Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-29072009 ( 07fbaeddfade72be1d0d7e7f2b947e5d3c183f4a )

Changes in WebKit since the last update:

++ b/WebKit/qt/ChangeLog
2009-07-28  Simon Hausmann  <simon.hausmann@nokia.com>

        Rubber-stamped by Ariya Hidayat.

        Fix compilation with the precompiled header.

        * WebKit_pch.h: Don't include JSDOMBinding.h and MathObject.h,
        as they include AtomicString.h. AtomicString.cpp needs to enable
        a #define before including AtomicString.h, which breaks if the PCH
        forces the inclusion beforehand.

2009-07-28  Ariya Hidayat  <ariya.hidayat@nokia.com>

        Reviewed by Simon Hausmann.

        Added tests to ensure that scroll position can be changed
        programmatically, even when the scroll bar policy is set to off.

        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Simon Hausmann.

        Fix a few compilation warnings in the QWebFrame tests.

        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-28  Andre Pedralho  <andre.pedralho@openbossa.org>

         Reviewed by Simon Hausmann.

         Fixed tst_QWebFrame::hasSetFocus test which was using
         an undefined resource.
         https://bugs.webkit.org/show_bug.cgi?id=27512

         * tests/qwebframe/tst_qwebframe.cpp:

2009-07-28  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Make it possible to pass relative file names to QtLauncher.

        * QtLauncher/main.cpp:
        (MainWindow::MainWindow):

2009-07-27  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=27735
        Give a helpful name to JSLock constructor argument

        * Api/qwebframe.cpp:
        (QWebFrame::addToJavaScriptWindowObject):

2009-07-27  Volker Hilsheimer <volker.hilsheimer@nokia.com>

        Reviewed by Simon Hausmann.

        QWebView's "enabled" parameter should default to true, as with QGraphicsView and
        QPainter.

        * Api/qwebview.cpp: Add reference to QPainter::renderHints().
        * Api/qwebview.h: Add default for enabled argument.

2009-07-26  Kavindra Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        More documentation cleanups in the QWebElement class overview.

        * Api/qwebelement.cpp:

2009-07-26  Kavindra Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        Clean up documentation of QWebElement's findFirst and findAll functions,
        as well as their QWebFrame counterparts.

        * Api/qwebelement.cpp:
        * Api/qwebframe.cpp:

2009-07-26  Kavindra Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        Various documentation cleanups

        * Fixed qdoc warnings
        * Hide QWebNetworkInterface from the class overview
        * Mention QWebElement in the module overview
        * More cleanups

        * Api/qwebframe.cpp:
        * Api/qwebnetworkinterface.cpp:
        * Api/qwebview.cpp:
        * docs/qtwebkit.qdoc:

2009-07-26  Kavindra Palaraja  <kavindra.palaraja@nokia.com>

        Reviewed by Simon Hausmann.

        Added missing class diagram referenced from the docs, taken from the Qt
        documentation.

        * docs/qtwebkit.qdocconf: Register the image directory with
        qdoc.
        * docs/qwebview-diagram.png: Added.

2009-07-24  Antonio Gomes   <antonio.gomes@openbossa.org>

        Reviewed by Adam Treat.

        As per discussion on IRC, changed originalUrl by requestedUrl.

        * Api/qwebframe.cpp:
        (QWebFrame::requestedUrl):
        * Api/qwebframe.h:
        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-24  Andre Pedralho  <andre.pedralho@openbossa.org>

        Reviewed by Adam Treat.

        Removed void QWebFrame::renderContents(...) and added the Q_PROPERTY
        clipRenderToViewport to control whether QWebFrame::render would call
        FrameView::paintContents rather than FrameView::paint and do not clip
        the frame content to viewport.

        * Api/qwebframe.cpp:
        (QWebFramePrivate::renderPrivate):
        (QWebFrame::clipRenderToViewport):
        (QWebFrame::setClipRenderToViewport):
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        (QWebFramePrivate::QWebFramePrivate):
        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-24  Antonio Gomes   <antonio.gomes@openbossa.org>

        Reviewed by Simon Hausmann.

