+    // Build up list of ancestors elements between the insertion node and the outer block.
+    if (insertionNode != outerBlock) {
+        for (Element* n = insertionNode->parentElement(); n && n != outerBlock; n = n->parentElement())
+            ancestors.append(n);
+    }
+}
+
+PassRefPtr<Element> InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert)
+{
+    // Make clones of ancestors in between the start node and the start block.
+    RefPtr<Element> parent = blockToInsert;
+    for (size_t i = ancestors.size(); i != 0; --i) {
+        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
+        appendNode(child, parent);
+        parent = child.release();
+    }
+    
+    return parent.release();
+}
+
 void InsertParagraphSeparatorCommand::doApply()
 {
     bool splitText = false;
@@ -193,12 +217,18 @@ void InsertParagraphSeparatorCommand::doApply()
             insertNodeAfter(blockToInsert, startBlock);
         }
 
-        appendBlockPlaceholder(blockToInsert);
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        if (shouldApplyStyleAfterInsertion)
-            applyStyleAfterInsertion(startBlock);
+        // Recreate the same structure in the new paragraph.
+        
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);      
+        RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
+        
+        appendBlockPlaceholder(parent);
+
+        setEndingSelection(VisibleSelection(Position(parent.get(), 0), DOWNSTREAM));
         return;
     }
+    
 
     //---------------------------------------------------------------------
     // Handle case when position is in the first visible position in its block, and
@@ -217,9 +247,15 @@ void InsertParagraphSeparatorCommand::doApply()
         insertionPosition = insertionPosition.downstream();
         
         insertNodeBefore(blockToInsert, refNode);
-        appendBlockPlaceholder(blockToInsert.get());
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        applyStyleAfterInsertion(startBlock);
+
+        // Recreate the same structure in the new paragraph.
+
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(positionAvoidingSpecialElementBoundary(insertionPosition).node(), startBlock, ancestors);
+        
+        appendBlockPlaceholder(cloneHierarchyUnderNewBlock(ancestors, blockToInsert));
+        
+        // In this case, we need to set the new ending selection.
         setEndingSelection(VisibleSelection(insertionPosition, DOWNSTREAM));
         return;
     }
@@ -248,10 +284,7 @@ void InsertParagraphSeparatorCommand::doApply()
 
     // Build up list of ancestors in between the start node and the start block.
     Vector<Element*> ancestors;
-    if (insertionPosition.node() != startBlock) {
-        for (Element* n = insertionPosition.node()->parentElement(); n && n != startBlock; n = n->parentElement())
-            ancestors.append(n);
-    }
+    getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
@@ -284,13 +317,8 @@ void InsertParagraphSeparatorCommand::doApply()
 
     updateLayout();
     
-    // Make clones of ancestors in between the start node and the start block.
-    RefPtr<Element> parent = blockToInsert;
-    for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
-        appendNode(child, parent);
-        parent = child.release();
-    }
+    // Make clones of ancestors in between the start node and the outer block.
+    RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
 
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.h b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.h
index 01c08bf..23ee51c 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.h
@@ -44,6 +44,8 @@ private:
 
     void calculateStyleBeforeInsertion(const Position&);
     void applyStyleAfterInsertion(Node* originalEnclosingBlock);
+    void getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors);
+    PassRefPtr<Element> cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert);
     
     bool shouldUseDefaultParagraphElement(Node*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index e7fd69c..c6843ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -44,6 +44,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void markChildren(JSC::MarkStack&);
+
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
@@ -62,6 +64,10 @@ public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
     JSAttrPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 772be76..9820998 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -1045,7 +1045,9 @@ void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
-    imp->setDomain(valueToStringWithNullCheck(exec, value));
+    ExceptionCode ec = 0;
+    imp->setDomain(valueToStringWithNullCheck(exec, value), ec);
+    setDOMException(exec, ec);
 }
 
 void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValue value)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index f487532..c074e40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -171,7 +171,7 @@ bool JSElementConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 
 /* Hash table for prototype */
 
-static const HashTableValue JSElementPrototypeTableValues[28] =
+static const HashTableValue JSElementPrototypeTableValues[29] =
 {
     { "getAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttribute, (intptr_t)1 },
     { "setAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttribute, (intptr_t)2 },
@@ -198,6 +198,7 @@ static const HashTableValue JSElementPrototypeTableValues[28] =
     { "getElementsByClassName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
     { "querySelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelector, (intptr_t)1 },
     { "querySelectorAll", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "webkitMatchesSelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionWebkitMatchesSelector, (intptr_t)1 },
     { "getClientRects", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetClientRects, (intptr_t)0 },
     { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -1633,6 +1634,22 @@ JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec
     return result;
 }
 
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionWebkitMatchesSelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSElement::s_info))
+        return throwError(exec, TypeError);
+    JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& selectors = args.at(0).toString(exec);
+
+
+    JSC::JSValue result = jsBoolean(imp->webkitMatchesSelector(selectors, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 8d72032..770dc43 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -116,6 +116,7 @@ JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(JSC::ExecStat
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionWebkitMatchesSelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
index 77b4b7c..7059003 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.cpp
@@ -96,7 +96,7 @@ bool JSInspectorBackendConstructor::getOwnPropertyDescriptor(ExecState* exec, co
 
 /* Hash table for prototype */
 
-static const HashTableValue JSInspectorBackendPrototypeTableValues[69] =
+static const HashTableValue JSInspectorBackendPrototypeTableValues[70] =
 {
     { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
     { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
@@ -156,6 +156,7 @@ static const HashTableValue JSInspectorBackendPrototypeTableValues[69] =
     { "setAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetAttribute, (intptr_t)4 },
     { "removeAttribute", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionRemoveAttribute, (intptr_t)3 },
     { "setTextNodeValue", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionSetTextNodeValue, (intptr_t)3 },
+    { "copyNode", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionCopyNode, (intptr_t)1 },
     { "nodeForId", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionNodeForId, (intptr_t)1 },
     { "wrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionWrapObject, (intptr_t)1 },
     { "unwrapObject", DontDelete|Function, (intptr_t)jsInspectorBackendPrototypeFunctionUnwrapObject, (intptr_t)1 },
@@ -955,6 +956,19 @@ JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(ExecSt
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSInspectorBackend::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorBackend* castedThisObj = static_cast<JSInspectorBackend*>(asObject(thisValue));
+    InspectorBackend* imp = static_cast<InspectorBackend*>(castedThisObj->impl());
+    int nodeId = args.at(0).toInt32(exec);
+
+    imp->copyNode(nodeId);
+    return jsUndefined();
+}
+
 JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
index fec9031..37fd8b8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorBackend.h
@@ -148,6 +148,7 @@ JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionGetChildNodes(JSC:
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionSetTextNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionCopyNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionNodeForId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionWrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsInspectorBackendPrototypeFunctionUnwrapObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 3b73a2d..11b3101 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -47,6 +47,8 @@ public:
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void markChildren(JSC::MarkStack&);
+
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
     NamedNodeMap* impl() const { return m_impl.get(); }
@@ -72,7 +74,7 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasDefaultMark));
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
     JSNamedNodeMapPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index 9968a29..8faa98f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -21,7 +21,11 @@
 #include "config.h"
 #include "JSRange.h"
 
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "DocumentFragment.h"
+#include "JSClientRect.h"
+#include "JSClientRectList.h"
 #include "JSDocumentFragment.h"
 #include "JSNode.h"
 #include "JSRange.h"
@@ -114,7 +118,7 @@ bool JSRangeConstructor::getOwnPropertyDescriptor(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSRangePrototypeTableValues[33] =
+static const HashTableValue JSRangePrototypeTableValues[35] =
 {
     { "START_TO_START", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_START, (intptr_t)0 },
     { "START_TO_END", DontDelete|ReadOnly, (intptr_t)jsRangeSTART_TO_END, (intptr_t)0 },
@@ -142,6 +146,8 @@ static const HashTableValue JSRangePrototypeTableValues[33] =
     { "cloneRange", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCloneRange, (intptr_t)0 },
     { "toString", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionToString, (intptr_t)0 },
     { "detach", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionDetach, (intptr_t)0 },
+    { "getClientRects", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionGetClientRects, (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
     { "createContextualFragment", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCreateContextualFragment, (intptr_t)1 },
     { "intersectsNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionIntersectsNode, (intptr_t)1 },
     { "compareNode", DontDelete|Function, (intptr_t)jsRangePrototypeFunctionCompareNode, (intptr_t)1 },
@@ -155,7 +161,7 @@ static JSC_CONST_HASHTABLE HashTable JSRangePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSRangePrototypeTableValues, 0 };
 #else
-    { 72, 63, JSRangePrototypeTableValues, 0 };
+    { 132, 127, JSRangePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSRangePrototype::s_info = { "RangePrototype", 0, &JSRangePrototypeTable, 0 };
@@ -545,6 +551,32 @@ JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*,
     return jsUndefined();
 }
 
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionGetClientRects(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSRange::s_info))
+        return throwError(exec, TypeError);
+    JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
+    Range* imp = static_cast<Range*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getClientRects()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionGetBoundingClientRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.inherits(&JSRange::s_info))
+        return throwError(exec, TypeError);
+    JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
+    Range* imp = static_cast<Range*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->getBoundingClientRect()));
+    return result;
+}
+
 JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     UNUSED_PARAM(args);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index 1752888..6bd51e9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -91,6 +91,8 @@ JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(JSC::ExecSta
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionGetClientRects(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index bc74ecf..8e66fe0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -39,6 +39,7 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderBox.h"
+#include "RenderTextControl.h"
 #include "RenderTheme.h"
 #include "ValidityState.h"
 
@@ -368,4 +369,43 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     }
 }
 
+HTMLTextFormControlElement::HTMLTextFormControlElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, doc, form)
+{
+}
+
+HTMLTextFormControlElement::~HTMLTextFormControlElement()
+{
+}
+
+void HTMLTextFormControlElement::dispatchFocusEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleFocusEvent();
+    HTMLFormControlElementWithState::dispatchFocusEvent();
+}
+
+void HTMLTextFormControlElement::dispatchBlurEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleBlurEvent();
+    HTMLFormControlElementWithState::dispatchBlurEvent();
+}
+
+bool HTMLTextFormControlElement::placeholderShouldBeVisible() const
+{
+    return supportsPlaceholder()
+        && isEmptyValue()
+        && document()->focusedNode() != this
+        && !getAttribute(placeholderAttr).isEmpty();
+}
+
+void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderValueChanged)
+{
+    if (supportsPlaceholder() && renderer())
+        toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
+}
+
 } // namespace Webcore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index ee7d772..7b3cfbd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -143,6 +143,28 @@ protected:
     virtual void didMoveToNewOwnerDocument();
 };
 
+class HTMLTextFormControlElement : public HTMLFormControlElementWithState {
+public:
+    HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
+    virtual ~HTMLTextFormControlElement();
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+protected:
+    bool placeholderShouldBeVisible() const;
+    void updatePlaceholderVisibility(bool);
+
+private:
+    // A subclass should return true if placeholder processing is needed.
+    virtual bool supportsPlaceholder() const = 0;
+    // Returns true if user-editable value is empty.  This is used to check placeholder visibility.
+    virtual bool isEmptyValue() const = 0;
+    // Called in dispatchFocusEvent(), after placeholder process, before calling parent's dispatchFocusEvent().
+    virtual void handleFocusEvent() { }
+    // Called in dispatchBlurEvent(), after placeholder process, before calling parent's dispatchBlurEvent().
+    virtual void handleBlurEvent() { }
+};
+
 } //namespace
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index 5ba780a..0aefe7f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -71,7 +71,7 @@ using namespace HTMLNames;
 const int maxSavedResults = 256;
 
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
+    : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
     , m_yPos(0)
     , m_maxResults(-1)
@@ -257,20 +257,17 @@ bool HTMLInputElement::shouldUseInputMethod() const
     return m_type == TEXT || m_type == SEARCH || m_type == ISINDEX;
 }
 
-void HTMLInputElement::dispatchFocusEvent()
+void HTMLInputElement::handleFocusEvent()
 {
     InputElement::dispatchFocusEvent(this, this);
 
     if (isTextField())
         m_autofilled = false;
-
-    HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
-void HTMLInputElement::dispatchBlurEvent()
+void HTMLInputElement::handleBlurEvent()
 {
     InputElement::dispatchBlurEvent(this, this);
-    HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
 void HTMLInputElement::setType(const String& t)
@@ -741,8 +738,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         }
         setNeedsStyleRecalc();
     } else if (attr->name() == placeholderAttr) {
-        if (isTextField())
-            updatePlaceholderVisibility();
+        updatePlaceholderVisibility(true);
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
@@ -814,7 +810,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case TELEPHONE:
         case TEXT:
         case URL:
-            return new (arena) RenderTextControlSingleLine(this);
+            return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
     return 0;
@@ -1111,7 +1107,7 @@ void HTMLInputElement::setValue(const String& value)
         else {
             m_data.setValue(sanitizeValue(value));
             if (isTextField()) {
-                InputElement::updatePlaceholderVisibility(this, this);
+                updatePlaceholderVisibility(false);
                 if (inDocument())
                     document()->updateStyleIfNeeded();
             }
@@ -1151,6 +1147,7 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
 {
     // File upload controls will always use setFileListFromRenderer.
     ASSERT(inputType() != FILE);
+    updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
 }
 
@@ -1790,11 +1787,6 @@ bool HTMLInputElement::willValidate() const
            inputType() != BUTTON && inputType() != RESET;
 }
 
-bool HTMLInputElement::placeholderShouldBeVisible() const
-{
-    return InputElement::placeholderShouldBeVisible(this, this);
-}
-
 bool HTMLInputElement::formStringToDouble(const String& src, double* out)
 {
     // See HTML5 2.4.4.3 `Real numbers.'
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 8f273cb..63d1634 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -37,7 +37,7 @@ class HTMLOptionElement;
 class KURL;
 class VisibleSelection;
 
-class HTMLInputElement : public HTMLFormControlElementWithState, public InputElement {
+class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
         TEXT,
@@ -75,8 +75,6 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return inputType() != IMAGE; }
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
@@ -230,8 +228,6 @@ public:
     
     virtual bool willValidate() const;
 
-    virtual bool placeholderShouldBeVisible() const;
-
     // Converts the specified string to a floating number.
     // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
     // The double* parameter may be 0.
@@ -241,11 +237,6 @@ protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
-    void updatePlaceholderVisibility()
-    {
-        InputElement::updatePlaceholderVisibility(this, this, true);
-    }
-
 private:
     bool storesValueSeparateFromAttribute() const;
 
@@ -253,6 +244,11 @@ private:
     void registerForActivationCallbackIfNeeded();
     void unregisterForActivationCallbackIfNeeded();
 
+    virtual bool supportsPlaceholder() const { return isTextField(); }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual void handleFocusEvent();
+    virtual void handleBlurEvent();
+
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
index bcfa623..31fafa6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
@@ -44,7 +44,7 @@ void HTMLIsIndexElement::parseMappedAttribute(MappedAttribute* attr)
     if (attr->name() == promptAttr)
         setValue(attr->value());
     else if (attr->name() == placeholderAttr)
-        updatePlaceholderVisibility();
+        updatePlaceholderVisibility(true);
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index 3cf4852..f398fc2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -63,7 +63,7 @@ static inline void notifyFormStateChanged(const HTMLTextAreaElement* element)
 }
 
 HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElementWithState(tagName, document, form)
+    : HTMLTextFormControlElement(tagName, document, form)
     , m_rows(defaultRows)
     , m_cols(defaultCols)
     , m_wrap(SoftWrap)
@@ -211,7 +211,7 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlMultiLine(this);
+    return new (arena) RenderTextControlMultiLine(this, placeholderShouldBeVisible());
 }
 
 bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
@@ -448,29 +448,4 @@ bool HTMLTextAreaElement::shouldUseInputMethod() const
     return true;
 }
 
-bool HTMLTextAreaElement::placeholderShouldBeVisible() const
-{
-    return value().isEmpty()
-        && document()->focusedNode() != this
-        && !getAttribute(placeholderAttr).isEmpty();
-}
-
-void HTMLTextAreaElement::updatePlaceholderVisibility(bool placeholderValueChanged)
-{
-    if (renderer())
-        toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
-}
-
-void HTMLTextAreaElement::dispatchFocusEvent()
-{
-    updatePlaceholderVisibility(false);
-    HTMLFormControlElementWithState::dispatchFocusEvent();
-}
-
-void HTMLTextAreaElement::dispatchBlurEvent()
-{
-    updatePlaceholderVisibility(false);
-    HTMLFormControlElementWithState::dispatchBlurEvent();
-}
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index fbf519d..ef96fc5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -31,7 +31,7 @@ namespace WebCore {
 class BeforeTextInsertedEvent;
 class VisibleSelection;
 
-class HTMLTextAreaElement : public HTMLFormControlElementWithState {
+class HTMLTextAreaElement : public HTMLTextFormControlElement {
 public:
     HTMLTextAreaElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
@@ -97,17 +97,15 @@ public:
 
     virtual bool shouldUseInputMethod() const;
 
-    bool placeholderShouldBeVisible() const;
-
 private:
     enum WrapMethod { NoWrap, SoftWrap, HardWrap };
 
     void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) const;
     static String sanitizeUserInputValue(const String&, unsigned maxLength);
     void updateValue() const;
-    void updatePlaceholderVisibility(bool placeholderValueChanged);
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
+
+    virtual bool supportsPlaceholder() const { return true; }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
 
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
index c140b13..ad0c510 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.cpp
@@ -45,6 +45,7 @@
 #include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorResource.h"
+#include "Pasteboard.h"
 #include "ScriptFunctionCall.h"
 
 #if ENABLE(DOM_STORAGE)
@@ -57,6 +58,8 @@
 using namespace JSC;
 #endif
 
+#include "markup.h"
+
 #include <wtf/RefPtr.h>
 #include <wtf/StdLibExtras.h>
 
@@ -446,6 +449,15 @@ void InspectorBackend::setTextNodeValue(long callId, long nodeId, const String&
         domAgent->setTextNodeValue(callId, nodeId, value);
 }
 
