Updated WebKit from /home/joce/dev/qtwebkit/ to qtwebkit-4.6-snapshot-29092009-2 ( 999c28aa9f6ad9e0d6a26a794220e1cb45408a97 )

Changes in WebKit/qt since the last update:

++ b/WebKit/qt/ChangeLog
2009-09-28  HJK

        Reviewed by Simon Hausmann.

        Compile fix with namespaced Qt.

        * Api/qwebinspector_p.h:

2009-09-27  Joe Ligman  <joseph.ligman@mindspring.com>

        Reviewed by Simon Hausmann.

        [Qt] Adding API setFocus and hasFocus to QWebElement. This API is needed for
        clients that want to check/set the focus node of the document.
        https://bugs.webkit.org/show_bug.cgi?id=29682

        * Api/qwebelement.cpp:
        (QWebElement::hasFocus):
        (QWebElement::setFocus):
        * Api/qwebelement.h:
        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::hasSetFocus):

2009-09-25  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>

        Reviewed by Simon Hausmann.

        [Qt] Make tst_qwebframe work if Qt built without SSL support
        https://bugs.webkit.org/show_bug.cgi?id=29735

        * tests/qwebframe/tst_qwebframe.cpp: Missing #ifndef blocks added.

2009-09-24  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Update QWebElement API to remove script related methods.
        QWebElement::evaluateScript is the only one kept, these are
        removed to postpone most of the QtWebKit<->JavaScript API design
        after 4.6.
        https://bugs.webkit.org/show_bug.cgi?id=29708

        * Api/qwebelement.cpp:
        * Api/qwebelement.h:
        Methods removed:
        - QWebElement::callFunction
        - QWebElement::functions
        - QWebElement::scriptableProperty
        - QWebElement::setScriptableProperty
        - QWebElement::scriptableProperties
        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::evaluateScript):

2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Rename QWebElement::evaluateScript
        to QWebElement::evaluateJavaScript.
        https://bugs.webkit.org/show_bug.cgi?id=29709

        * Api/qwebelement.cpp:
        (QWebElement::evaluateJavaScript):
        * Api/qwebelement.h:
        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::evaluateJavaScript):

2009-09-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Update the stypeProperty API of QWebElement.
        https://bugs.webkit.org/show_bug.cgi?id=29711

        * Api/qwebelement.cpp:
        (QWebElement::styleProperty):
        - Merge the stypeProperty and the computedStyleProperty methods
        - Remove the default value for the style resolving enum
        - Rename ResolveRule to StyleResolveStrategy
        (QWebElement::setStyleProperty):
        - Remove the priority argument since it is possible to control the
          behaviour by adding !important or removing in the value.
        * Api/qwebelement.h:
        * tests/qwebelement/tst_qwebelement.cpp:
        (tst_QWebElement::style):
        (tst_QWebElement::computedStyle):
        * tests/qwebframe/tst_qwebframe.cpp:

2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>

        Reviewed by Alice Liu.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        Pass 0 for new Page constructor argument.

19 files changed, 196 insertions, 145 deletions

diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index 29f4be1..c01f34a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 5422bf0..174c0ee 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -1941,7 +1941,8 @@ CSSStyleSheet* Document::pageUserSheet()
         return 0;
     
     // Parse the sheet and cache it.
-    m_pageUserSheet = CSSStyleSheet::create(this);
+    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet->setIsUserStyleSheet(true);
     m_pageUserSheet->parseString(userSheetText, !inCompatMode());
     return m_pageUserSheet.get();
 }
@@ -1973,7 +1974,8 @@ const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
         const UserStyleSheetVector* sheets = it->second;
         for (unsigned i = 0; i < sheets->size(); ++i) {
             const UserStyleSheet* sheet = sheets->at(i).get();
-            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this));
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            parsedSheet->setIsUserStyleSheet(true);
             parsedSheet->parseString(sheet->source(), !inCompatMode());
             if (!m_pageGroupUserSheets)
                 m_pageGroupUserSheets.set(new Vector<RefPtr<CSSStyleSheet> >);
@@ -3011,7 +3013,7 @@ String Document::domain() const
     return securityOrigin()->domain();
 }
 
-void Document::setDomain(const String& newDomain)
+void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
@@ -3034,19 +3036,25 @@ void Document::setDomain(const String& newDomain)
     int oldLength = domain().length();
     int newLength = newDomain.length();
     // e.g. newDomain = webkit.org (10) and domain() = www.webkit.org (14)
-    if (newLength >= oldLength)
+    if (newLength >= oldLength) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     String test = domain();
     // Check that it's a subdomain, not e.g. "ebkit.org"
-    if (test[oldLength - newLength - 1] != '.')
+    if (test[oldLength - newLength - 1] != '.') {
+        ec = SECURITY_ERR;
         return;
+    }
 