+void InspectorBackend::copyNode(long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node)
+        return;
+    String markup = createMarkup(node);
+    Pasteboard::generalPasteboard()->writePlainText(markup);
+}
+
 void InspectorBackend::highlight(long nodeId)
 {
     if (Node* node = nodeForId(nodeId))
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
index 038ae14..739d28e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.h
@@ -138,6 +138,7 @@ public:
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
     void setTextNodeValue(long callId, long nodeId, const String& value);
+    void copyNode(long nodeId);
 
     // Generic code called from custom implementations.
     void highlight(long nodeId);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
index 395e7fd..d8ccf9f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorBackend.idl
@@ -109,6 +109,7 @@ module core {
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
         void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
+        void copyNode(in long nodeId);
 
         // Called from InjectedScript.
         [Custom] DOMObject nodeForId(in long nodeId);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 69a7e60..e65f21c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -503,6 +503,13 @@ void InspectorController::handleMousePressOnNode(Node* node)
     inspect(node);
 }
 
+void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
+{
+    if (!enabled() || !m_frontend || frame != m_inspectedPage->mainFrame())
+        return;
+    resetInjectedScript();
+}
+
 void InspectorController::windowScriptObjectAvailable()
 {
     if (!m_page || !enabled())
@@ -644,9 +651,7 @@ void InspectorController::populateScriptObjects()
     if (!m_frontend)
         return;
 
-    // Initialize dom agent and reset injected script state first.
-    if (m_domAgent->setDocument(m_inspectedPage->mainFrame()->document()))
-        resetInjectedScript();
+    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
@@ -694,6 +699,7 @@ void InspectorController::resetScriptObjects()
         m_timelineAgent->reset();
 
     m_frontend->reset();
+    m_domAgent->setDocument(0);
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -758,10 +764,9 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // identifierForInitialRequest.
                 m_mainResource = 0;
             }
+            if (windowVisible())
+                m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
         }
-
-        if (m_domAgent && m_domAgent->setDocument(m_inspectedPage->mainFrame()->document()))
-            resetInjectedScript();
     }
 
     for (Frame* frame = loader->frame(); frame; frame = frame->tree()->traverseNext(loader->frame()))
@@ -1089,7 +1094,8 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     m_databaseResources.add(resource);
 
-    if (m_frontend)
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
@@ -1109,7 +1115,9 @@ void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLoca
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
     m_domStorageResources.add(resource);
-    if (m_frontend)
+
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 20295aa..ff7a516 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -196,6 +196,7 @@ public:
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
+    void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
     void setFrontendProxyObject(ScriptState* state, ScriptObject webInspectorObj, ScriptObject injectedScriptObj = ScriptObject());
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
index 4a4902d..d893796 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.cpp
@@ -70,10 +70,10 @@ InspectorDOMAgent::~InspectorDOMAgent()
     setDocument(0);
 }
 
-bool InspectorDOMAgent::setDocument(Document* doc)
+void InspectorDOMAgent::setDocument(Document* doc)
 {
     if (doc == mainFrameDocument())
-        return false;
+        return;
     discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
@@ -88,7 +88,6 @@ bool InspectorDOMAgent::setDocument(Document* doc)
             pushDocumentToFrontend();
         }
     }
-    return true;
 }
 
 void InspectorDOMAgent::releaseDanglingNodes()
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
index bd539a5..c430c57 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMAgent.h
@@ -75,7 +75,7 @@ namespace WebCore {
         void getCookies(long callId);
 
         // Methods called from the InspectorController.
-        bool setDocument(Document* document);
+        void setDocument(Document* document);
         void releaseDanglingNodes();
 
         Node* nodeForId(long nodeId);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
index 99a2dba..7ed0d7f 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -79,7 +79,9 @@ void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
 
 void InspectorDOMStorageResource::unbind()
 {
-    ASSERT(m_frontend);
+    if (!m_frontend)
+        return;  // Already unbound.
+
     if (m_reportingChangesToFrontend) {
         m_frame->domWindow()->removeEventListener(eventNames().storageEvent, this, true);
         m_reportingChangesToFrontend = false;
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
index 3bdfa97..c9793cb 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -83,13 +83,8 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
             function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i]));
-    } else {
-        // FIXME: avoid manual wrapping here.
-        ScriptObject textWrapper = ScriptObject::createNew(m_scriptState);
-        textWrapper.set("type", "string");
-        textWrapper.set("description", message);
-        function->appendArgument(textWrapper);
-    }
+    } else
+        function->appendArgument(message);
     function->call();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
index 6657120..e460ae8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -235,7 +235,7 @@ bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber
         // An erroneous condition counts as "false".
         return false;
     }
-    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject()->globalExec());
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
 }
 
 void JavaScriptDebugServer::clearBreakpoints()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
index 575b13a..4f50ecc 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ConsoleView.js
@@ -608,7 +608,7 @@ WebInspector.ConsoleMessage.prototype = {
                 this.formattedMessage = span;
                 break;
             case WebInspector.ConsoleMessage.MessageType.Object:
-                this.formattedMessage = this._format([WebInspector.ObjectProxy.wrapPrimitiveValue("%O"), args[0]]);
+                this.formattedMessage = this._format(["%O", args[0]]);
                 break;
             default:
                 this.formattedMessage = this._format(args);
@@ -631,6 +631,13 @@ WebInspector.ConsoleMessage.prototype = {
         if (!parameters.length)
             return formattedResult;
 
+        // Formatting code below assumes that parameters are all wrappers whereas frontend console
+        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i) {
+            if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
+                parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
+        }
+
         function formatForConsole(obj)
         {
             return WebInspector.console._format(obj);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
index 49a1188..928da52 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsPanel.js
@@ -987,27 +987,9 @@ WebInspector.ElementsPanel.prototype = {
         // Don't prevent the normal copy if the user has a selection.
         if (!window.getSelection().isCollapsed)
             return;
-
-        switch (this.focusedDOMNode.nodeType) {
-            case Node.ELEMENT_NODE:
-                // TODO: Introduce InspectorController.copyEvent that pushes appropriate markup into the clipboard.
-                var data = null;
-                break;
-
-            case Node.COMMENT_NODE:
-                var data = "<!--" + this.focusedDOMNode.nodeValue + "-->";
-                break;
-
-            default:
-            case Node.TEXT_NODE:
-                var data = this.focusedDOMNode.nodeValue;
-        }
-
         event.clipboardData.clearData();
         event.preventDefault();
-
-        if (data)
-            event.clipboardData.setData("text/plain", data);
+        InspectorController.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
index 726c7cc..87293b8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScript.js
@@ -44,6 +44,10 @@ InjectedScript.reset();
 InjectedScript.dispatch = function(methodName, args)
 {
     var result = InjectedScript[methodName].apply(InjectedScript, JSON.parse(args));
+    if (typeof result === "undefined") {
+        InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
+        result = null;
+    }
     return JSON.stringify(result);
 }
 
@@ -150,6 +154,7 @@ InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
 InjectedScript.setStyleText = function(style, cssText)
 {
     style.cssText = cssText;
+    return true;
 }
 
 InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
@@ -536,11 +541,11 @@ InjectedScript._evaluateAndWrap = function(evalFunction, object, expression)
         result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression));
         // Handle error that might have happened while describing result.
         if (result.value.errorText) {
-            result.value = InspectorController.wrapObject(result.value.errorText);
+            result.value = result.value.errorText;
             result.isException = true;
         }
     } catch (e) {
-        result.value = InspectorController.wrapObject(e.toString());
+        result.value = e.toString();
         result.isException = true;
     }
     return result;
@@ -812,7 +817,10 @@ InjectedScript.searchCanceled = function()
 
 InjectedScript.openInInspectedWindow = function(url)
 {
-    InjectedScript._window().open(url);
+    // Don't call window.open on wrapper - popup blocker mutes it.
+    // URIs should have no double quotes.
+    InjectedScript._window().eval("window.open(\"" + url + "\")");
+    return true;
 }
 
 InjectedScript.getCallFrames = function()
@@ -1100,10 +1108,6 @@ Object.describe = function(obj, abbreviated)
         return objectText;
     case "regexp":
         return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-    case "boolean":
-    case "number":
-    case "null":
-        return obj;
     default:
         return String(obj);
     }
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
index da85d03..67312f7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -51,6 +51,9 @@ InjectedScriptAccess._installHandler = function(methodName)
     };
 }
 
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
+// - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
 InjectedScriptAccess._installHandler("getStyles");
 InjectedScriptAccess._installHandler("getComputedStyle");
 InjectedScriptAccess._installHandler("getInlineStyle");
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
index 356f57d..3fb0e00 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -153,8 +153,11 @@ WebInspector.ProfileDataGridNode.prototype = {
 
                 // If the grid node is collapsed, then don't sort children (save operation for later).
                 // If the grid node has the same sorting as previously, then there is no point in sorting it again.
-                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator) {
+                    if (gridNode.children.length)
+                        gridNode.shouldRefreshChildren = true;
                     continue;
+                }
 
                 gridNode.lastComparator = comparator;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
index d915055..4fcc956 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourceView.js
@@ -178,7 +178,7 @@ WebInspector.ResourceView.prototype = {
 
         var isFormEncoded = false;
         var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
-        if (requestContentType == "application/x-www-form-urlencoded")
+        if (requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
             isFormEncoded = true;
 
         if (isFormEncoded) {
@@ -217,14 +217,27 @@ WebInspector.ResourceView.prototype = {
 
         for (var i = 0; i < parms.length; ++i) {
             var key = parms[i][0];
-            var val = parms[i][1];
-
-            if (val.indexOf("%") >= 0)
-                if (this._decodeRequestParameters)
-                    val = decodeURIComponent(val).replace(/\+/g, " ");
+            var value = parms[i][1];
+
+            var errorDecoding = false;
+            if (this._decodeRequestParameters) {
+                if (value.indexOf("%") >= 0) {
+                    try {
+                        value = decodeURIComponent(value);
+                    } catch(e) {
+                        errorDecoding = true;
+                    }
+                }
+                    
+                value = value.replace(/\+/g, " ");
+            }
+
+            valueEscaped = value.escapeHTML();
+            if (errorDecoding)
+                valueEscaped += " <span class=\"error-message\">" + WebInspector.UIString("(unable to decode value)").escapeHTML() + "</span>";
 
             var title = "<div class=\"header-name\">" + key.escapeHTML() + ":</div>";
-            title += "<div class=\"header-value\">" + val.escapeHTML() + "</div>";
+            title += "<div class=\"header-value\">" + valueEscaped + "</div>";
 
             var parmTreeElement = new TreeElement(title, null, false);
             parmTreeElement.selectable = false;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index 680f66c..2c96974 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -1209,7 +1209,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     
     ondblclick: function(treeElement, event)
     {
-        InjectedScriptAccess.openInInspectedWindow(this.resource.url);
+        InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
     get mainTitle()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index b568939..d6d1d61 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -84,18 +84,23 @@ WebInspector.WatchExpressionsSection.prototype = {
     {
         function appendResult(expression, watchIndex, result, exception)
         {
-            // The null check catches some other cases, like null itself, and NaN
-            if ((typeof result !== "object") || (result == null))
-                result = new WebInspector.ObjectProxy(null, [], 0, String(result), false);
+            if (exception) {
+                // Exception results are not wrappers, but text messages.
+                result = WebInspector.ObjectProxy.wrapPrimitiveValue(result);
+            } else if (result.type === "string") {
+                // Evaluation result is intentionally not abbreviated. However, we'd like to distinguish between null and "null"
+                result.description = "\"" + result.description + "\"";
+            }
 
             var property = new WebInspector.ObjectPropertyProxy(expression, result);
             property.watchIndex = watchIndex;
+            property.isException = exception;
 
             // For newly added, empty expressions, set description to "",
             // since otherwise you get DOMWindow
             if (property.name === WebInspector.WatchExpressionsSection.NewWatchExpression) 
                 property.value.description = "";
-            
+
             // To clarify what's going on here: 
             // In the outer function, we calculate the number of properties
             // that we're going to be updating, and set that in the
@@ -218,6 +223,9 @@ WebInspector.WatchExpressionTreeElement.prototype = {
     {
         WebInspector.ObjectPropertyTreeElement.prototype.update.call(this);
 
+        if (this.property.isException)
+            this.valueElement.addStyleClass("watch-expressions-error-level");
+
         var deleteButton = document.createElement("input");
         deleteButton.type = "button";
         deleteButton.title = WebInspector.UIString("Delete watch expression.");
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index b4dff4e..0c50bb7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -92,6 +92,7 @@
     <file>Images/enableSolidButtonGlyph.png</file>
     <file>Images/errorIcon.png</file>
     <file>Images/errorMediumIcon.png</file>
+    <file>Images/errorRedDot.png</file>
     <file>Images/excludeButtonGlyph.png</file>
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
@@ -153,6 +154,7 @@
     <file>Images/statusbarResizerHorizontal.png</file>
     <file>Images/statusbarResizerVertical.png</file>
     <file>Images/storageIcon.png</file>
+    <file>Images/successGreenDot.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -184,6 +186,7 @@
     <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
+    <file>Images/warningOrangeDot.png</file>
     <file>Images/warningsErrors.png</file>
 </qresource>
 </RCC>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index 2ae4aac..4513886 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -1409,6 +1409,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     display: none;
 }
 
+.watch-expressions-error-level {
+    color: red;
+}
+
 .section .properties li.editing-sub-part {
     padding: 3px 6px 8px 18px;
     margin: -3px -6px -8px -6px;
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 41b6ebc..14d36f1 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -39,6 +39,7 @@
 #include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
+#include "PluginHalterClient.h"
 #include "ResourceError.h"
 #include "SharedBuffer.h"
 
@@ -483,6 +484,12 @@ public:
     virtual void inspectorWindowObjectCleared() { }
 };
 
+class EmptyPluginHalterClient : public PluginHalterClient
+{
+public:
+    virtual bool shouldHaltPlugin(Node*) const { return false; }
+};
+
 }
 
 #endif // EmptyClients_h
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
index 6573fb6..40bd714 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
@@ -57,6 +57,13 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 #endif
 #endif
 
+static inline FTPEntryType ParsingFailed(ListState& state)
+{
+  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
+    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
+  return FTPMiscEntry;        /* its part of a comment or error message */
+}
+
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
 {
   result.clear();
@@ -126,6 +133,9 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
       }
     }    
 
+    if (!numtoks)
+      return ParsingFailed(state);
+
     linelen_sans_wsp = &(tokens[numtoks-1][toklen[numtoks-1]]) - tokens[0];
     if (numtoks == (sizeof(tokens)/sizeof(tokens[0])) )
     {
@@ -356,11 +366,16 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
               pos++;
               p++;
             }
-            if (lstyle && pos < (toklen[0]-1) && *p == ']')
+            if (lstyle && pos < (toklen[0]-1))
             {
+              /* ']' was found and there is at least one character after it */
+              ASSERT(*p == ']');
               pos++;
               p++;
               tokmarker = pos; /* length of leading "[DIR1.DIR2.etc]" */
+            } else {
+              /* not a CMU style listing */
+              lstyle = 0;
             }
           }
           while (lstyle && pos < toklen[0] && *p != ';')
@@ -387,7 +402,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           pos -= tokmarker;      /* => fnlength sans "[DIR1.DIR2.etc]" */
           p = &(tokens[0][tokmarker]); /* offset of basename */
 
-          if (!lstyle || pos > 80) /* VMS filenames can't be longer than that */
+          if (!lstyle || pos == 0 || pos > 80) /* VMS filenames can't be longer than that */
           {
             lstyle = 0;
           }
@@ -780,7 +795,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
         state.parsedOne = true;
         state.listStyle = lstyle;
 
-        p = &(line[linelen_sans_wsp]); /* line end sans wsp */
+        p = &(line[linelen]); /* line end */
         result.caseSensitive = true;
         result.filename = tokens[3];
         result.filenameLength = p - tokens[3];
@@ -788,29 +803,46 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
         if (*tokens[2] != '<') /* not <DIR> or <JUNCTION> */
         {
+          // try to handle correctly spaces at the beginning of the filename
+          // filesize (token[2]) must end at offset 38
+          if (tokens[2] + toklen[2] - line == 38) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
           result.type = FTPFileEntry;
           pos = toklen[2];
           result.fileSize = String(tokens[2], pos);
         }
-        else if ((tokens[2][1]) != 'D') /* not <DIR> */
-        {
-          result.type = FTPJunkEntry; /* unknown until junc for sure */
-          if (result.filenameLength > 4)
+        else {
+          // try to handle correctly spaces at the beginning of the filename
+          // token[2] must begin at offset 24, the length is 5 or 10
+          // token[3] must begin at offset 39 or higher
+          if (tokens[2] - line == 24 && (toklen[2] == 5 || toklen[2] == 10) &&
+              tokens[3] - line >= 39) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
+
+          if ((tokens[2][1]) != 'D') /* not <DIR> */
           {
-            p = result.filename;
-            for (pos = result.filenameLength - 4; pos > 0; pos--)
+            result.type = FTPJunkEntry; /* unknown until junc for sure */
+            if (result.filenameLength > 4)
             {
-              if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
-                  (p[1] == '=' || p[1] == '-'))
+              p = result.filename;
+              for (pos = result.filenameLength - 4; pos > 0; pos--)
               {
-                result.type = FTPLinkEntry;
-                result.filenameLength = p - result.filename;
-                result.linkname = p + 4;
-                result.linknameLength = &(line[linelen_sans_wsp]) 
-                                   - result.linkname;
-                break;
+                if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
+                    (p[1] == '=' || p[1] == '-'))
+                {
+                  result.type = FTPLinkEntry;
+                  result.filenameLength = p - result.filename;
+                  result.linkname = p + 4;
+                  result.linknameLength = &(line[linelen]) 
+                                     - result.linkname;
+                  break;
+                }
+                p++;
               }
-              p++;
             }    
           }
         }
@@ -821,8 +853,13 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           result.modifiedTime.tm_mon--;
           result.modifiedTime.tm_mday = atoi(tokens[0]+3);
           result.modifiedTime.tm_year = atoi(tokens[0]+6);
+          /* if year has only two digits then assume that
+               00-79 is 2000-2079
+               80-99 is 1980-1999 */
           if (result.modifiedTime.tm_year < 80)
-            result.modifiedTime.tm_year += 100;
+            result.modifiedTime.tm_year += 2000;
+          else if (result.modifiedTime.tm_year < 100)
+            result.modifiedTime.tm_year += 1900;
         }
 
         result.modifiedTime.tm_hour = atoi(tokens[1]+0);
@@ -974,6 +1011,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        * "drwxr-xr-x  2 0  0  512 May 28 22:17 etc"
       */
     
+      bool isOldHellsoft = false;
+    
       if (numtoks >= 6)
       {
         /* there are two perm formats (Hellsoft/NetWare and *IX strmode(3)).
@@ -999,6 +1038,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               /* rest is FMA[S] or AFM[S] */
               lstyle = 'U'; /* very likely one of the NetWare servers */
+              if (toklen[0] == 10)
+                isOldHellsoft = true;
             }
           }
         }
@@ -1063,7 +1104,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
             /* check that size is numeric */
             p = tokens[tokmarker];
-            for (pos = 0; lstyle && pos < toklen[tokmarker]; pos++)
+            for (unsigned int i = 0; lstyle && i < toklen[tokmarker]; ++i)
             {
               if (!isASCIIDigit(*p++))
                 lstyle = 0;
@@ -1072,11 +1113,11 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               month_num = 0;
               p = tokens[tokmarker+1];
-              for (pos = 0;pos < (12*3); pos+=3)
+              for (unsigned int i = 0; i < (12*3); i+=3)
               {
-                if (p[0] == month_names[pos+0] && 
-                    p[1] == month_names[pos+1] && 
-                    p[2] == month_names[pos+2])
+                if (p[0] == month_names[i+0] && 
+                    p[1] == month_names[i+1] && 
+                    p[2] == month_names[i+2])
                   break;
                 month_num++;
               }
@@ -1084,8 +1125,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
                 lstyle = 0;
             }
           } /* relative position test */
-        } /* while (pos+5) < numtoks */
-      } /* if (numtoks >= 4) */
+        } /* for (pos = (numtoks-5); !lstyle && pos > 1; pos--) */
+      } /* if (lstyle == 'U') */
 
       if (lstyle == 'U')
       {
@@ -1144,24 +1185,49 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        
         } /* time/year */
         
-        result.filename = tokens[tokmarker+4];
-        result.filenameLength = (&(line[linelen_sans_wsp]))
+        // there is exacly 1 space between filename and previous token in all
+        // outputs except old Hellsoft
+        if (!isOldHellsoft)
+          result.filename = tokens[tokmarker+3] + toklen[tokmarker+3] + 1;
+        else
+          result.filename = tokens[tokmarker+4];
+
+        result.filenameLength = (&(line[linelen]))
                            - (result.filename);
 
         if (result.type == FTPLinkEntry && result.filenameLength > 4)
         {
-          p = result.filename + 1;
-          for (pos = 1; pos < (result.filenameLength - 4); pos++)
+          /* First try to use result.fe_size to find " -> " sequence.
+             This can give proper result for cases like "aaa -> bbb -> ccc". */
+          unsigned int fileSize = result.fileSize.toUInt();
+
+          if (result.filenameLength > (fileSize + 4) &&
+              strncmp(result.filename + result.filenameLength - fileSize - 4, " -> ", 4) == 0)
+          {
+            result.linkname = result.filename + (result.filenameLength - fileSize);
+            result.linknameLength = (&(line[linelen])) - (result.linkname);
+            result.filenameLength -= fileSize + 4;
+          }
+          else
           {
-            if (*p == ' ' && p[1] == '-' && p[2] == '>' && p[3] == ' ')
+            /* Search for sequence " -> " from the end for case when there are
+               more occurrences. F.e. if ftpd returns "a -> b -> c" assume
+               "a -> b" as a name. Powerusers can remove unnecessary parts
+               manually but there is no way to follow the link when some
+               essential part is missing. */
+            p = result.filename + (result.filenameLength - 5);
+            for (pos = (result.filenameLength - 5); pos > 0; pos--)
             {
-              result.linkname = p + 4;
-              result.linknameLength = (&(line[linelen_sans_wsp]))
-                               - (result.linkname);
-              result.filenameLength = pos;
-              break;
+              if (strncmp(p, " -> ", 4) == 0)
+              {
+                result.linkname = p + 4;
+                result.linknameLength = (&(line[linelen]))
+                                 - (result.linkname);
+                result.filenameLength = pos;
+                break;
+              }
+              p--;
             }
-            p++;
           }
         }
 
@@ -1618,9 +1684,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
   } /* if (linelen > 0) */
 
-  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
-    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
-  return FTPMiscEntry;        /* its part of a comment or error message */
+  return ParsingFailed(state);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 807edef..57cf85a 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -2312,9 +2312,6 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
 void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType newLoadType,
     PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 {
-    if (m_unloadEventBeingDispatched)
-        return;
-
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
     
@@ -2337,6 +2334,9 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
         return;
     }
 
+    if (m_unloadEventBeingDispatched)
+        return;
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
     if (!targetFrame && !frameName.isEmpty()) {
@@ -5193,6 +5193,8 @@ void FrameLoader::dispatchWindowObjectAvailable()
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
+        if (InspectorController* inspector = page->inspectorController())
+            inspector->inspectedWindowScriptObjectCleared(m_frame);
         if (InspectorController* inspector = page->parentInspectorController())
             inspector->windowScriptObjectAvailable();
     }
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 809d541..5ac4049 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -34,6 +34,8 @@
 #include "CString.h"
 #include "Chrome.h"
 #include "Console.h"
+#include "Database.h"
+#include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMTimer.h"
 #include "PageTransitionEvent.h"
@@ -55,6 +57,7 @@
 #include "Media.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PlatformScreen.h"
@@ -62,29 +65,14 @@
 #include "Screen.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "Storage.h"
+#include "StorageArea.h"
+#include "StorageNamespace.h"
 #include "SuddenTermination.h"
 #include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
 
-#if ENABLE(DATABASE)
-#include "Database.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "StorageArea.h"
-#include "StorageNamespace.h"
-#endif
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "DOMApplicationCache.h"
-#endif
-
-#if ENABLE(NOTIFICATIONS)
-#include "NotificationCenter.h"
-#endif
-
 using std::min;
 using std::max;
 
@@ -137,6 +125,66 @@ static DOMWindowSet& windowsWithBeforeUnloadEventListeners()
     return windowsWithBeforeUnloadEventListeners;
 }
 
+static void addUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
+}
+
+static void removeUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
+
+static void removeAllUnloadEventListeners(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.removeAll(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
+
+static void addBeforeUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
+}
+
+static void removeBeforeUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
+
+static void removeAllBeforeUnloadEventListeners(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.removeAll(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
+
 static bool allowsBeforeUnloadListeners(DOMWindow* window)
 {
     ASSERT_ARG(window, window);
@@ -193,7 +241,7 @@ unsigned DOMWindow::pendingUnloadEventListeners() const
 
 void DOMWindow::dispatchAllPendingUnloadEvents()
 {
-    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
     if (set.isEmpty())
         return;
 
@@ -328,8 +376,8 @@ DOMWindow::~DOMWindow()
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
 
-    windowsWithUnloadEventListeners().clear(this);
-    windowsWithBeforeUnloadEventListeners().clear(this);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
 ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
@@ -552,15 +600,12 @@ Storage* DOMWindow::localStorage() const
     if (!page->settings()->localStorageEnabled())
         return 0;
 
-    StorageNamespace* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
-    if (storageArea) {
+    RefPtr<StorageArea> storageArea = page->group().localStorage()->storageArea(document->securityOrigin());
 #if ENABLE(INSPECTOR)
-        page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
+    page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
 #endif
-        m_localStorage = Storage::create(m_frame, storageArea.release());
-    }
 
+    m_localStorage = Storage::create(m_frame, storageArea.release());
     return m_localStorage.get();
 }
 #endif
@@ -579,6 +624,9 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
+    if (!page->settings()->experimentalNotificationsEnabled())
+        return 0;
+
     NotificationPresenter* provider = page->chrome()->notificationPresenter();
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
@@ -1215,9 +1263,9 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<Event
         document->addListenerTypeIfNeeded(eventType);
 
     if (eventType == eventNames().unloadEvent)
-        windowsWithUnloadEventListeners().add(this);
+        addUnloadEventListener(this);
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
-        windowsWithBeforeUnloadEventListeners().add(this);
+        addBeforeUnloadEventListener(this);
 
     return true;
 }
@@ -1228,9 +1276,9 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
         return false;
 
     if (eventType == eventNames().unloadEvent)
-        windowsWithUnloadEventListeners().remove(this);
+        removeUnloadEventListener(this);
     else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
-        windowsWithBeforeUnloadEventListeners().remove(this);
+        removeBeforeUnloadEventListener(this);
 
     return true;
 }
@@ -1266,8 +1314,8 @@ void DOMWindow::removeAllEventListeners()
 {
     EventTarget::removeAllEventListeners();
 
-    windowsWithUnloadEventListeners().clear(this);
-    windowsWithBeforeUnloadEventListeners().clear(this);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
 void DOMWindow::captureEvents()
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 8d519ef..3772d65 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -1758,6 +1758,13 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
+#if !PLATFORM(GTK)
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
+{
+    return false;
+}
+#endif
+
 bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
 {
     Document* doc = m_frame->document();
@@ -1777,11 +1784,12 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     bool isOverWidget;
     bool didSetLatchedNode = false;
 
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    HitTestResult result(vPoint);
+    doc->renderView()->layer()->hitTest(request, result);
+
     if (m_useLatchedWheelEventNode) {
         if (!m_latchedWheelEventNode) {
-            HitTestRequest request(HitTestRequest::ReadOnly);
-            HitTestResult result(vPoint);
-            doc->renderView()->layer()->hitTest(request, result);
             m_latchedWheelEventNode = result.innerNode();
             m_widgetIsLatched = result.isOverWidget();
             didSetLatchedNode = true;
@@ -1795,13 +1803,13 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         if (m_previousWheelScrolledNode)
             m_previousWheelScrolledNode = 0;
 
-        HitTestRequest request(HitTestRequest::ReadOnly);
-        HitTestResult result(vPoint);
-        doc->renderView()->layer()->hitTest(request, result);
         node = result.innerNode();
         isOverWidget = result.isOverWidget();
     }
 
+    if (shouldTurnVerticalTicksIntoHorizontal(result))
+        e.turnVerticalTicksIntoHorizontal();
+
     if (node) {
         // Figure out which view to send the event to.
         RenderObject* target = node->renderer();
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 7066252..e1a02db 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -125,6 +125,8 @@ public:
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
 #endif
 
+    bool shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const;
+
     bool tabsToLinks(KeyboardEvent*) const;
     bool tabsToAllControls(KeyboardEvent*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h b/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h
new file mode 100644
index 0000000..a5fe0f4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/HaltablePlugin.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HaltablePlugin_h
+#define HaltablePlugin_h
+
+namespace WebCore {
+
+class Node;
+
+class HaltablePlugin {
+public:
+    virtual ~HaltablePlugin() { }
+
+    virtual void halt() = 0;
+    virtual void restart() = 0;
+    virtual Node* node() const = 0;
+};
+
+} // namespace WebCore
+
+#endif // HaltablePlugin_h
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index 182d22c..2d0c91c 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -49,6 +49,7 @@
 #include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
+#include "PluginHalter.h"
 #include "ProgressTracker.h"
 #include "RenderWidget.h"
 #include "RenderTheme.h"
@@ -99,7 +100,7 @@ static void networkStateChanged()
         frames[i]->document()->dispatchWindowEvent(Event::create(eventName, false, false));
 }
 
-Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
+Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient, PluginHalterClient* pluginHalterClient)
     : m_chrome(new Chrome(this, chromeClient))
     , m_dragCaretController(new SelectionController(0, true))
 #if ENABLE(DRAG_SUPPORT)
@@ -135,6 +136,7 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
+    , m_pluginHalterClient(pluginHalterClient)
 {
 #if !ENABLE(CONTEXT_MENUS)
     UNUSED_PARAM(contextMenuClient);
@@ -154,6 +156,8 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
+    pluginHalterEnabledStateChanged();
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
 #endif
@@ -679,4 +683,32 @@ InspectorTimelineAgent* Page::inspectorTimelineAgent() const
 }
 #endif
 
+void Page::pluginHalterEnabledStateChanged()
+{
+    if (m_settings->pluginHalterEnabled()) {
+        ASSERT(!m_pluginHalter);
+        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    } else
+        m_pluginHalter = 0;
+}
+
+void Page::pluginAllowedRunTimeChanged()
+{
+    if (m_pluginHalter)
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+}
+
+void Page::didStartPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStartPlugin(obj);
+}
+
+void Page::didStopPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStopPlugin(obj);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index d3f7ddb..602d99b 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -54,12 +54,15 @@ namespace WebCore {
     class EditorClient;
     class FocusController;
     class Frame;
+    class HaltablePlugin;
     class InspectorClient;
     class InspectorController;
     class InspectorTimelineAgent;
     class Node;
     class PageGroup;
     class PluginData;
+    class PluginHalter;
+    class PluginHalterClient;
     class PluginView;
     class ProgressTracker;
     class RenderTheme;
@@ -82,7 +85,7 @@ namespace WebCore {
     public:
         static void setNeedsReapplyStyles();
 
-        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*);
+        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*, PluginHalterClient*);
         ~Page();
 
         RenderTheme* theme() const { return m_theme.get(); };
@@ -181,6 +184,11 @@ namespace WebCore {
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
 
+        void didStartPlugin(HaltablePlugin*);
+        void didStopPlugin(HaltablePlugin*);
+        void pluginAllowedRunTimeChanged();
+        void pluginHalterEnabledStateChanged();
+
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
         JSC::Debugger* debugger() const { return m_debugger; }
@@ -284,6 +292,9 @@ namespace WebCore {
         bool m_canStartPlugins;
         HashSet<PluginView*> m_unstartedPlugins;
 
+        OwnPtr<PluginHalter> m_pluginHalter;
+        PluginHalterClient* m_pluginHalterClient;
+
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
new file mode 100644
index 0000000..8025337
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "PluginHalter.h"
+
+#include "HaltablePlugin.h"
+#include "PluginHalterClient.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+namespace WebCore {
+
+PluginHalter::PluginHalter(PluginHalterClient* client)
+    : m_client(client)
+    , m_timer(this, &PluginHalter::timerFired)
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+{
+    ASSERT_ARG(client, client);
+}
+
+void PluginHalter::didStartPlugin(HaltablePlugin* obj)
+{
+    ASSERT_ARG(obj, obj);
+    ASSERT_ARG(obj, !m_plugins.contains(obj));
+
+    double currentTime = WTF::currentTime();
+
+    m_plugins.add(obj, currentTime);
+
+    if (m_plugins.size() == 1)
+        m_oldestStartTime = currentTime;
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::didStopPlugin(HaltablePlugin* obj)
+{
+    m_plugins.remove(obj);
+}
+
+void PluginHalter::timerFired(Timer<PluginHalter>*)
+{
+    if (m_plugins.isEmpty())
+        return;
+
+    Vector<HaltablePlugin*> plugins;
+    copyKeysToVector(m_plugins, plugins);
+
+    // Plug-ins older than this are candidates to be halted.
+    double pluginCutOffTime = WTF::currentTime() - m_pluginAllowedRunTime;
+
+    m_oldestStartTime = numeric_limits<double>::max();
+
+    for (size_t i = 0; i < plugins.size(); ++i) {
+        double thisStartTime = m_plugins.get(plugins[i]);
+        if (thisStartTime > pluginCutOffTime) {
+            // This plug-in is too young to be halted. We find the oldest
+            // plug-in that is not old enough to be halted and use it to set
+            // the timer's next fire time.
+            if (thisStartTime < m_oldestStartTime)
+                m_oldestStartTime = thisStartTime;
+            continue;
+        }
+
+        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+            plugins[i]->halt();
+
+        m_plugins.remove(plugins[i]);
+    }
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::startTimerIfNecessary()
+{
+    if (m_timer.isActive())
+        return;
+
+    if (m_plugins.isEmpty())
+        return;
+
+    double nextFireInterval = static_cast<double>(m_pluginAllowedRunTime) - (currentTime() - m_oldestStartTime);
+    m_timer.startOneShot(nextFireInterval < 0 ? 0 : nextFireInterval);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalter.h b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
new file mode 100644
index 0000000..26f5101
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalter.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalter_h
+#define PluginHalter_h
+
+#include "Timer.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class HaltablePlugin;
+class PluginHalterClient;
+
+class PluginHalter {
+public:
+    PluginHalter(PluginHalterClient*);
+
+    void didStartPlugin(HaltablePlugin*);
+    void didStopPlugin(HaltablePlugin*);
+
+    void setPluginAllowedRunTime(unsigned runTime) { m_pluginAllowedRunTime = runTime; }
+
+private:
+    void timerFired(Timer<PluginHalter>*);
+    void startTimerIfNecessary();
+
+    PluginHalterClient* m_client;
+    Timer<PluginHalter> m_timer;
+    unsigned m_pluginAllowedRunTime;
+    double m_oldestStartTime;
+    HashMap<HaltablePlugin*, double> m_plugins;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalter_h
diff --git a/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
new file mode 100644
index 0000000..7ea460a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/PluginHalterClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalterClient_h
+#define PluginHalterClient_h
+
+namespace WebCore {
+
+class Node;
+
+class PluginHalterClient {
+public:
+    virtual ~PluginHalterClient() { }
+
+    virtual bool shouldHaltPlugin(Node*) const = 0;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalterClient_h
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index da36fee..708d595 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -61,6 +61,7 @@ Settings::Settings(Page* page)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -114,6 +115,8 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_experimentalNotificationsEnabled(false)
+    , m_pluginHalterEnabled(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -497,6 +500,27 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setExperimentalNotificationsEnabled(bool enabled)
+{
+    m_experimentalNotificationsEnabled = enabled;
+}
+
+void Settings::setPluginHalterEnabled(bool enabled)
+{
+    if (m_pluginHalterEnabled == enabled)
+        return;
+
+    m_pluginHalterEnabled = enabled;
+
+    m_page->pluginHalterEnabledStateChanged();
+}
+
+void Settings::setPluginAllowedRunTime(unsigned runTime)
+{
+    m_pluginAllowedRunTime = runTime;
+    m_page->pluginAllowedRunTimeChanged();
+}
+
 #if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
 void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTimers)
 {
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 7900c91..b3daf19 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -253,11 +253,20 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setExperimentalNotificationsEnabled(bool);
+        bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
+
 #if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
         static void setShouldUseHighResolutionTimers(bool);
         static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
 #endif
 