     // Now test is "webkit.org" from domain()
     // and we check that it's the same thing as newDomain
     test.remove(0, oldLength - newLength);
-    if (test != newDomain)
+    if (test != newDomain) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     securityOrigin()->setDomainFromDOM(newDomain);
     if (m_frame)
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 454304b..2805562 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -672,7 +672,7 @@ public:
     String referrer() const;
 
     String domain() const;
-    void setDomain(const String& newDomain);
+    void setDomain(const String& newDomain, ExceptionCode&);
 
     String lastModified() const;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index 34a9771..822f860 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -155,7 +155,8 @@ module core {
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString domain;
+                 attribute [ConvertNullToNullString] DOMString domain
+                     setter raises (DOMException);
 #else
         readonly attribute DOMString domain;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index f04723f..50ff033 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -28,6 +28,8 @@
 
 #include "AXObjectCache.h"
 #include "Attr.h"
+#include "CSSParser.h"
+#include "CSSSelectorList.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
 #include "ClientRect.h"
@@ -280,42 +282,6 @@ static int adjustForLocalZoom(int value, RenderObject* renderer)
     return static_cast<int>(value / zoomFactor);
 }
 
-static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
-{
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return value;
-    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
-    if (zoomFactor > 1)
-        value++;
-    return static_cast<int>(value / zoomFactor);
-}
-
-static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
-{
-    // The result here is in floats, so we don't need the truncation hack from the integer version above.
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return point;
-    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
-}
-
-static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
-{
-    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
-    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
-    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
-    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
-}
-
-static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
-{
-    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
-    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
-    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
-    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
-}
-
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -1406,6 +1372,39 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
+{
+    if (selector.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    bool strictParsing = !document()->inCompatMode();
+    CSSParser p(strictParsing);
+
+    CSSSelectorList selectorList;
+    p.parseSelector(selector, document(), selectorList);
+
+    if (!selectorList.first()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
+    if (selectorList.selectorsNeedNamespaceResolution()) {
+        ec = NAMESPACE_ERR;
+        return false;
+    }
+
+    CSSStyleSelector::SelectorChecker selectorChecker(document(), strictParsing);
+    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (selectorChecker.checkSelector(selector, this))
+            return true;
+    }
+
+    return false;
+}
+
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index 4ecf932..d27976a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -231,6 +231,8 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index cbb36d9..d90f819 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -111,6 +111,10 @@ module core {
             raises(DOMException);
 
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // WebKit extension, pending specification.
+        boolean webkitMatchesSelector(in DOMString selectors)
+            raises(DOMException);
+
         // ElementTraversal API
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 4499328..2d612e1 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -202,6 +202,7 @@ namespace WebCore {
 
         d->eventListenerMap.clear();
     }
+#endif
 
     inline bool EventTarget::isFiringEventListeners()
     {
@@ -227,8 +228,6 @@ namespace WebCore {
         return d->eventListenerMap.contains(eventType);
     }
 
-#endif
-
 } // namespace WebCore
 
 #endif // EventTarget_h
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index 96e31f4..c29cb1c 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -56,8 +56,6 @@ void InputElement::dispatchFocusEvent(InputElement* inputElement, Element* eleme
     if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(inputElement, element);
-
     Document* document = element->document();
     if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
@@ -73,29 +71,12 @@ void InputElement::dispatchBlurEvent(InputElement* inputElement, Element* elemen
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(inputElement, element);
-
     if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
 
     frame->textFieldDidEndEditing(element);
 }
 
-bool InputElement::placeholderShouldBeVisible(const InputElement* inputElement, const Element* element)
-{
-    return inputElement->value().isEmpty()
-        && element->document()->focusedNode() != element
-        && !inputElement->placeholder().isEmpty();
-}
-
-void InputElement::updatePlaceholderVisibility(InputElement* inputElement, Element* element, bool placeholderValueChanged)
-{
-    ASSERT(inputElement->isTextField());
-    bool placeholderVisible = inputElement->placeholderShouldBeVisible();
-    if (element->renderer())
-        toRenderTextControlSingleLine(element->renderer())->updatePlaceholderVisibility(placeholderVisible, placeholderValueChanged);
-}
-
 void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
 {
     ASSERT(inputElement->isTextField());
@@ -138,10 +119,7 @@ void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
     // Renderer and our event handler are responsible for sanitizing values.
-    ASSERT(value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
-
-    if (inputElement->isTextField())
-        updatePlaceholderVisibility(inputElement, element);
+    ASSERT_UNUSED(inputElement, value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
index 746e4f2..e0e7110 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -44,16 +44,12 @@ public:
     virtual bool isSearchField() const = 0;
     virtual bool isTextField() const = 0;
 