+        void setPluginHalterEnabled(bool);
+        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
+
+        void setPluginAllowedRunTime(unsigned);
+        unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
+
     private:
         Page* m_page;
         
@@ -278,6 +287,7 @@ namespace WebCore {
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
         size_t m_maximumDecodedImageSize;
+        unsigned m_pluginAllowedRunTime;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -322,6 +332,8 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_experimentalNotificationsEnabled : 1;
+        bool m_pluginHalterEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
index 3ba64e9..978bc25 100644
--- a/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/InspectorControllerAndroid.cpp
@@ -90,6 +90,7 @@ void InspectorController::addProfile(PassRefPtr<JSC::Profile>, unsigned int, con
 void InspectorController::inspectedPageDestroyed() {}
 void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, JSC::UString& sourceString) {}
 
+void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame) {}
 void InspectorController::startGroup(MessageSource source, JSC::ExecState* exec, const JSC::ArgList& arguments, unsigned lineNumber, const String& sourceURL) {}
 void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL) {}
 void InspectorController::startTiming(const JSC::UString& title) {}
diff --git a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
index cd6a3b5..188b962 100644
--- a/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
+++ b/src/3rdparty/webkit/WebCore/platform/Pasteboard.h
@@ -86,6 +86,7 @@ public:
     
     static Pasteboard* generalPasteboard();
     void writeSelection(Range*, bool canSmartCopyOrDelete, Frame*);
+    void writePlainText(const String&);
     void writeURL(const KURL&, const String&, Frame* = 0);
     void writeImage(Node*, const KURL&, const String& title);
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index 537deac..9a4a0cb 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -93,6 +93,15 @@ namespace WebCore {
         void accept() { m_isAccepted = true; }
         void ignore() { m_isAccepted = false; }
 
+        void turnVerticalTicksIntoHorizontal()
+        {
+            m_deltaX = m_deltaY;
+            m_deltaY = 0;
+
+            m_wheelTicksX = m_wheelTicksY;
+            m_wheelTicksY = 0;
+        }
+
 #if PLATFORM(GTK)
         PlatformWheelEvent(GdkEventScroll*);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
index b68a74c..c0b57a6 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -175,6 +175,11 @@ void Pasteboard::writeSelection(Range*, bool, Frame*)
     notImplemented();
 }
 
+void Pasteboard::writePlainText(const String&)
+{
+    notImplemented();
+}
+
 void Pasteboard::writeURL(const KURL&, const String&, Frame*)
 {
     notImplemented();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
index cbbf2b4..edda215 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/GraphicsContext3D.h
@@ -62,6 +62,11 @@ namespace WebCore {
     class ImageData;
     class WebKitCSSMatrix;
     
+    // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(SKIA)
+    class GraphicsContext3DInternal;
+#endif
+
     class GraphicsContext3D : Noncopyable {
     public:
         enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
@@ -308,10 +313,6 @@ namespace WebCore {
     private:        
         int m_currentWidth, m_currentHeight;
         
-#if PLATFORM(SKIA)
-#include "GraphicsContext3DSkia.h"
-#endif
-
 #if PLATFORM(MAC)
         Vector<Vector<float> > m_vertexArray;
         
@@ -320,6 +321,12 @@ namespace WebCore {
         GLuint m_fbo;
         GLuint m_depthBuffer;
 #endif        
+
+        // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(SKIA)
+        friend class GraphicsContext3DInternal;
+        OwnPtr<GraphicsContext3DInternal> m_internal;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
index e21f549..f048791 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/PasteboardMac.mm
@@ -135,8 +135,8 @@ static NSAttributedString *stripAttachmentCharacters(NSAttributedString *string)
 
 void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
     ASSERT(selectedRange);
     
     NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
@@ -203,12 +203,24 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     Pasteboard::writeSelection(m_pasteboard.get(), selectedRange, canSmartCopyOrDelete, frame);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+
+    NSArray *types = [NSArray arrayWithObject:NSStringPboardType];
+    NSPasteboard *pasteboard = m_pasteboard.get();
+    [pasteboard declareTypes:types owner:nil];
+
+    [pasteboard setString:text forType:NSStringPboardType];
+}
+
 void Pasteboard::writeURL(NSPasteboard* pasteboard, NSArray* types, const KURL& url, const String& titleStr, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
    
-    if (types == nil) {
+    if (!types) {
         types = writableTypesForURL();
         [pasteboard declareTypes:types owner:nil];
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
index 969de62..209a573 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PasteboardQt.cpp
@@ -119,6 +119,18 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     return 0;
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+#ifndef QT_NO_CLIPBOARD
+    QMimeData* md = new QMimeData;
+    QString qtext = text;
+    qtext.replace(QChar(0xa0), QLatin1Char(' '));
+    md->setText(qtext);
+    QApplication::clipboard()->setMimeData(md, m_selectionMode ?
+            QClipboard::Selection : QClipboard::Clipboard);
+#endif
+}
+
 void Pasteboard::writeURL(const KURL& _url, const String&, Frame*)
 {
     ASSERT(!_url.isEmpty());
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
index c6c02cf..e351522 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -94,7 +94,26 @@ TextCodecQt::~TextCodecQt()
 
 String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*stopOnError*/, bool& sawError)
 {
-    QString unicode = m_codec->toUnicode(bytes, length, &m_state);
+    // We chop input buffer to smaller buffers to avoid excessive memory consumption
+    // when the input buffer is big.  This helps reduce peak memory consumption in
+    // mobile devices where system RAM is limited.
+#if PLATFORM(SYMBIAN)
+    static const int MaxInputChunkSize = 32 * 1024;
+#else
+    static const int MaxInputChunkSize = 1024 * 1024;
+#endif
+    const char* buf = bytes;
+    const char* end = buf + length;
+    String unicode;
+
+    while (buf < end) {
+        int size = end - buf;
+        size = qMin(size, MaxInputChunkSize);
+        QString decoded = m_codec->toUnicode(buf, size, &m_state);
+        unicode.append(decoded);
+        buf += size;
+    }
+
     sawError = m_state.invalidChars != 0;
 
     if (flush) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index cea226e..dd58ed1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -2456,7 +2456,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     // positioned, inline containing block because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isInline() && containerBlock->style()->direction() == RTL) {
+    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
         const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index e5a0c16..34f2b8b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -985,6 +985,42 @@ inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRenderi
 #endif
 }
 
+inline int adjustForAbsoluteZoom(int value, RenderObject* renderer)
+{
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
+inline void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
+inline FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
index cd90854..f430399 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.cpp
@@ -67,9 +67,9 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
     return disabledColor;
 }
 
-RenderTextControl::RenderTextControl(Node* node)
+RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
-    , m_placeholderVisible(false)
+    , m_placeholderVisible(placeholderVisible)
     , m_edited(false)
     , m_userEdited(false)
 {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
index 3212a1b..cdd8716 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
@@ -59,7 +59,7 @@ public:
     void updatePlaceholderVisibility(bool, bool);
 
 protected:
-    RenderTextControl(Node*);
+    RenderTextControl(Node*, bool);
 
     int scrollbarThickness() const;
     void adjustInnerTextStyle(const RenderStyle* startStyle, RenderStyle* textBlockStyle) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
index 3f0d041..8478432 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -31,10 +31,9 @@
 
 namespace WebCore {
 
-RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node)
-    : RenderTextControl(node)
+RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
 {
-    m_placeholderVisible = static_cast<HTMLTextAreaElement*>(node)->placeholderShouldBeVisible();
 }
 
 RenderTextControlMultiLine::~RenderTextControlMultiLine()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
index 333cfa8..3371a8f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlMultiLine.h
@@ -28,7 +28,7 @@ namespace WebCore {
 
 class RenderTextControlMultiLine : public RenderTextControl {
 public:
-    RenderTextControlMultiLine(Node*);
+    RenderTextControlMultiLine(Node*, bool);
     virtual ~RenderTextControlMultiLine();
 
     void forwardEvent(Event*);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
index 794be17..8d8ba97 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -48,14 +48,13 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node)
-    : RenderTextControl(node)
+RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
     , m_searchPopupIsVisible(false)
     , m_shouldDrawCapsLockIndicator(false)
     , m_searchEventTimer(this, &RenderTextControlSingleLine::searchEventTimerFired)
     , m_searchPopup(0)
 {
-    m_placeholderVisible = inputElement()->placeholderShouldBeVisible();
 }
 
 RenderTextControlSingleLine::~RenderTextControlSingleLine()
@@ -460,7 +459,7 @@ void RenderTextControlSingleLine::updateFromElement()
 
     if (m_placeholderVisible) {
         ExceptionCode ec = 0;
-        innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
+        innerTextElement()->setInnerText(static_cast<Element*>(node())->getAttribute(placeholderAttr), ec);
         ASSERT(!ec);
     } else
         setInnerTextValue(inputElement()->value());
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
index 817efb2..4a17918 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControlSingleLine.h
@@ -36,7 +36,7 @@ class TextControlInnerElement;
 
 class RenderTextControlSingleLine : public RenderTextControl, private PopupMenuClient {
 public:
-    RenderTextControlSingleLine(Node*);
+    RenderTextControlSingleLine(Node*, bool);
     virtual ~RenderTextControlSingleLine();
 
     bool placeholderIsVisible() const { return m_placeholderVisible; }
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
index 0d69216..66447d3 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.cpp
@@ -47,6 +47,11 @@ StorageAreaImpl::~StorageAreaImpl()
 {
 }
 
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+{
+    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager));
+}
+
 StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
index b98482b..a7cc9f6 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaImpl.h
@@ -30,6 +30,7 @@
 
 #include "StorageArea.h"
 
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -40,7 +41,7 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
@@ -60,6 +61,7 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index 825581f..6866746 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -45,7 +45,7 @@ namespace WebCore {
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespace() { }
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*) = 0;
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>) = 0;
         virtual PassRefPtr<StorageNamespace> copy() = 0;
         virtual void close() = 0;
         virtual void unlock() = 0;
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
index 5ac22cf..d5af31f 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.cpp
@@ -99,17 +99,18 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     return adoptRef(newNamespace);
 }
 
-PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(SecurityOrigin* origin)
+PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(PassRefPtr<SecurityOrigin> prpOrigin)
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
 
+    RefPtr<SecurityOrigin> origin = prpOrigin;
     RefPtr<StorageAreaImpl> storageArea;
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = adoptRef(new StorageAreaImpl(m_storageType, origin, m_syncManager));
-    m_storageAreaMap.set(origin, storageArea);
+    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager);
+    m_storageAreaMap.set(origin.release(), storageArea);
     return storageArea.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
index d3ef37f..05a12ad 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespaceImpl.h
@@ -46,7 +46,7 @@ namespace WebCore {
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespaceImpl();
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>);
         virtual PassRefPtr<StorageNamespace> copy();
         virtual void close();
         virtual void unlock();
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index e301c86..bb68b82 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -239,13 +239,14 @@ bool SVGImage::dataChanged(bool allDataReceived)
         static DragClient* dummyDragClient = 0;
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
+        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
         // THe comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
index 2dbdaf0..b027bf0 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.cpp
@@ -134,7 +134,6 @@ String WMLInputElement::value() const
 
 void WMLInputElement::setValue(const String& value)
 {
-    InputElement::updatePlaceholderVisibility(this, this);
     setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
     if (inDocument())
@@ -221,7 +220,7 @@ void WMLInputElement::copyNonAttributeProperties(const Element* source)
 
 RenderObject* WMLInputElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlSingleLine(this);
+    return new (arena) RenderTextControlSingleLine(this, false);
 }
 
 void WMLInputElement::detach()
@@ -318,11 +317,6 @@ void WMLInputElement::documentDidBecomeActive()
     reset();
 }
 
-bool WMLInputElement::placeholderShouldBeVisible() const
-{
-    return InputElement::placeholderShouldBeVisible(this, this);
-}
-
 void WMLInputElement::willMoveToNewOwnerDocument()
 {
     // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
index 7eb2455..98ea13a 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLInputElement.h
@@ -58,8 +58,6 @@ public:
     virtual const AtomicString& formControlName() const;
     virtual String value() const;
     virtual void setValue(const String&);
-    virtual String placeholder() const { return String(); }
-    virtual void setPlaceholder(const String&) { }
     virtual void setValueFromRenderer(const String&);
 
     virtual bool saveFormControlState(String& value) const;
@@ -82,7 +80,6 @@ public:
     virtual String sanitizeValue(const String& proposedValue) const { return constrainValue(proposedValue); }
 
     virtual void documentDidBecomeActive();
-    virtual bool placeholderShouldBeVisible() const;
 
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
diff --git a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
index 798ae00..ca48d8d 100644
--- a/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XMLHttpRequest.cpp
@@ -709,23 +709,19 @@ String XMLHttpRequest::getResponseHeader(const AtomicString& name, ExceptionCode
 {
     if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
-        return "";
+        return String();
     }
 
-    if (!isValidToken(name))
-        return "";
-
     // See comment in getAllResponseHeaders above.
     if (isSetCookieHeader(name) && !scriptExecutionContext()->securityOrigin()->canLoadLocalResources()) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
 
     if (!m_sameOriginRequest && !isOnAccessControlResponseHeaderWhitelist(name)) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
-
     return m_response.httpHeaderField(name);
 }
 
diff --git a/src/3rdparty/webkit/WebKit/ChangeLog b/src/3rdparty/webkit/WebKit/ChangeLog
index b317193..7d55d82 100644
--- a/src/3rdparty/webkit/WebKit/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/ChangeLog
@@ -1,3 +1,14 @@
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * chromium/features.gypi: Added 'ENABLE_ORIENTATION_EVENTS=0' to
+        disable this feature by default.
+
 2009-09-22  Yaar Schnitman  <yaar@chromium.org>
 
         Reviewed by David Levin.
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
index ff086f6..939d881 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.cpp
@@ -95,16 +95,6 @@ public:
     It is possible to replace the contents of child elements using
     setPlainText() and setInnerXml(). To replace the element itself and its
     contents, use setOuterXml().
-
-    In the JavaScript DOM interfaces, elements can have additional functions
-    depending on their type. For example, an HTML form element can be triggered
-    to submit the entire form to the web server using the submit() function. A
-    list of these special functions can be obtained in QWebElement using
-    functions(); they can be invoked using callFunction().
-
-    Similarly, element specific properties can be obtained using
-    scriptableProperties() and read or written using scriptableProperty() or
-    setScriptableProperty().
 */
 
 /*!
@@ -473,6 +463,33 @@ bool QWebElement::hasAttributes() const
 }
 
 /*!
+    Returns true if the element has keyboard input focus; otherwise, returns false
+
+    \sa setFocus()
+*/
+bool QWebElement::hasFocus() const
+{
+    if (!m_element)
+        return false;
+    if (m_element->document())
+        return m_element == m_element->document()->focusedNode();
+    return false;
+}
+
+/*!
+    Gives keyboard input focus to this element
+
+    \sa hasFocus()
+*/
+void QWebElement::setFocus()
+{
+    if (!m_element)
+        return;
+    if (m_element->document() && m_element->isFocusable())
+        m_element->document()->setFocusedNode(m_element);
+}
+
+/*!
     Returns the geometry of this element, relative to its containing frame.
 