-    virtual bool placeholderShouldBeVisible() const = 0;
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
     virtual String value() const = 0;
     virtual void setValue(const String&) = 0;
 
-    virtual String placeholder() const = 0;
-    virtual void setPlaceholder(const String&) = 0;
-
     virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
 
@@ -66,8 +62,6 @@ public:
 protected:
     static void dispatchFocusEvent(InputElement*, Element*);
     static void dispatchBlurEvent(InputElement*, Element*);
-    static bool placeholderShouldBeVisible(const InputElement*, const Element*);
-    static void updatePlaceholderVisibility(InputElement*, Element*, bool placeholderValueChanged = false);
     static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
     static void updateSelectionRange(InputElement*, Element*, int start, int end);
     static void aboutToUnload(InputElement*, Element*);
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index fe631c8..d4ec598 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -178,10 +178,8 @@ Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreA
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && 
-            m_attributes[i]->name().localName() == name)
-                return m_attributes[i].get();
-
+        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
+            return m_attributes[i].get();
         if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
             return m_attributes[i].get();
     }
@@ -206,10 +204,12 @@ void NamedNodeMap::clearAttributes()
 
 void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedNodeMap w/o an element in case someone still has a reference
-    // to if after the element gets deleted - but the map is now invalid
+    // This can't happen if the holder of the map is JavaScript, because we mark the
+    // element if the map is alive. So it has no impact on web page behavior. Because
+    // of that, we can simply clear all the attributes to avoid accessing stale
+    // pointers to do things like create Attr objects.
     m_element = 0;
-    detachAttributesFromElement();
+    clearAttributes();
 }
 
 void NamedNodeMap::setAttributes(const NamedNodeMap& other)
@@ -251,7 +251,7 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
         attr->m_element = m_element;
 
     // Notify the element that the attribute has been added, and dispatch appropriate mutation events
-    // Note that element may be null here if we are called from insertAttr() during parsing
+    // Note that element may be null here if we are called from insertAttribute() during parsing
     if (m_element) {
         m_element->attributeChanged(attribute.get());
         // Because of our updateStyleAttribute() style modification events are never sent at the right time, so don't bother sending them.
@@ -265,12 +265,13 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
-    unsigned index = len + 1;
-    for (unsigned i = 0; i < len; ++i)
+    unsigned index = len;
+    for (unsigned i = 0; i < len; ++i) {
         if (m_attributes[i]->name().matches(name)) {
             index = i;
             break;
         }
+    }
 
     if (index >= len)
         return;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 4fb96de..759900b 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -94,11 +94,11 @@ public:
     void addAttribute(PassRefPtr<Attribute>);
     void removeAttribute(const QualifiedName&);
 
+    Element* element() const { return m_element; }
+
 protected:
     virtual void clearAttributes();
 
-    Element* element() const { return m_element; }
-
 private:
     void detachAttributesFromElement();
     void detachFromElement();
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
index 3310ded..8166853 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 2240dd8..c899f3d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -1626,52 +1626,6 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return ClassNodeList::create(this, classNames, result.first->second.get());
 }
 
-template <typename Functor>
-static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
-{
-    ASSERT(selector);
-
-    do {
-        if (functor(selector))
-            return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
-        }
-    } while ((selector = selector->tagHistory()));
-
-    return false;
-}
-
-template <typename Functor>
-static bool forEachSelector(Functor& functor, const CSSSelectorList& selectorList)
-{
-    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
-        if (forEachTagSelector(functor, selector))
-            return true;
-    }
-
-    return false;
-}
-
-class SelectorNeedsNamespaceResolutionFunctor {
-public:
-    bool operator()(CSSSelector* selector)
-    {
-        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
-            return true;
-        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
-            return true;
-        return false;
-    }
-};
-
-static bool selectorNeedsNamespaceResolution(const CSSSelectorList& selectorList)
-{
-    SelectorNeedsNamespaceResolutionFunctor functor;
-    return forEachSelector(functor, selectorList);
-}
-
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1690,7 +1644,7 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
     }
 
     // throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1738,7 +1692,7 @@ PassRefPtr<NodeList> Node::querySelectorAll(const String& selectors, ExceptionCo
     }
 
     // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index 0503597..122130d 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,7 +26,10 @@
 #include "RangeException.h"
 