     \sa tagName()
@@ -673,41 +690,10 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
 }
 
 
-static bool setupScriptObject(WebCore::Element* element, ScriptObject& object, ScriptState*& state, ScriptController*& scriptController)
-{
-    if (!element)
-        return false;
-
-    Document* document = element->document();
-    if (!document)
-        return false;
-
-    Frame* frame = document->frame();
-    if (!frame)
-        return false;
-
-    scriptController = frame->script();
-
-    state = scriptController->globalObject()->globalExec();
-
-    JSC::JSValue thisValue = toJS(state, element);
-    if (!thisValue)
-        return false;
-
-    JSC::JSObject* thisObject = thisValue.toObject(state);
-    if (!thisObject)
-        return false;
-
-    object = ScriptObject(state, thisObject);
-    return true;
-}
-
 /*!
     Executes \a scriptSource with this element as \c this object.
-
-    \sa callFunction()
 */
-QVariant QWebElement::evaluateScript(const QString& scriptSource)
+QVariant QWebElement::evaluateJavaScript(const QString& scriptSource)
 {
     if (scriptSource.isEmpty())
         return QVariant();
@@ -734,256 +720,25 @@ QVariant QWebElement::evaluateScript(const QString& scriptSource)
 }
 
 /*!
-    Calls the function with the given \a name and \a arguments.
-
-    The underlying DOM element that QWebElement wraps may have dedicated
-    functions, depending on its type. For example, a form element can have the
-    \c submit function, that would submit the form to the destination specified
-    in the HTML.
-
-    \sa functions()
-*/
-QVariant QWebElement::callFunction(const QString &name, const QVariantList &arguments)
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QVariant();
-
-    ScriptFunctionCall functionCall(state, thisObject, name);
-
-    for (QVariantList::ConstIterator it = arguments.constBegin(), end = arguments.constEnd();
-         it != end; ++it)
-        functionCall.appendArgument(JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), *it));
-
-    bool hadException = false;
-    ScriptValue result = functionCall.call(hadException);
-    if (hadException)
-        return QVariant();
-
-    int distance = 0;
-    return JSC::Bindings::convertValueToQVariant(state, result.jsValue(), QMetaType::Void, &distance);
-}
-
-/*!
-    Returns a list of function names this element supports.
-
-    The function names returned are the same functions callable from the DOM
-    element's JavaScript binding.
-
-    \sa callFunction()
-*/
-QStringList QWebElement::functions() const
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QStringList();
-
-    JSC::JSObject* object = thisObject.jsObject();
-    if (!object)
-        return QStringList();
-
-    QStringList names;
-
-    // Enumerate the contents of the object
-    JSC::PropertyNameArray properties(state);
-    object->getPropertyNames(state, properties);
-    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
-         it != properties.end(); ++it) {
-
-        JSC::JSValue property = object->get(state, *it);
-        if (!property)
-            continue;
-
-        JSC::JSObject* function = property.toObject(state);
-        if (!function)
-            continue;
-
-        JSC::CallData callData;
-        JSC::CallType callType = function->getCallData(callData);
-        if (callType == JSC::CallTypeNone)
-            continue;
-
-        JSC::UString ustring = (*it).ustring();
-        names << QString::fromUtf16((const ushort*)ustring.rep()->data(), ustring.size());
-    }
-
-    if (state->hadException())
-        state->clearException();
-
-    return names;
-}
-
-/*!
-    Returns the value of the element's \a name property. If no such property
-    exists, an invalid QVariant is returned.
-
-    The return value's property has the same value as the corresponding
-    property in the element's JavaScript binding with the same name.
-
-    Information about all available properties is provided through
-    scriptProperties().
-
-    \sa setScriptableProperty(), scriptableProperties()
-*/
-QVariant QWebElement::scriptableProperty(const QString &name) const
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController *scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return QVariant();
-
-    String wcName(name);
-    JSC::JSValue property = thisObject.jsObject()->get(state, JSC::Identifier(state, wcName));
-
-    // ###
-    if (state->hadException())
-        state->clearException();
-
-    int distance = 0;
-    return JSC::Bindings::convertValueToQVariant(state, property, QMetaType::Void, &distance);
-}
-
-/*!
-    Sets the value of the element's \a name property to \a value.
-
-    Information about all available properties is provided through
-    scriptProperties().
-
-    Setting the property will affect the corresponding property in the
-    element's JavaScript binding with the same name.
-
-    \sa scriptableProperty(), scriptableProperties()
-*/
-void QWebElement::setScriptableProperty(const QString &name, const QVariant &value)
-{
-    ScriptState* state = 0;
-    ScriptObject thisObject;
-    ScriptController* scriptController = 0;
-
-    if (!setupScriptObject(m_element, thisObject, state, scriptController))
-        return;
-
-    JSC::JSValue jsValue = JSC::Bindings::convertQVariantToValue(state, scriptController->bindingRootObject(), value);
-    if (!jsValue)
-        return;
-
-    String wcName(name);
-    JSC::PutPropertySlot slot;
-    thisObject.jsObject()->put(state, JSC::Identifier(state, wcName), jsValue, slot);
-    if (state->hadException())
-        state->clearException();
-}
-
-/*!
-    Returns a list of property names this element supports.
-
-    The function names returned are the same properties that are accessible
-    from the DOM element's JavaScript binding.
-
-    \sa setScriptableProperty(), scriptableProperty()
-*/
-QStringList QWebElement::scriptableProperties() const
-{
-    if (!m_element)
-        return QStringList();
-
-    Document* document = m_element->document();
-    if (!document)
-        return QStringList();
-
-    Frame* frame = document->frame();
-    if (!frame)
-        return QStringList();
-
-    ScriptController* script = frame->script();
-    JSC::ExecState* exec = script->globalObject()->globalExec();
-
-    JSC::JSValue thisValue = toJS(exec, m_element);
-    if (!thisValue)
-        return QStringList();
-
-    JSC::JSObject* object = thisValue.toObject(exec);
-    if (!object)
-        return QStringList();
-
-    QStringList names;
-
-    // Enumerate the contents of the object
-    JSC::PropertyNameArray properties(exec);
-    object->getPropertyNames(exec, properties);
-    for (JSC::PropertyNameArray::const_iterator it = properties.begin();
-         it != properties.end(); ++it) {
-
-        JSC::JSValue property = object->get(exec, *it);
-        if (!property)
-            continue;
-
-        JSC::JSObject* function = property.toObject(exec);
-        if (!function)
-            continue;
-
-        JSC::CallData callData;
-        JSC::CallType callType = function->getCallData(callData);
-        if (callType != JSC::CallTypeNone)
-            continue;
-
-        JSC::UString ustring = (*it).ustring();
-        names << QString::fromUtf16((const ushort*)ustring.rep()->data(), ustring.size());
-    }
-
-    if (exec->hadException())
-        exec->clearException();
-
-    return names;
-}
-
-/*!
-    \enum QWebElement::ResolveRule
-    \since 4.6
+    \enum QWebElement::StyleResolveStrategy
 
     This enum describes how QWebElement's styleProperty resolves the given
     property name.
 
-    \value IgnoreCascadingStyles Return the property value as it is defined in
+    \value InlineStyle Return the property value as it is defined in
            the element, without respecting style inheritance and other CSS
            rules.
-    \value RespectCascadingStyles The property's value is determined using the
+    \value CascadedStyle The property's value is determined using the
            inheritance and importance rules defined in the document's
            stylesheet.
+    \value ComputedStyle The property's value is the absolute value
+           of the style property resolved from the environment.
 */
 
 /*!
-    \enum QWebElement::StylePriority
-    \since 4.6
-
-    This enum describes the priority newly set CSS properties should have when
-    set using QWebElement::setStyleProperty().
-
-    \value NormalStylePriority Define the property without important priority
-           even if "!important" is explicitly set in \a value.
-    \value DeclaredStylePriority Define the property respecting the priority
-           specified in \a value.
-    \value ImportantStylePriority Define the property to have an important
-           priority. This is equal to appending "!important" to the value.
-*/
-
-/*!
-    Returns the value of the style with the given \a name. If a style with
-    \a name does not exist, an empty string is returned.
-
-    If \a rule is IgnoreCascadingStyles, the value defined inside the element
-    (inline in CSS terminology) is returned.
-
-    if \a rule is RespectCascadingStyles, the actual style applied to the
-    element is returned.
+    Returns the value of the style with the given \a name using the specified
+    \a strategy. If a style with \a name does not exist, an empty string is
+    returned.
 
     In CSS, the cascading part depends on which CSS rule has priority and is
     thus applied. Generally, the last defined rule has priority. Thus, an
@@ -997,7 +752,8 @@ QStringList QWebElement::scriptableProperties() const
 
     \sa setStyleProperty()
 */
-QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
+
+QString QWebElement::styleProperty(const QString &name, StyleResolveStrategy strategy) const
 {
     if (!m_element || !m_element->isStyledElement())
         return QString();
@@ -1009,10 +765,10 @@ QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
 
     CSSStyleDeclaration* style = static_cast<StyledElement*>(m_element)->style();
 
-    if (rule == IgnoreCascadingStyles)
+    if (strategy == InlineStyle)
         return style->getPropertyValue(propID);
 
-    if (rule == RespectCascadingStyles) {
+    if (strategy == CascadedStyle) {
         if (style->getPropertyPriority(propID))
             return style->getPropertyValue(propID);
 
@@ -1040,33 +796,33 @@ QString QWebElement::styleProperty(const QString &name, ResolveRule rule) const
         return style->getPropertyValue(propID);
     }
 
+    if (strategy == ComputedStyle) {
+        if (!m_element || !m_element->isStyledElement())
+            return QString();
+
+        int propID = cssPropertyID(name);
+
+        RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element);
+        if (!propID || !style)
+            return QString();
+
+        return style->getPropertyValue(propID);
+    }
+
     return QString();
 }
 
 /*!
-    Sets the value of the style with the given \a name to \a value.
+    Sets the value of the inline style with the given \a name to \a value.
 
     Setting a value, does not necessarily mean that it will become the applied
     value, due to the fact that the style property's value might have been set
-    earlier with priority in external or embedded style declarations.
-
-    In order to ensure that the value will be applied, ImportantStylePriority
-    should be used as \a priority.
+    earlier with a higher priority in external or embedded style declarations.
 
-    Following the CSS syntax for property values, this is equal to appending
+    In order to ensure that the value will be applied, you may have to append
     "!important" to the value.
-
-    This syntax is supported when using DeclaredStylePriority as \a priority.
-
-    Using NormalStylePriority as \a priority, the property will have normal
-    priority, and any "!important" declaration will be ignored. On the other
-    hand, using ImportantStylePriority sets the important priority even when
-    it is not explicitly passed in \a value.
-
-    By using DeclaredStylePriority as \a priority the property will respect the
-    priority specified in \a value.
 */
-void QWebElement::setStyleProperty(const QString &name, const QString &value, StylePriority priority)
+void QWebElement::setStyleProperty(const QString &name, const QString &value)
 {
     if (!m_element || !m_element->isStyledElement())
         return;
@@ -1077,43 +833,7 @@ void QWebElement::setStyleProperty(const QString &name, const QString &value, St
         return;
 
     ExceptionCode exception = 0;
-
-    const QRegExp hasImportantTest(QLatin1String("!\\s*important"));
-    int index = value.indexOf(hasImportantTest);
-
-    QString newValue = (index != -1) ? value.left(index - 1) : value;
-
-    switch (priority) {
-    case NormalStylePriority:
-        style->setProperty(name, newValue, "", exception);
-        break;
-    case DeclaredStylePriority:
-        style->setProperty(name, newValue, (index != -1) ? "important" : "", exception);
-        break;
-    case ImportantStylePriority:
-        style->setProperty(name, newValue, "important", exception);
-        break;
-    default:
-        break;
-    }
-}
-
-/*!
-    Returns the computed value for style with the given \a name. If a style
-    with \a name does not exist, an empty string is returned.
-*/
-QString QWebElement::computedStyleProperty(const QString &name) const
-{
-    if (!m_element || !m_element->isStyledElement())
-        return QString();
-
-    int propID = cssPropertyID(name);
-
-    RefPtr<CSSComputedStyleDeclaration> style = computedStyle(m_element);
-    if (!propID || !style)
-        return QString();
-
-    return style->getPropertyValue(propID);
+    style->setProperty(name, value, exception);
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
index 5f4870c..3db4637 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebelement.h
@@ -74,6 +74,9 @@ public:
     void removeClass(const QString& name);
     void toggleClass(const QString& name);
 
+    bool hasFocus() const;
+    void setFocus();
+
     QRect geometry() const;
 
     QString tagName() const;
@@ -120,22 +123,15 @@ public:
     void removeFromDocument();
     void removeChildren();
 
-    QVariant evaluateScript(const QString& scriptSource);
-
-    QVariant callFunction(const QString& functionName, const QVariantList& arguments = QVariantList());
-    QStringList functions() const;
-
-    QVariant scriptableProperty(const QString& name) const;
-    void setScriptableProperty(const QString& name, const QVariant& value);
-    QStringList scriptableProperties() const;
-
-    enum ResolveRule { IgnoreCascadingStyles, RespectCascadingStyles };
-    QString styleProperty(const QString& name, ResolveRule = IgnoreCascadingStyles) const;
-
-    enum StylePriority { NormalStylePriority, DeclaredStylePriority, ImportantStylePriority };
-    void setStyleProperty(const QString& name, const QString& value, StylePriority = DeclaredStylePriority);
+    QVariant evaluateJavaScript(const QString& scriptSource);
 
-    QString computedStyleProperty(const QString& name) const;
+    enum StyleResolveStrategy {
+         InlineStyle,
+         CascadedStyle,
+         ComputedStyle,
+    };
+    QString styleProperty(const QString& name, StyleResolveStrategy strategy) const;
+    void setStyleProperty(const QString& name, const QString& value);
 
 private:
     explicit QWebElement(WebCore::Element*);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index af27788..45a38c6 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -271,7 +271,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     contextMenuClient = new ContextMenuClientQt();
     editorClient = new EditorClientQt(q);
     page = new Page(chromeClient, contextMenuClient, editorClient,
-                    new DragClientQt(q), new InspectorClientQt(q));
+                    new DragClientQt(q), new InspectorClientQt(q), 0);
 
     // ### should be configurable
     page->settings()->setDefaultTextEncodingName("iso-8859-1");
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 7020ec0..a8b5c38 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,99 @@
+2009-09-28  Andre Poenitz  <andre.poenitz@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compile fix with namespaced Qt.
+
+        * Api/qwebinspector_p.h:
+
+2009-09-27  Joe Ligman  <joseph.ligman@mindspring.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Adding API setFocus and hasFocus to QWebElement. This API is needed for
+        clients that want to check/set the focus node of the document.
+        https://bugs.webkit.org/show_bug.cgi?id=29682
+
+        * Api/qwebelement.cpp:
+        (QWebElement::hasFocus):
+        (QWebElement::setFocus):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::hasSetFocus):
+
+2009-09-25  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make tst_qwebframe work if Qt built without SSL support
+        https://bugs.webkit.org/show_bug.cgi?id=29735
+
+        * tests/qwebframe/tst_qwebframe.cpp: Missing #ifndef blocks added.
+
+2009-09-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update QWebElement API to remove script related methods.
+        QWebElement::evaluateScript is the only one kept, these are
+        removed to postpone most of the QtWebKit<->JavaScript API design
+        after 4.6.
+        https://bugs.webkit.org/show_bug.cgi?id=29708
+
+        * Api/qwebelement.cpp:
+        * Api/qwebelement.h:
+        Methods removed:
+        - QWebElement::callFunction
+        - QWebElement::functions
+        - QWebElement::scriptableProperty
+        - QWebElement::setScriptableProperty
+        - QWebElement::scriptableProperties
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::evaluateScript):
+
+2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Rename QWebElement::evaluateScript
+        to QWebElement::evaluateJavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=29709
+
+        * Api/qwebelement.cpp:
+        (QWebElement::evaluateJavaScript):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::evaluateJavaScript):
+
+2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update the stypeProperty API of QWebElement.
+        https://bugs.webkit.org/show_bug.cgi?id=29711
+
+        * Api/qwebelement.cpp:
+        (QWebElement::styleProperty):
+        - Merge the stypeProperty and the computedStyleProperty methods
+        - Remove the default value for the style resolving enum
+        - Rename ResolveRule to StyleResolveStrategy
+        (QWebElement::setStyleProperty):
+        - Remove the priority argument since it is possible to control the
+          behaviour by adding !important or removing in the value.
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::style):
+        (tst_QWebElement::computedStyle):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Reviewed by Alice Liu.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        Pass 0 for new Page constructor argument.
+
 2009-09-24  Martin Smith  <msmith@trolltech.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebview_snippet.cpp b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebview_snippet.cpp
index f04cd29..069bea2 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebview_snippet.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/docs/webkitsnippets/qtwebkit_qwebview_snippet.cpp
@@ -13,22 +13,22 @@ void wrapInFunction()
 
 
 //! [2]
-    view->triggerAction(QWebPage::Copy);
+    view->triggerPageAction(QWebPage::Copy);
 //! [2]
 
 
 //! [3]
-    view->page()->triggerPageAction(QWebPage::Stop);
+    view->page()->triggerAction(QWebPage::Stop);
 //! [3]
 
 
 //! [4]
-    view->page()->triggerPageAction(QWebPage::GoBack);
+    view->page()->triggerAction(QWebPage::GoBack);
 //! [4]
 
 
 //! [5]
-    view->page()->triggerPageAction(QWebPage::GoForward);
+    view->page()->triggerAction(QWebPage::GoForward);
 //! [5]
 
 }
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 0819a3a..00783d1 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -71,15 +71,11 @@ private slots:
     void classes();
     void namespaceURI();
     void foreachManipulation();
-    void evaluateScript();
-    void callFunction();
-    void callFunctionSubmitForm();
-    void functionNames();
+    void evaluateJavaScript();
     void documentElement();
     void frame();
     void style();
     void computedStyle();
-    void properties();
     void appendAndPrepend();
     void insertBeforeAndAfter();
     void remove();
@@ -90,6 +86,7 @@ private slots:
     void nullSelect();
     void firstChildNextSibling();
     void lastChildPreviousSibling();
+    void hasSetFocus();
 
 private:
     QWebView* m_view;
@@ -282,69 +279,31 @@ void tst_QWebElement::foreachManipulation()
     QCOMPARE(body.findAll("div").count(), 4);
 }
 
-void tst_QWebElement::evaluateScript()
+void tst_QWebElement::evaluateJavaScript()
 {
     QVariant result;
     m_mainFrame->setHtml("<body><p>test");
     QWebElement para = m_mainFrame->findFirstElement("p");
 
-    result = para.evaluateScript("this.tagName");
+    result = para.evaluateJavaScript("this.tagName");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::String);
     QCOMPARE(result.toString(), QLatin1String("P"));
 
-    QVERIFY(para.functions().contains("hasAttributes"));
-    result = para.evaluateScript("this.hasAttributes()");
+    result = para.evaluateJavaScript("this.hasAttributes()");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::Bool);
     QVERIFY(!result.toBool());
 
-    para.evaluateScript("this.setAttribute('align', 'left');");
+    para.evaluateJavaScript("this.setAttribute('align', 'left');");
     QCOMPARE(para.attribute("align"), QLatin1String("left"));
 
-    result = para.evaluateScript("this.hasAttributes()");
+    result = para.evaluateJavaScript("this.hasAttributes()");
     QVERIFY(result.isValid());
     QVERIFY(result.type() == QVariant::Bool);
     QVERIFY(result.toBool());
 }
 
-void tst_QWebElement::callFunction()
-{
-    m_mainFrame->setHtml("<body><p>test");
-    QWebElement body = m_mainFrame->documentElement();
-    QVERIFY(body.functions().contains("hasChildNodes"));
-    QVariant result = body.callFunction("hasChildNodes");
-    QVERIFY(result.isValid());
-    QVERIFY(result.type() == QVariant::Bool);
-    QVERIFY(result.toBool());
-
-    body.callFunction("setAttribute", QVariantList() << "foo" << "bar");
-    QCOMPARE(body.attribute("foo"), QString("bar"));
-}
-
-void tst_QWebElement::callFunctionSubmitForm()
-{
-    m_mainFrame->setHtml(QString("<html><body><form name='tstform' action='data:text/html,foo'method='get'>"
-                                 "<input type='text'><input type='submit'></form></body></html>"), QUrl());
-
-    QWebElement form = m_mainFrame->documentElement().findAll("form").at(0);
-    QVERIFY(form.functions().contains("submit"));
-    QVERIFY(!form.isNull());
-    form.callFunction("submit");
-
-    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
-    QCOMPARE(m_mainFrame->url().toString(), QString("data:text/html,foo?"));
-}
-
-void tst_QWebElement::functionNames()
-{
-    m_mainFrame->setHtml("<body><p>Test");
-
-    QWebElement body = m_mainFrame->documentElement();
-
-    QVERIFY(body.functions().contains("setAttribute"));
-}
-
 void tst_QWebElement::documentElement()
 {
     m_mainFrame->setHtml("<body><p>Test");
@@ -398,27 +357,27 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html);
 
     QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QVERIFY(p.styleProperty("cursor").isEmpty());
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QVERIFY(p.styleProperty("cursor", QWebElement::InlineStyle).isEmpty());
 
     p.setStyleProperty("color", "red");
     p.setStyleProperty("cursor", "auto");
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("yellow"));
-    QCOMPARE(p.styleProperty("cursor"), QLatin1String("auto"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("yellow"));
+    QCOMPARE(p.styleProperty("cursor", QWebElement::InlineStyle), QLatin1String("auto"));
 
     p.setStyleProperty("color", "green !important");
-    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
     p.setStyleProperty("color", "blue");
-    QCOMPARE(p.styleProperty("color"), QLatin1String("green"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("green"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("green"));
 
-    p.setStyleProperty("color", "blue", QWebElement::ImportantStylePriority);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    p.setStyleProperty("color", "blue !important");
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html2 = "<head>"
         "<style type='text/css'>"
@@ -434,8 +393,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html2);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html3 = "<head>"
         "<style type='text/css'>"
@@ -451,8 +410,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html3);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("blue"));
 
     QString html5 = "<head>"
         "<style type='text/css'>"
@@ -468,8 +427,8 @@ void tst_QWebElement::style()
     m_mainFrame->setHtml(html5);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 
     QString html6 = "<head>"
         "<link rel='stylesheet' href='qrc:/style.css' type='text/css' />"
@@ -489,8 +448,8 @@ void tst_QWebElement::style()
     QTest::qWait(200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color"), QLatin1String("blue"));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("blue"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html7 = "<head>"
         "<style type='text/css'>"
@@ -507,15 +466,15 @@ void tst_QWebElement::style()
     QTest::qWait(200);
 
     p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("black"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("black"));
 
     QString html8 = "<body><p>some text</p></body>";
 
     m_mainFrame->setHtml(html8);
     p = m_mainFrame->documentElement().findAll("p").at(0);
 
-    QCOMPARE(p.styleProperty("color"), QLatin1String(""));
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String(""));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String(""));
 }
 
 void tst_QWebElement::computedStyle()
@@ -524,47 +483,16 @@ void tst_QWebElement::computedStyle()
     m_mainFrame->setHtml(html);
 
     QWebElement p = m_mainFrame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("auto"));
-    QVERIFY(!p.computedStyleProperty("cursor").isEmpty());
-    QVERIFY(p.styleProperty("cursor").isEmpty());
+    QCOMPARE(p.styleProperty("cursor", QWebElement::ComputedStyle), QLatin1String("auto"));
+    QVERIFY(!p.styleProperty("cursor", QWebElement::ComputedStyle).isEmpty());
+    QVERIFY(p.styleProperty("cursor", QWebElement::InlineStyle).isEmpty());
 
     p.setStyleProperty("cursor", "text");
     p.setStyleProperty("color", "red");
 
-    QCOMPARE(p.computedStyleProperty("cursor"), QLatin1String("text"));
-    QCOMPARE(p.computedStyleProperty("color"), QLatin1String("rgb(255, 0, 0)"));
-    QCOMPARE(p.styleProperty("color"), QLatin1String("red"));
-}
-
-void tst_QWebElement::properties()
-{
-    m_mainFrame->setHtml("<body><form><input type=checkbox id=ourcheckbox checked=true>");
-
-    QWebElement checkBox = m_mainFrame->findFirstElement("#ourcheckbox");
-    QVERIFY(!checkBox.isNull());
-
-    QVERIFY(checkBox.scriptableProperties().contains("checked"));
-
-    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(true));
-    checkBox.setScriptableProperty("checked", false);
-    QCOMPARE(checkBox.scriptableProperty("checked"), QVariant(false));
-
-    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
-
-    checkBox.setScriptableProperty("non_existant", "test");
-
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant("test"));
-    QVERIFY(checkBox.scriptableProperties().contains("non_existant"));
-
-    // removing scriptableProperties is currently not supported. We should look into this
-    // and consider the option of just allowing through the QtScript API only.
-#if 0
-    checkBox.setScriptableProperty("non_existant", QVariant());
-
-    QCOMPARE(checkBox.scriptableProperty("non_existant"), QVariant());
-    QVERIFY(!checkBox.scriptableProperties().contains("non_existant"));
-#endif
+    QCOMPARE(p.styleProperty("cursor", QWebElement::ComputedStyle), QLatin1String("text"));
+    QCOMPARE(p.styleProperty("color", QWebElement::ComputedStyle), QLatin1String("rgb(255, 0, 0)"));
+    QCOMPARE(p.styleProperty("color", QWebElement::InlineStyle), QLatin1String("red"));
 }
 
 void tst_QWebElement::appendAndPrepend()
@@ -878,5 +806,24 @@ void tst_QWebElement::lastChildPreviousSibling()
     QVERIFY(p.previousSibling().isNull());
 }
 
+void tst_QWebElement::hasSetFocus()
+{
+    m_mainFrame->setHtml("<html><body>" \
+                            "<input type='text' id='input1'/>" \
+                            "<br>"\
+                            "<input type='text' id='input2'/>" \
+                            "</body></html>");
+
+    QList<QWebElement> inputs = m_mainFrame->documentElement().findAll("input");
+    QWebElement input1 = inputs.at(0);
+    input1.setFocus();
+    QVERIFY(input1.hasFocus());
+
+    QWebElement input2 = inputs.at(1);
+    input2.setFocus();
+    QVERIFY(!input1.hasFocus());
+    QVERIFY(input2.hasFocus());
+}
+
 QTEST_MAIN(tst_QWebElement)
 #include "tst_qwebelement.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 729b971..797446b 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -33,7 +33,9 @@
 #include <QRegExp>
 #include <QNetworkRequest>
 #include <QNetworkReply>
+#ifndef QT_NO_OPENSSL
 #include <qsslerror.h>
+#endif
 #include "../util.h"
 
 //TESTED_CLASS=
@@ -2183,8 +2185,11 @@ public:
         if (request.url() == QUrl("qrc:/test1.html")) {
             setHeader(QNetworkRequest::LocationHeader, QString("qrc:/test2.html"));
             setAttribute(QNetworkRequest::RedirectionTargetAttribute, QUrl("qrc:/test2.html"));
-        } else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
+        }
+#ifndef QT_NO_OPENSSL
+        else if (request.url() == QUrl("qrc:/fake-ssl-error.html"))
             setError(QNetworkReply::SslHandshakeFailedError, tr("Fake error !")); // force a ssl error
+#endif
         else if (request.url() == QUrl("http://abcdef.abcdef/"))
             setError(QNetworkReply::HostNotFoundError, tr("Invalid URL"));
 
@@ -2211,8 +2216,10 @@ private slots:
             emit error(this->error());
         else if (request().url() == QUrl("http://abcdef.abcdef/"))
             emit metaDataChanged();
+#ifndef QT_NO_OPENSSL
         else if (request().url() == QUrl("qrc:/fake-ssl-error.html"))
             return;
+#endif
 
         emit readyRead();
         emit finished();
@@ -2232,12 +2239,14 @@ protected:
         if (op == QNetworkAccessManager::GetOperation)
             if (url == "qrc:/test1.html" ||  url == "http://abcdef.abcdef/")
                 return new FakeReply(request, this);
+#ifndef QT_NO_OPENSSL
             else if (url == "qrc:/fake-ssl-error.html") {
                 FakeReply* reply = new FakeReply(request, this);
                 QList<QSslError> errors;
                 emit sslErrors(reply, errors << QSslError(QSslError::UnspecifiedError));
                 return reply;
             }
+#endif
 
         return QNetworkAccessManager::createRequest(op, request, outgoingData);
     }
@@ -2271,6 +2280,7 @@ void tst_QWebFrame::requestedUrl()
     QCOMPARE(frame->requestedUrl(), QUrl("http://abcdef.abcdef/"));
     QCOMPARE(frame->url(), QUrl("http://abcdef.abcdef/"));
 
+#ifndef QT_NO_OPENSSL
     qRegisterMetaType<QList<QSslError> >("QList<QSslError>");
     qRegisterMetaType<QNetworkReply* >("QNetworkReply*");
 
@@ -2280,6 +2290,7 @@ void tst_QWebFrame::requestedUrl()
     QCOMPARE(spy2.count(), 1);
     QCOMPARE(frame->requestedUrl(), QUrl("qrc:/fake-ssl-error.html"));
     QCOMPARE(frame->url(), QUrl("qrc:/fake-ssl-error.html"));
+#endif
 }
 
 void tst_QWebFrame::javaScriptWindowObjectCleared_data()
@@ -2356,7 +2367,7 @@ void tst_QWebFrame::setHtmlWithResource()
     QCOMPARE(spy.size(), 2);
 
     QWebElement p = frame->documentElement().findAll("p").at(0);
-    QCOMPARE(p.styleProperty("color", QWebElement::RespectCascadingStyles), QLatin1String("red"));
+    QCOMPARE(p.styleProperty("color", QWebElement::CascadedStyle), QLatin1String("red"));
 }
 
 class TestNetworkManager : public QNetworkAccessManager
diff --git a/src/corelib/kernel/qcoreapplication.cpp b/src/corelib/kernel/qcoreapplication.cpp
index 61b9ee7..8a55bad 100644
--- a/src/corelib/kernel/qcoreapplication.cpp
+++ b/src/corelib/kernel/qcoreapplication.cpp
@@ -2067,7 +2067,8 @@ QStringList QCoreApplication::arguments()
                 ;
             else if (l1arg == "-style" ||
                      l1arg == "-session" ||
-                     l1arg == "-graphicssystem")
+                     l1arg == "-graphicssystem" ||
+                     l1arg == "-testability")
                 ++a;
             else
                 stripped += arg;
diff --git a/src/corelib/statemachine/qabstracttransition.cpp b/src/corelib/statemachine/qabstracttransition.cpp
index 8b858c7..76baa0a 100644
--- a/src/corelib/statemachine/qabstracttransition.cpp
+++ b/src/corelib/statemachine/qabstracttransition.cpp
@@ -93,6 +93,10 @@ QT_BEGIN_NAMESPACE
     \property QAbstractTransition::targetState
 
     \brief the target state of this transition
+
+    If a transition has no target state, the transition may still be
+    triggered, but this will not cause the state machine's configuration to
+    change (i.e. the current state will not be exited and re-entered).
 */
 
 /*!
diff --git a/src/corelib/statemachine/qstatemachine.cpp b/src/corelib/statemachine/qstatemachine.cpp
index 503eec0..8d50870c 100644
--- a/src/corelib/statemachine/qstatemachine.cpp
+++ b/src/corelib/statemachine/qstatemachine.cpp
@@ -804,6 +804,14 @@ void QStateMachinePrivate::applyProperties(const QList<QAbstractTransition*> &tr
         }
 
         if (hasValidEndValue) {
+            if (anim->state() == QAbstractAnimation::Running) {
+                // The animation is still running. This can happen if the
+                // animation is a group, and one of its children just finished,
+                // and that caused a state to emit its polished() signal, and
+                // that triggered a transition in the machine.
+                // Just stop the animation so it is correctly restarted again.
+                anim->stop();
+            }
             anim->start();
         }
     }
@@ -1268,12 +1276,19 @@ void QStateMachinePrivate::_q_process()
     }
 }
 
-void QStateMachinePrivate::scheduleProcess()
+void QStateMachinePrivate::processEvents(EventProcessingMode processingMode)
 {
     if ((state != Running) || processing || processingScheduled)
         return;
-    processingScheduled = true;
-    QMetaObject::invokeMethod(q_func(), "_q_process", Qt::QueuedConnection);
+    switch (processingMode) {
+    case DirectProcessing:
+        _q_process();
+        break;
+    case QueuedProcessing:
+        processingScheduled = true;
+        QMetaObject::invokeMethod(q_func(), "_q_process", Qt::QueuedConnection);
+        break;
+    }
 }
 
 namespace {
@@ -1335,7 +1350,7 @@ void QStateMachinePrivate::goToState(QAbstractState *targetState)
         trans->setTargetState(targetState);
     }
 
-    scheduleProcess();
+    processEvents(QueuedProcessing);
 }
 
 void QStateMachinePrivate::registerTransitions(QAbstractState *state)
@@ -1512,6 +1527,15 @@ void QStateMachinePrivate::unregisterEventTransition(QEventTransition *transitio
     }
     QEventTransitionPrivate::get(transition)->registered = false;
 }
+
+void QStateMachinePrivate::handleFilteredEvent(QObject *watched, QEvent *event)
+{
+    Q_ASSERT(qobjectEvents.contains(watched));
+    if (qobjectEvents[watched].contains(event->type())) {
+        internalEventQueue.append(new QStateMachine::WrappedEvent(watched, handler->cloneEvent(event)));
+        processEvents(DirectProcessing);
+    }
+}
 #endif
 
 void QStateMachinePrivate::handleTransitionSignal(QObject *sender, int signalIndex,
@@ -1533,7 +1557,7 @@ void QStateMachinePrivate::handleTransitionSignal(QObject *sender, int signalInd
              << ", signal =" << sender->metaObject()->method(signalIndex).signature() << ')';
 #endif
     internalEventQueue.append(new QStateMachine::SignalEvent(sender, signalIndex, vargs));
-    scheduleProcess();
+    processEvents(DirectProcessing);
 }
 
 /*!
@@ -1768,7 +1792,7 @@ void QStateMachine::stop()
         break;
     case QStateMachinePrivate::Running:
         d->stop = true;
-        d->scheduleProcess();
+        d->processEvents(QStateMachinePrivate::QueuedProcessing);
         break;
     }
 }
@@ -1798,7 +1822,7 @@ void QStateMachine::postEvent(QEvent *event, int delay)
         d->delayedEvents[tid] = event;
     } else {
         d->externalEventQueue.append(event);
-        d->scheduleProcess();
+        d->processEvents(QStateMachinePrivate::QueuedProcessing);
     }
 }
 
@@ -1814,7 +1838,7 @@ void QStateMachine::postInternalEvent(QEvent *event)
     qDebug() << this << ": posting internal event" << event;
 #endif
     d->internalEventQueue.append(event);
-    d->scheduleProcess();
+    d->processEvents(QStateMachinePrivate::QueuedProcessing);
 }
 
 /*!
@@ -1862,7 +1886,7 @@ bool QStateMachine::event(QEvent *e)
             killTimer(tid);
             QEvent *ee = d->delayedEvents.take(tid);
             d->externalEventQueue.append(ee);
-            d->scheduleProcess();
+            d->processEvents(QStateMachinePrivate::DirectProcessing);
             return true;
         }
     }
@@ -1876,9 +1900,7 @@ bool QStateMachine::event(QEvent *e)
 bool QStateMachine::eventFilter(QObject *watched, QEvent *event)
 {
     Q_D(QStateMachine);
-    Q_ASSERT(d->qobjectEvents.contains(watched));
-    if (d->qobjectEvents[watched].contains(event->type()))
-        postEvent(new QStateMachine::WrappedEvent(watched, d->handler->cloneEvent(event)));
+    d->handleFilteredEvent(watched, event);
     return false;
 }
 #endif
diff --git a/src/corelib/statemachine/qstatemachine_p.h b/src/corelib/statemachine/qstatemachine_p.h
index a1b6de2..141bc5c 100644
--- a/src/corelib/statemachine/qstatemachine_p.h
+++ b/src/corelib/statemachine/qstatemachine_p.h
@@ -88,6 +88,10 @@ public:
         Starting,
         Running
     };
+    enum EventProcessingMode {
+        DirectProcessing,
+        QueuedProcessing
+    };
     enum StopProcessingReason {
         EventQueueEmpty,
         Finished,
@@ -149,12 +153,13 @@ public:
 #ifndef QT_NO_STATEMACHINE_EVENTFILTER
     void registerEventTransition(QEventTransition *transition);
     void unregisterEventTransition(QEventTransition *transition);
+    void handleFilteredEvent(QObject *watched, QEvent *event);
 #endif
     void unregisterTransition(QAbstractTransition *transition);
     void unregisterAllTransitions();
     void handleTransitionSignal(QObject *sender, int signalIndex,
                                 void **args);    
-    void scheduleProcess();
+    void processEvents(EventProcessingMode processingMode);
     
 #ifndef QT_NO_PROPERTIES
     typedef QPair<QObject *, QByteArray> RestorableId;
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout.cpp b/src/gui/graphicsview/qgraphicsanchorlayout.cpp
index b3ebb2b..fdb1708 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout.cpp
+++ b/src/gui/graphicsview/qgraphicsanchorlayout.cpp
@@ -80,6 +80,24 @@
     PM_LayoutHorizontalSpacing (or PM_LayoutVerticalSpacing for vertical anchors).
 */
 
+/*!
+    \class QGraphicsAnchor
+    \brief The QGraphicsAnchor class represents an anchor between two items in a
+           QGraphicsAnchorLayout.
+    \since 4.6
+    \ingroup appearance
+    \ingroup geomanagement
+    \ingroup graphicsview-api
+
+    The graphics anchor provides an API that enables you to query and manipulate the
+    properties an anchor has. When an anchor is added to the layout with
+    QGraphicsAnchorLayout::addAnchor(), a QGraphicsAnchor instance is returned where the properties
+    are initialized to their default values. The properties can then be further changed, and they
+    will be picked up the next time the layout is activated.
+
+    \sa QGraphicsAnchorLayout::anchor()
+
+*/
 #include "qgraphicsanchorlayout_p.h"
 
 QT_BEGIN_NAMESPACE
@@ -288,18 +306,6 @@ void QGraphicsAnchorLayout::addAnchors(QGraphicsLayoutItem *firstItem,
 }
 
 /*!
-    Returns true if there are no arrangement that satisfies all constraints.
-    Otherwise returns false.
-
-    \sa addAnchor()
-*/
-bool QGraphicsAnchorLayout::hasConflicts() const
-{
-    Q_D(const QGraphicsAnchorLayout);
-    return d->hasConflicts();
-}
-
-/*!
     Sets the default horizontal spacing for the anchor layout to \a spacing.
 