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "DocumentFragment.h"
+#include "FrameView.h"
 #include "HTMLElement.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
@@ -1821,4 +1824,89 @@ void Range::expand(const String& unit, ExceptionCode& ec)
     setEnd(end.deepEquivalent().containerNode(), end.deepEquivalent().computeOffsetInContainerNode(), ec);
 }
 
+PassRefPtr<ClientRectList> Range::getClientRects() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Range::getBoundingClientRect() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result;
+    for (size_t i = 0; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    return ClientRect::create(result);
+}
+
+static void adjustFloatQuadsForScrollAndAbsoluteZoom(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
+{
+    FrameView* view = document->view();
+    if (!view)
+        return;
+
+    IntRect visibleContentRect = view->visibleContentRect();
+    for (size_t i = 0; i < quads.size(); ++i) {
+        quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+        adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
+    }
+}
+
+void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
+{
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+    Node* stopNode = pastLastNode();
+
+    HashSet<Node*> nodeSet;
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode())
+            nodeSet.add(node);
+    }
+
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode()) {
+            if (!nodeSet.contains(node->parentNode())) {
+                if (RenderBoxModelObject* renderBoxModelObject = static_cast<Element*>(node)->renderBoxModelObject()) {
+                    Vector<FloatQuad> elementQuads;
+                    renderBoxModelObject->absoluteQuads(elementQuads);
+                    adjustFloatQuadsForScrollAndAbsoluteZoom(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
+
+                    quads.append(elementQuads);
+                }
+            }
+        } else if (node->isTextNode()) {
+            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+                RenderText* renderText = toRenderText(renderer);
+                int startOffset = (node == startContainer) ? m_start.offset() : 0;
+                int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
+                
+                Vector<FloatQuad> textQuads;
+                renderText->absoluteQuadsForRange(textQuads, startOffset, endOffset);
+                adjustFloatQuadsForScrollAndAbsoluteZoom(textQuads, m_ownerDocument.get(), renderText);
+
+                quads.append(textQuads);
+            }
+        }
+    }
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 3382c84..e2e282b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,12 +25,15 @@
 #ifndef Range_h
 #define Range_h
 
+#include "FloatQuad.h"
 #include "RangeBoundaryPoint.h"
+#include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
+class ClientRect;
+class ClientRectList;
 class DocumentFragment;
 class NodeWithIndex;
 class Text;
@@ -117,6 +120,9 @@ public:
     // for details.
     void expand(const String&, ExceptionCode&);
 
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
@@ -135,6 +141,8 @@ private:
     enum ActionType { DELETE_CONTENTS, EXTRACT_CONTENTS, CLONE_CONTENTS };
     PassRefPtr<DocumentFragment> processContents(ActionType, ExceptionCode&);
 
+    void getBorderAndTextQuads(Vector<FloatQuad>&) const;
+
     RefPtr<Document> m_ownerDocument;
     RangeBoundaryPoint m_start;
     RangeBoundaryPoint m_end;
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 633bd90..9024e09 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -85,6 +85,13 @@ module ranges {
         void detach()
             raises(DOMException);
 
+#if defined(LANGUAGE_JAVASCRIPT) || LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API extensions
+
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
         // extensions
 
         DocumentFragment createContextualFragment(in DOMString html)
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 88d2279..c34a341 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -29,7 +29,8 @@
 
 namespace WebCore {
 
-    struct RegisteredEventListener {
+    class RegisteredEventListener {
+    public:
         RegisteredEventListener(PassRefPtr<EventListener> listener, bool useCapture)
             : listener(listener)
             , useCapture(useCapture)
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index 00db1c1..1ce074a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -315,10 +315,15 @@ PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& d
     unsigned end = start + min(charsLeft, maxChars);
     
     // Check we are not on an unbreakable boundary.
-    TextBreakIterator* it = characterBreakIterator(data.characters(), dataLength);
-    if (end < dataLength && !isTextBreak(it, end))
-        end = textBreakPreceding(it, end);
-        
+    // Some text break iterator implementations work best if the passed buffer is as small as possible, 
+    // see <https://bugs.webkit.org/show_bug.cgi?id=29092>. 
+    // We need at least two characters look-ahead to account for UTF-16 surrogates.
+    if (end < dataLength) {
+        TextBreakIterator* it = characterBreakIterator(data.characters() + start, (end + 2 > dataLength) ? dataLength - start : end - start + 2);
+        if (!isTextBreak(it, end - start))
+            end = textBreakPreceding(it, end - start) + start;
+    }
+    
     // If we have maxChars of unbreakable characters the above could lead to
     // an infinite loop.
     // FIXME: It would be better to just have the old value of end before calling