     \sa horizontalSpacing(), setVerticalSpacing(), setSpacing()
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout.h b/src/gui/graphicsview/qgraphicsanchorlayout.h
index 44074d1..d9a87ba 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout.h
+++ b/src/gui/graphicsview/qgraphicsanchorlayout.h
@@ -93,7 +93,6 @@ public:
                     QGraphicsLayoutItem *secondItem,
                     Qt::Orientations orientations = Qt::Horizontal | Qt::Vertical);
 
-    bool hasConflicts() const;
     void setHorizontalSpacing(qreal spacing);
     void setVerticalSpacing(qreal spacing);
     void setSpacing(qreal spacing);
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout_p.cpp b/src/gui/graphicsview/qgraphicsanchorlayout_p.cpp
index 49aabf5..f75118b 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout_p.cpp
+++ b/src/gui/graphicsview/qgraphicsanchorlayout_p.cpp
@@ -2287,6 +2287,13 @@ bool QGraphicsAnchorLayoutPrivate::solvePreferred(QList<QSimplexConstraint *> co
     return feasible;
 }
 
+/*!
+    \internal
+    Returns true if there are no arrangement that satisfies all constraints.
+    Otherwise returns false.
+
+    \sa addAnchor()
+*/
 bool QGraphicsAnchorLayoutPrivate::hasConflicts() const
 {
     QGraphicsAnchorLayoutPrivate *that = const_cast<QGraphicsAnchorLayoutPrivate*>(this);
diff --git a/src/gui/graphicsview/qgraphicsanchorlayout_p.h b/src/gui/graphicsview/qgraphicsanchorlayout_p.h
index 4e1bcd4..c86bfa3 100644
--- a/src/gui/graphicsview/qgraphicsanchorlayout_p.h
+++ b/src/gui/graphicsview/qgraphicsanchorlayout_p.h
@@ -343,7 +343,7 @@ public:
 
   QGraphicsAnchorLayout private methods and attributes.
 */
-class QGraphicsAnchorLayoutPrivate : public QGraphicsLayoutPrivate
+class Q_AUTOTEST_EXPORT QGraphicsAnchorLayoutPrivate : public QGraphicsLayoutPrivate
 {
     Q_DECLARE_PUBLIC(QGraphicsAnchorLayout)
 
@@ -370,6 +370,11 @@ public:
 
     QGraphicsAnchorLayoutPrivate();
 
+    static QGraphicsAnchorLayoutPrivate *get(QGraphicsAnchorLayout *q)
+    {
+        return q ? q->d_func() : 0;
+    }
+
     static Qt::AnchorPoint oppositeEdge(
         Qt::AnchorPoint edge);
 
diff --git a/src/gui/kernel/qapplication.cpp b/src/gui/kernel/qapplication.cpp
index 2ad89a2..df5097b 100644
--- a/src/gui/kernel/qapplication.cpp
+++ b/src/gui/kernel/qapplication.cpp
@@ -97,6 +97,10 @@
 
 #include "qapplication.h"
 
+#ifndef QT_NO_LIBRARY
+#include "qlibrary.h"
+#endif
+
 #ifdef Q_WS_WINCE
 #include "qdatetime.h"
 #include "qguifunctions_wince.h"
@@ -457,6 +461,7 @@ bool QApplicationPrivate::animate_tooltip = false;
 bool QApplicationPrivate::fade_tooltip = false;
 bool QApplicationPrivate::animate_toolbox = false;
 bool QApplicationPrivate::widgetCount = false;
+bool QApplicationPrivate::load_testability = false;
 #if defined(Q_WS_WIN) && !defined(Q_WS_WINCE)
 bool QApplicationPrivate::inSizeMove = false;
 #endif
@@ -563,6 +568,8 @@ void QApplicationPrivate::process_cmdline()
             QApplication::setLayoutDirection(Qt::RightToLeft);
         } else if (qstrcmp(arg, "-widgetcount") == 0) {
             widgetCount = true;
+        } else if (qstrcmp(arg, "-testability") == 0) {
+            load_testability = true;
         } else if (arg == "-graphicssystem" && i < argc-1) {
             graphics_system_name = QString::fromLocal8Bit(argv[++i]);
         } else {
@@ -765,6 +772,23 @@ void QApplicationPrivate::construct(
     extern void qt_gui_eval_init(uint);
     qt_gui_eval_init(application_type);
 #endif
+
+#ifndef QT_NO_LIBRARY
+    if(load_testability) {
+        QLibrary testLib(QLatin1String("qttestability"));
+        if (testLib.load()) {
+            typedef void (*TasInitialize)(void);
+            TasInitialize initFunction = (TasInitialize)testLib.resolve("qt_testability_init");
+            if (initFunction) {
+                initFunction();
+            } else {
+                qCritical("Library qttestability resolve failed!");
+            }
+        } else {
+            qCritical("Library qttestability load failed!");
+        }
+    }
+#endif
 }
 
 #if defined(Q_WS_X11)
diff --git a/src/gui/kernel/qapplication_p.h b/src/gui/kernel/qapplication_p.h
index aec21fd..6036196 100644
--- a/src/gui/kernel/qapplication_p.h
+++ b/src/gui/kernel/qapplication_p.h
@@ -452,6 +452,7 @@ public:
     static bool fade_tooltip;
     static bool animate_toolbox;
     static bool widgetCount; // Coupled with -widgetcount switch
+    static bool load_testability; // Coupled with -testability switch
 #ifdef Q_WS_MAC
     static bool native_modal_dialog_active;
 #endif
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp
index b27d1be..ee25239 100644
--- a/src/script/api/qscriptengine.cpp
+++ b/src/script/api/qscriptengine.cpp
@@ -2360,11 +2360,9 @@ JSC::CallFrame *QScriptEnginePrivate::pushContext(JSC::CallFrame *exec, JSC::JSV
         JSC::Register *oldEnd = interp->registerFile().end();
         int argc = args.size() + 1; //add "this"
         JSC::Register *newEnd = oldEnd + argc + JSC::RegisterFile::CallFrameHeaderSize;
-        //Without + argc + JSC::RegisterFile::CallFrameHeaderSize, it crashes.
-        //It seems that JSC is not consistant with the way the callframe is crated
-        if (!interp->registerFile().grow(newEnd + argc + JSC::RegisterFile::CallFrameHeaderSize))
+        if (!interp->registerFile().grow(newEnd))
             return 0; //### Stack overflow
-        newCallFrame = JSC::CallFrame::create(newEnd);
+        newCallFrame = JSC::CallFrame::create(oldEnd);
         newCallFrame[0] = thisObject;
         int dst = 0;
         JSC::ArgList::const_iterator it;
diff --git a/tests/auto/qactiongroup/tst_qactiongroup.cpp b/tests/auto/qactiongroup/tst_qactiongroup.cpp
index c290941..2d215a0 100644
--- a/tests/auto/qactiongroup/tst_qactiongroup.cpp
+++ b/tests/auto/qactiongroup/tst_qactiongroup.cpp
@@ -226,6 +226,14 @@ void tst_QActionGroup::separators()
 
     mw.show();
 
+#ifdef QT_SOFTKEYS_ENABLED
+    // Softkeys add extra "Select" and "Back" actions to menu by default.
+    // Two first actions will be Select and Back when softkeys are enabled
+    int numSoftkeyActions = 2;
+#else
+    int numSoftkeyActions = 0;
+#endif
+
     QAction *action = new QAction(&actGroup);
     action->setText("test one");
 
@@ -237,13 +245,13 @@ void tst_QActionGroup::separators()
     while (it.hasNext())
         menu.addAction(it.next());
 
-    QCOMPARE((int)menu.actions().size(), 2);
+    QCOMPARE((int)menu.actions().size(), 2 + numSoftkeyActions);
 
     it = QListIterator<QAction*>(actGroup.actions());
     while (it.hasNext())
         menu.removeAction(it.next());
 
-    QCOMPARE((int)menu.actions().size(), 0);
+    QCOMPARE((int)menu.actions().size(), 0 + numSoftkeyActions);
 
     action = new QAction(&actGroup);
     action->setText("test two");
@@ -252,7 +260,7 @@ void tst_QActionGroup::separators()
     while (it.hasNext())
         menu.addAction(it.next());
 
-    QCOMPARE((int)menu.actions().size(), 3);
+    QCOMPARE((int)menu.actions().size(), 3 + numSoftkeyActions);
 }
 
 void tst_QActionGroup::testActionInTwoQActionGroup()
diff --git a/tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp b/tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp
index 2fee98d..9f13aca 100644
--- a/tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp
+++ b/tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp
@@ -40,9 +40,10 @@
 ****************************************************************************/
 
 #include <QtTest/QtTest>
-#include <qgraphicsanchorlayout.h>
-#include <qgraphicswidget.h>
-#include <qgraphicsproxywidget.h>
+#include <QtGui/qgraphicsanchorlayout.h>
+#include <private/qgraphicsanchorlayout_p.h>
+#include <QtGui/qgraphicswidget.h>
+#include <QtGui/qgraphicsproxywidget.h>
 #include <QtGui/qgraphicsview.h>
 
 class tst_QGraphicsAnchorLayout : public QObject {
@@ -142,6 +143,11 @@ static bool checkReverseDirection(QGraphicsWidget *w)
     return true;
 }
 
+static bool layoutHasConflict(QGraphicsAnchorLayout *l)
+{
+    return QGraphicsAnchorLayoutPrivate::get(l)->hasConflicts();
+}
+
 void tst_QGraphicsAnchorLayout::simple()
 {
     QGraphicsWidget *w1 = createItem();
@@ -154,8 +160,6 @@ void tst_QGraphicsAnchorLayout::simple()
     QGraphicsWidget p;
     p.setLayout(l);
 
-    QVERIFY(l->hasConflicts() == false);
-
     QCOMPARE(l->count(), 2);
 }
 
@@ -185,8 +189,6 @@ void tst_QGraphicsAnchorLayout::simple_center()
     setAnchor(l, b, Qt::AnchorBottom, c, Qt::AnchorTop, 0);
     setAnchor(l, c, Qt::AnchorBottom, l, Qt::AnchorBottom, 0);
 
-    QVERIFY(l->hasConflicts() == false);
-
     QCOMPARE(l->count(), 3);
 
     QGraphicsWidget *p = new QGraphicsWidget(0, Qt::Window);
@@ -234,8 +236,6 @@ void tst_QGraphicsAnchorLayout::simple_semifloat()
     setAnchor(l, a, Qt::AnchorBottom, l, Qt::AnchorBottom, 0);
     setAnchor(l, b, Qt::AnchorBottom, l, Qt::AnchorBottom, 0);
 
-    QVERIFY(l->hasConflicts() == false);
-
     QCOMPARE(l->count(), 4);
 
     QGraphicsWidget *p = new QGraphicsWidget(0, Qt::Window);
@@ -296,7 +296,6 @@ void tst_QGraphicsAnchorLayout::layoutDirection()
     view->show();
 
     QCOMPARE(checkReverseDirection(p), true);
-    QVERIFY(l->hasConflicts() == false);
 
     delete p;
     delete view;
@@ -340,8 +339,6 @@ void tst_QGraphicsAnchorLayout::diagonal()
     l->addAnchor(e, Qt::AnchorRight, l, Qt::AnchorRight);
     l->addAnchor(d, Qt::AnchorRight, e, Qt::AnchorLeft);
 
-    QVERIFY(l->hasConflicts() == false);
-
     QCOMPARE(l->count(), 5);
 
     QGraphicsWidget p;
@@ -391,7 +388,7 @@ void tst_QGraphicsAnchorLayout::diagonal()
     QCOMPARE(checkReverseDirection(&p), true);
 
     c->setMinimumWidth(300);
-    QVERIFY(l->hasConflicts());
+    QVERIFY(layoutHasConflict(l));
 }
 
 void tst_QGraphicsAnchorLayout::parallel()
@@ -484,8 +481,6 @@ void tst_QGraphicsAnchorLayout::parallel()
     QCOMPARE(e->geometry(), QRectF(375, 400, 175, 100));
     QCOMPARE(f->geometry(), QRectF(550, 500, 200, 100));
     QCOMPARE(p.size(), layoutMaximumSize);
-
-    QVERIFY(l->hasConflicts() == false);
 }
 
 void tst_QGraphicsAnchorLayout::parallel2()
@@ -510,7 +505,6 @@ void tst_QGraphicsAnchorLayout::parallel2()
     l->addAnchor(l, Qt::AnchorLeft, b, Qt::AnchorLeft);
     l->addAnchor(b, Qt::AnchorRight, a, Qt::AnchorRight);
 
-    QVERIFY(l->hasConflicts() == false);
     QCOMPARE(l->count(), 2);
 
     QGraphicsWidget p;
@@ -592,8 +586,6 @@ void tst_QGraphicsAnchorLayout::snake()
     QCOMPARE(b->geometry(), QRectF(90.0, 100.0, 10.0, 100.0));
     QCOMPARE(c->geometry(), QRectF(90.0, 200.0, 100.0, 100.0));
     QCOMPARE(p.size(), layoutMaximumSize);
-
-    QVERIFY(l->hasConflicts() == false);
 }
 
 void tst_QGraphicsAnchorLayout::snakeOppositeDirections()
@@ -627,7 +619,6 @@ void tst_QGraphicsAnchorLayout::snakeOppositeDirections()
 
     l->addAnchor(c, Qt::AnchorRight, l, Qt::AnchorRight);
 
-    QVERIFY(l->hasConflicts() == false);
     QCOMPARE(l->count(), 3);
 
     QGraphicsWidget p;
@@ -731,8 +722,6 @@ void tst_QGraphicsAnchorLayout::fairDistribution()
     QCOMPARE(c->geometry(), QRectF(200.0, 200.0, 100.0, 100.0));
     QCOMPARE(d->geometry(), QRectF(0.0, 300.0, 300.0, 100.0));
     QCOMPARE(p.size(), layoutMaximumSize);
-
-    QVERIFY(l->hasConflicts() == false);
 }
 
 void tst_QGraphicsAnchorLayout::fairDistributionOppositeDirections()
@@ -809,8 +798,6 @@ void tst_QGraphicsAnchorLayout::fairDistributionOppositeDirections()
     QCOMPARE(a->size(), d->size());
     QCOMPARE(e->size().width(), 4 * a->size().width());
     QCOMPARE(p.size(), layoutMaximumSize);
-
-    QVERIFY(l->hasConflicts() == false);
 }
 
 void tst_QGraphicsAnchorLayout::proportionalPreferred()
@@ -873,8 +860,6 @@ void tst_QGraphicsAnchorLayout::proportionalPreferred()
     QCOMPARE(a->size().width(), 10 * factor);
     QCOMPARE(c->size().width(), 14 * factor);
     QCOMPARE(p.size(), QSizeF(12, 400));
-
-    QVERIFY(l->hasConflicts() == false);
 }
 
 void tst_QGraphicsAnchorLayout::example()
@@ -928,7 +913,6 @@ void tst_QGraphicsAnchorLayout::example()
     l->addAnchor(l, Qt::AnchorLeft, g, Qt::AnchorLeft);
     l->addAnchor(f, Qt::AnchorRight, g, Qt::AnchorRight);
 
-    QVERIFY(l->hasConflicts() == false);
     QCOMPARE(l->count(), 7);
 
     QGraphicsWidget p;
@@ -1017,8 +1001,6 @@ void tst_QGraphicsAnchorLayout::setSpacing()
     QCOMPARE(b->geometry(), QRectF(24, 0, 20, 20));
     QCOMPARE(c->geometry(), QRectF(0, 20, 44, 20));
 
-    QVERIFY(l->hasConflicts() == false);
-
     delete p;
     delete view;
 }
@@ -1103,7 +1085,6 @@ void tst_QGraphicsAnchorLayout::hardComplexS60()
     QSizeF layoutMaximumSize = l->effectiveSizeHint(Qt::MaximumSize);
     QCOMPARE(layoutMaximumSize, QSizeF(240, 40));
 
-    QVERIFY(l->hasConflicts() == false);
     delete p;
 }
 
@@ -1166,7 +1147,6 @@ void tst_QGraphicsAnchorLayout::delete_anchor()
     QGraphicsWidget *p = new QGraphicsWidget;
     p->setLayout(l);
 
-    QVERIFY(l->hasConflicts() == false);
     QCOMPARE(l->count(), 3);
 
     scene.addItem(p);
@@ -1281,6 +1261,12 @@ void tst_QGraphicsAnchorLayout::sizePolicy()
     delete view;
 }
 
+/*!
+    \internal
+
+    Uses private API. (We have decided to pull hasConflicts() out of the API). However, it also
+    tests some tight conditions (almost-in-conflict) that we really want to test.
+*/
 void tst_QGraphicsAnchorLayout::conflicts()
 {
     QGraphicsWidget *a = createItem(QSizeF(80,10), QSizeF(90,10), QSizeF(100,10), "a");
@@ -1311,13 +1297,13 @@ void tst_QGraphicsAnchorLayout::conflicts()
 
     p->setLayout(l);
 
-    QCOMPARE(l->hasConflicts(), true);
+    QCOMPARE(layoutHasConflict(l), true);
 
     a->setMinimumSize(QSizeF(29,10));
-    QCOMPARE(l->hasConflicts(), false);
+    QCOMPARE(layoutHasConflict(l), false);
 
     a->setMinimumSize(QSizeF(30,10));
-    QCOMPARE(l->hasConflicts(), false);
+    QCOMPARE(layoutHasConflict(l), false);
 
     delete p;
 }
diff --git a/tests/auto/qgraphicsanchorlayout1/tst_qgraphicsanchorlayout1.cpp b/tests/auto/qgraphicsanchorlayout1/tst_qgraphicsanchorlayout1.cpp
index a6746db..a521b78 100644
--- a/tests/auto/qgraphicsanchorlayout1/tst_qgraphicsanchorlayout1.cpp
+++ b/tests/auto/qgraphicsanchorlayout1/tst_qgraphicsanchorlayout1.cpp
@@ -43,7 +43,8 @@
 #include <QtTest/QtTest>
 #include <QTest>
 #include <QMetaType>
-#include <QGraphicsAnchorLayout>
+#include <QtGui/qgraphicsanchorlayout.h>
+#include <private/qgraphicsanchorlayout_p.h>
 
 #define TEST_COMPLEX_CASES
 
@@ -60,7 +61,7 @@ public:
 
     bool isValid()
     {
-        return !hasConflicts();
+        return !QGraphicsAnchorLayoutPrivate::get(this)->hasConflicts();
     }
 
     void setAnchor(
diff --git a/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp b/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp
index 9045acf..b6750ea 100644
--- a/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp
+++ b/tests/auto/qgraphicswidget/tst_qgraphicswidget.cpp
@@ -824,7 +824,8 @@ void tst_QGraphicsWidget::initStyleOption()
     if (underMouse) {
         view.resize(300, 300);
         view.show();
-        QTest::qWait(125);
+        QTest::qWaitForWindowShown(&view);
+        QTest::qWait(20);
         sendMouseMove(view.viewport(), view.mapFromScene(widget->mapToScene(widget->boundingRect().center())));
     }
 
@@ -877,7 +878,7 @@ void tst_QGraphicsWidget::layout()
     }
     widget.setLayout(layout);
 
-    QTest::qWait(250);
+    QTest::qWait(25);
 
     QCOMPARE(widget.layout(), static_cast<QGraphicsLayout*>(layout));
     for (int i = 0; i < children.count(); ++i) {
@@ -917,13 +918,13 @@ void tst_QGraphicsWidget::layoutDirection()
     widget.setLayoutDirection(layoutDirection);
     QCOMPARE(widget.testAttribute(Qt::WA_SetLayoutDirection), true);
     view->show();
-    QTest::qWait(100);
+    QTest::qWaitForWindowShown(view);
     for (int i = 0; i < children.count(); ++i) {
         QCOMPARE(children[i]->layoutDirection(), layoutDirection);
         QCOMPARE(children[i]->testAttribute(Qt::WA_SetLayoutDirection), false);
         view->repaint();
-        QTest::qWait(200);
-        QCOMPARE(children[i]->m_painterLayoutDirection, layoutDirection);
+        QApplication::processEvents();
+        QTRY_COMPARE(children[i]->m_painterLayoutDirection, layoutDirection);
     }
     delete view;
 }
@@ -1156,8 +1157,8 @@ void tst_QGraphicsWidget::setTabOrder()
     if (!children.isEmpty()) {
         QGraphicsWidget *first = children.first();
         view.viewport()->setFocus();
-        QTest::qWait(250);
-        QVERIFY(view.viewport()->hasFocus());
+        QApplication::processEvents();
+        QTRY_VERIFY(view.viewport()->hasFocus());
         first->setFocus();
         QVERIFY(first->hasFocus());
         QVERIFY(scene.hasFocus());
@@ -1198,11 +1199,8 @@ void tst_QGraphicsWidget::setTabOrderAndReparent()
     QGraphicsScene scene;
     QGraphicsView view(&scene);
     view.show();
-#ifdef Q_WS_X11
-    qt_x11_wait_for_window_manager(&view);
-#endif
     QApplication::setActiveWindow(&view);
-    QTest::qWait(25);
+    QTest::qWaitForWindowShown(&view);
     QTRY_COMPARE(QApplication::activeWindow(), &view);
 
     int i;
@@ -1341,11 +1339,8 @@ void tst_QGraphicsWidget::verifyFocusChain()
     QGraphicsScene scene;
     QGraphicsView view(&scene);
     view.show();
-#ifdef Q_WS_X11
-    qt_x11_wait_for_window_manager(&view);
-#endif
     QApplication::setActiveWindow(&view);
-    QTest::qWait(25);
+    QTest::qWaitForWindowShown(&view);
     QTRY_COMPARE(QApplication::activeWindow(), &view);
 
     {
@@ -1419,39 +1414,38 @@ void tst_QGraphicsWidget::verifyFocusChain()
         w1_2->setFocusPolicy(Qt::StrongFocus);
         scene.addItem(w1_2);
         window->show();
-#ifdef Q_WS_X11
-        qt_x11_wait_for_window_manager(window);
-#endif
+        QApplication::setActiveWindow(window);
+        QTest::qWaitForWindowShown(window);
 
         lineEdit->setFocus();
-        QTest::qWait(250);
-        QVERIFY(lineEdit->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(lineEdit->hasFocus());
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
-        QTest::qWait(250);
-        QVERIFY(w1_1->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(w1_1->hasFocus());
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
-        QTest::qWait(250);
-        QVERIFY(w1_2->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(w1_2->hasFocus());
 
         // remove the tabFocusFirst and insert new item
         delete w1_1;            // calls _q_removeItemLater
-        QTest::qWait(250);
+        QTest::qWait(25);
         SubQGraphicsWidget *w1_3 = new SubQGraphicsWidget;
         w1_3->setFocusPolicy(Qt::StrongFocus);
         w1_3->setData(0, "w1_3");
         w1_3->setGeometry(50,0,25, 25);
         scene.addItem(w1_3);
-        QVERIFY(w1_2->hasFocus());
+        QTRY_VERIFY(w1_2->hasFocus());
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
-        QTest::qWait(250);
-        QVERIFY(lineEdit->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(lineEdit->hasFocus());
         // tabFocusFirst should now point to w1_2
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
-        QTest::qWait(250);
-        QVERIFY(w1_2->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(w1_2->hasFocus());
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
-        QTest::qWait(250);
-        QVERIFY(w1_3->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(w1_3->hasFocus());
         scene.removeItem(w1_2);   // does not call _q_removeItemLater
         delete w1_2;            // calls _q_removeItemLater
 
@@ -1460,18 +1454,18 @@ void tst_QGraphicsWidget::verifyFocusChain()
         w1_4->setData(0, "w1_4");
         w1_4->setGeometry(75,0,25, 25);
         scene.addItem(w1_4);
-        QVERIFY(w1_3->hasFocus());
-        QTest::qWait(250);
+        QTRY_VERIFY(w1_3->hasFocus());
+        QTest::qWait(25);
         QVERIFY(compareFocusChain(view, QList<QGraphicsItem*>() << w1_3 << w1_4));
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Backtab);
-        QTest::qWait(250);
-        QVERIFY(lineEdit->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(lineEdit->hasFocus());
         // tabFocusFirst should now point to w1_3
         QTest::keyPress(QApplication::focusWidget(), Qt::Key_Tab);
-        QTest::qWait(250);
-        QVERIFY(w1_3->hasFocus());
-        QTest::qWait(250);
-        QVERIFY(compareFocusChain(view, QList<QGraphicsItem*>() << w1_3 << w1_4));
+        QTest::qWait(25);
+        QTRY_VERIFY(w1_3->hasFocus());
+        QTest::qWait(25);
+        QTRY_VERIFY(compareFocusChain(view, QList<QGraphicsItem*>() << w1_3 << w1_4));
         delete window;
     }
 }
@@ -2353,9 +2347,7 @@ void tst_QGraphicsWidget::painterStateProtectionOnWindowFrame()
     QGraphicsView view(&scene);
     scene.addItem(widget);
     view.show();
-#ifdef Q_WS_X11
-    qt_x11_wait_for_window_manager(&view);
-#endif
+    QTest::qWaitForWindowShown(&view);
     QTest::qWait(500);
 }
 
@@ -2561,14 +2553,11 @@ void tst_QGraphicsWidget::ensureClipping()
     QGraphicsView view(&scene);
     view.setOptimizationFlag(QGraphicsView::IndirectPainting);
     view.show();
-#ifdef Q_WS_X11
-    qt_x11_wait_for_window_manager(&view);
-#endif
-    QTest::qWait(250);
+    QTest::qWaitForWindowShown(&view);
 
     QList<QGraphicsItem *> expected;
     expected << clipWidget << childWidget << childitem;
-    QVERIFY(scene.drawnItems.contains(clipWidget));
+    QTRY_VERIFY(scene.drawnItems.contains(clipWidget));
     QVERIFY(scene.drawnItems.contains(childWidget));
     QVERIFY(scene.drawnItems.contains(childitem));
 }
@@ -2630,11 +2619,12 @@ void tst_QGraphicsWidget::respectHFW()
 
     view->show();
     window->setGeometry(0, 0, 70, 70);
+    QTest::qWaitForWindowShown(view);
 
     {   // here we go - simulate a interactive resize of the window
-        QTest::qWait(200);
+        QTest::qWait(100);
         QTest::mouseMove(view, view->mapFromScene(71, 71)); // bottom right corner
-        QTest::qWait(200);
+        QTest::qWait(100);
 
         QTest::mousePress(view->viewport(), Qt::LeftButton, 0, view->mapFromScene(71, 71), 200);
         view->grabMouse();
@@ -2648,7 +2638,7 @@ void tst_QGraphicsWidget::respectHFW()
         QApplication::sendEvent(view->viewport(), &e);
         view->releaseMouse();
     }
-    QTest::qWait(200);
+    QTest::qWait(100);
     const QSizeF winSize = window->size();
     qreal minHFW = window->effectiveSizeHint(Qt::MinimumSize, QSizeF(winSize.width(), -1)).height();
     QVERIFY(qAbs(minHFW - winSize.height()) < 1);
diff --git a/tests/auto/qmainwindow/tst_qmainwindow.cpp b/tests/auto/qmainwindow/tst_qmainwindow.cpp
index 38d23b6..9615c63 100644
--- a/tests/auto/qmainwindow/tst_qmainwindow.cpp
+++ b/tests/auto/qmainwindow/tst_qmainwindow.cpp
@@ -1297,18 +1297,27 @@ void tst_QMainWindow::createPopupMenu()
         mainwindow.addDockWidget(Qt::LeftDockWidgetArea, &dockwidget3);
         mainwindow.addDockWidget(Qt::LeftDockWidgetArea, &dockwidget4);
 
+
+#ifdef QT_SOFTKEYS_ENABLED
+        // Softkeys add extra "Select" and "Back" actions to menu by default.
+        // Two first actions will be Select and Back when softkeys are enabled
+        int numSoftkeyActions = 2;
+#else
+        int numSoftkeyActions = 0;
+#endif
+
         QMenu *menu = mainwindow.createPopupMenu();
         QVERIFY(menu != 0);
         QList<QAction *> actions = menu->actions();
-        QCOMPARE(actions.size(), 7);
+        QCOMPARE(actions.size(), 7 + numSoftkeyActions);
 
-        QCOMPARE(actions.at(0), dockwidget1.toggleViewAction());
-        QCOMPARE(actions.at(1), dockwidget2.toggleViewAction());
-        QCOMPARE(actions.at(2), dockwidget3.toggleViewAction());
-        QCOMPARE(actions.at(3), dockwidget4.toggleViewAction());
-        QVERIFY(actions.at(4)->isSeparator());
-        QCOMPARE(actions.at(5), toolbar1.toggleViewAction());
-        QCOMPARE(actions.at(6), toolbar2.toggleViewAction());
+        QCOMPARE(actions.at(0 + numSoftkeyActions), dockwidget1.toggleViewAction());
+        QCOMPARE(actions.at(1 + numSoftkeyActions), dockwidget2.toggleViewAction());
+        QCOMPARE(actions.at(2 + numSoftkeyActions), dockwidget3.toggleViewAction());
+        QCOMPARE(actions.at(3 + numSoftkeyActions), dockwidget4.toggleViewAction());
+        QVERIFY(actions.at(4 + numSoftkeyActions)->isSeparator());
+        QCOMPARE(actions.at(5 + numSoftkeyActions), toolbar1.toggleViewAction());
+        QCOMPARE(actions.at(6 + numSoftkeyActions), toolbar2.toggleViewAction());
 
         delete menu;
 
@@ -1319,12 +1328,12 @@ void tst_QMainWindow::createPopupMenu()
         menu = mainwindow.createPopupMenu();
         QVERIFY(menu != 0);
         actions = menu->actions();
-        QCOMPARE(actions.size(), 4);
+        QCOMPARE(actions.size(), 4 + numSoftkeyActions);
 
-        QCOMPARE(actions.at(0), dockwidget2.toggleViewAction());
-        QCOMPARE(actions.at(1), dockwidget3.toggleViewAction());
-        QVERIFY(actions.at(2)->isSeparator());
-        QCOMPARE(actions.at(3), toolbar2.toggleViewAction());
+        QCOMPARE(actions.at(0 + numSoftkeyActions), dockwidget2.toggleViewAction());
+        QCOMPARE(actions.at(1 + numSoftkeyActions), dockwidget3.toggleViewAction());
+        QVERIFY(actions.at(2 + numSoftkeyActions)->isSeparator());
+        QCOMPARE(actions.at(3 + numSoftkeyActions), toolbar2.toggleViewAction());
 
         delete menu;
     }
diff --git a/tests/auto/qmenu/tst_qmenu.cpp b/tests/auto/qmenu/tst_qmenu.cpp
index e467229..726ca55 100644
--- a/tests/auto/qmenu/tst_qmenu.cpp
+++ b/tests/auto/qmenu/tst_qmenu.cpp
@@ -260,9 +260,17 @@ void tst_QMenu::onStatusMessageChanged(const QString &s)
 void
 tst_QMenu::addActionsAndClear()
 {
-    QCOMPARE(menus[0]->actions().count(), 0);
+#ifdef QT_SOFTKEYS_ENABLED
+    // Softkeys add extra "Select" and "Back" actions to menu by default.
+    // Two first actions will be Select and Back when softkeys are enabled
+    int numSoftkeyActions = 2;
+#else
+    int numSoftkeyActions = 0;
+#endif
+
+    QCOMPARE(menus[0]->actions().count(), 0 + numSoftkeyActions);
     createActions();
-    QCOMPARE(menus[0]->actions().count(), 8);
+    QCOMPARE(menus[0]->actions().count(), 8 + numSoftkeyActions);
     menus[0]->clear();
     QCOMPARE(menus[0]->actions().count(), 0);
 }
diff --git a/tests/auto/qparallelanimationgroup/tst_qparallelanimationgroup.cpp b/tests/auto/qparallelanimationgroup/tst_qparallelanimationgroup.cpp
index a129f7f..acd23b0 100644
--- a/tests/auto/qparallelanimationgroup/tst_qparallelanimationgroup.cpp
+++ b/tests/auto/qparallelanimationgroup/tst_qparallelanimationgroup.cpp
@@ -379,6 +379,10 @@ void tst_QParallelAnimationGroup::updateChildrenWithRunningGroup()
 
 void tst_QParallelAnimationGroup::deleteChildrenWithRunningGroup()
 {
+#if defined(Q_OS_SYMBIAN)
+    // give the Symbian app start event queue time to clear
+    QTest::qWait(1000);
+#endif
     // test if children can be activated when their group is stopped
     QParallelAnimationGroup group;
 
diff --git a/tests/auto/qprogressbar/tst_qprogressbar.cpp b/tests/auto/qprogressbar/tst_qprogressbar.cpp
index d86094d..bc4583e 100644
--- a/tests/auto/qprogressbar/tst_qprogressbar.cpp
+++ b/tests/auto/qprogressbar/tst_qprogressbar.cpp
@@ -175,7 +175,7 @@ void tst_QProgressBar::format()
     bar.repainted = false;
     bar.setFormat("%v of %m (%p%)");
     QTest::qWait(20);
-    QVERIFY(bar.repainted);
+    QTRY_VERIFY(bar.repainted);
     bar.repainted = false;
     bar.setFormat("%v of %m (%p%)");
     qApp->processEvents();
diff --git a/tests/auto/qstatemachine/tst_qstatemachine.cpp b/tests/auto/qstatemachine/tst_qstatemachine.cpp
index 7244d72..37b34bf 100644
--- a/tests/auto/qstatemachine/tst_qstatemachine.cpp
+++ b/tests/auto/qstatemachine/tst_qstatemachine.cpp
@@ -176,6 +176,7 @@ private slots:
     void twoAnimatedTransitions();
     void playAnimationTwice();
     void nestedTargetStateForAnimation();
+    void polishedSignalTransitionsReuseAnimationGroup();
     void animatedGlobalRestoreProperty();
     void specificTargetValueOfAnimation();
 
@@ -3115,6 +3116,38 @@ void tst_QStateMachine::nestedTargetStateForAnimation()
     QCOMPARE(counter.counter, 2);
 }
 
+void tst_QStateMachine::polishedSignalTransitionsReuseAnimationGroup()
+{
+    QStateMachine machine;
+    QObject *object = new QObject(&machine);
+    object->setProperty("foo", 0);
+
+    QState *s1 = new QState(&machine);
+    s1->assignProperty(object, "foo", 123);
+    QState *s2 = new QState(&machine);
+    s2->assignProperty(object, "foo", 456);
+    QState *s3 = new QState(&machine);
+    s3->assignProperty(object, "foo", 789);
+    QFinalState *s4 = new QFinalState(&machine);
+
+    QParallelAnimationGroup animationGroup;
+    animationGroup.addAnimation(new QPropertyAnimation(object, "foo"));
+    QSignalSpy animationFinishedSpy(&animationGroup, SIGNAL(finished()));
+    s1->addTransition(s1, SIGNAL(polished()), s2)->addAnimation(&animationGroup);
+    s2->addTransition(s2, SIGNAL(polished()), s3)->addAnimation(&animationGroup);
+    s3->addTransition(s3, SIGNAL(polished()), s4);
+
+    machine.setInitialState(s1);
+    QSignalSpy machineFinishedSpy(&machine, SIGNAL(finished()));
+    machine.start();
+    QTRY_COMPARE(machineFinishedSpy.count(), 1);
+    QCOMPARE(machine.configuration().size(), 1);
+    QVERIFY(machine.configuration().contains(s4));
+    QCOMPARE(object->property("foo").toInt(), 789);
+
+    QCOMPARE(animationFinishedSpy.count(), 2);
+}
+
 void tst_QStateMachine::animatedGlobalRestoreProperty()
 {
     QStateMachine machine;
diff --git a/util/webkit/mkdist-webkit b/util/webkit/mkdist-webkit
index 74a4f65..b1efe91 100755
--- a/util/webkit/mkdist-webkit
+++ b/util/webkit/mkdist-webkit
@@ -5,7 +5,7 @@ die() {
     exit 1
 }
 
-default_tag="qtwebkit-4.6-snapshot-24092009"
+default_tag="qtwebkit-4.6-snapshot-29092009-2"
 
 if [ $# -eq 0 ]; then
     tag="$default_tag"