        [QT] Implement originalUrl getter method to the API
        https://bugs.webkit.org/show_bug.cgi?id=25867

        * Api/qwebframe.cpp:
        (QWebFrame::originalUrl):
        * Api/qwebframe.h:
        * tests/qwebframe/qwebframe.qrc:
        * tests/qwebframe/test1.html: Added.
        * tests/qwebframe/test2.html: Added.
        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-24  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Build fix for Qt.

        Fix build issue introduced in 46344
        ([Bug 22700] ApplicationCache should have size limit)

        Remove method only added to the Qt ChromeClient.

        * WebCoreSupport/ChromeClientQt.h:

2009-07-24  Andrei Popescu  <andreip@google.com>

        Reviewed by Anders Carlsson.

        ApplicationCache should have size limit
        https://bugs.webkit.org/show_bug.cgi?id=22700

        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::reachedMaxAppCacheSize):
        Adds empty implementation of the reachedMaxAppCacheSize callback.
        * WebCoreSupport/ChromeClientQt.h:

2009-07-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Simon Hausmann.

        [Qt] Add simple proxy support for QtLauncher
        https://bugs.webkit.org/show_bug.cgi?id=27495

        Picks up proxy settings from the http_proxy environment
        variable.

        * QtLauncher/QtLauncher.pro: Add QtNetwork dependency for all
        platforms.
        * QtLauncher/main.cpp:
        (MainWindow::MainWindow):

2009-07-23  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Holger Freyther.

        Added a testcase to verify that cached methods in the QOBject bindings
        remain alife even after garbage collection.

        * tests/qwebpage/tst_qwebpage.cpp:
        (tst_QWebPage::protectBindingsRuntimeObjectsFromCollector):

2009-07-23  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>

        Reviewed by Simon Hausmann.

        Fixing two issues related to QtLauncher
          - MainWindow objects are not always freed after close
          - JavaScript window.close() sometimes crashes
        https://bugs.webkit.org/show_bug.cgi?id=27601

        * QtLauncher/main.cpp:
        (MainWindow::MainWindow):
        (main):

2009-07-21  Volker Hilsheimer <volker.hilsheimer@nokia.com>

        Reviewed by Simon Hausmann.

        Various improvements to the API documentation.

        * Updated link to W3c Database spec
        * Formatting fixes, cleanups
        * Add missing \since 4.6 tags to QWebPage::frameAt
        * Extend QWebDatabase and QWebSecurityOrigin docs.

        * Api/qwebdatabase.cpp:
        * Api/qwebpage.cpp:
        * Api/qwebsecurityorigin.cpp:
        * Api/qwebview.cpp:

2009-07-21  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Rubber-stamped by Simon Hausmann.

        Remove preliminary-tag from QWebElement

        * Api/qwebelement.cpp:

2009-07-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>

        Reviewed by Eric Seidel.

        Fix Qt code to follow the WebKit Coding Style.

        * Api/qcookiejar.cpp:
        (QCookieJar::setCookieJar):
        (QCookieJar::cookieJar):
        * Api/qcookiejar.h:
        * Api/qwebdatabase.cpp:
        (QWebDatabase::QWebDatabase):
        (QWebDatabase::removeDatabase):
        * Api/qwebdatabase.h:
        * Api/qwebdatabase_p.h:
        * Api/qwebelement.h:
        * Api/qwebframe.cpp:
        (QWebFrame::title):
        (QWebFrame::print):
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        * Api/qwebhistory.cpp:
        (QWebHistory::clear):
        * Api/qwebhistory.h:
        * Api/qwebhistory_p.h:
        * Api/qwebhistoryinterface.cpp:
        (gCleanupInterface):
        (QWebHistoryInterface::setDefaultInterface):
        (QWebHistoryInterface::defaultInterface):
        (QWebHistoryInterface::QWebHistoryInterface):
        * Api/qwebhistoryinterface.h:
        * Api/qwebnetworkinterface.cpp:
        (QWebNetworkManager::started):
        (QWebNetworkManager::finished):
        (QWebNetworkInterfacePrivate::parseDataUrl):
        (QWebNetworkInterface::addJob):
        (WebCoreHttp::onResponseHeaderReceived):
        (WebCoreHttp::onReadyRead):
        * Api/qwebnetworkinterface.h:
        * Api/qwebnetworkinterface_p.h:
        * Api/qwebpage.cpp:
        (QWebPagePrivate::editorCommandForWebActions):
        (QWebPagePrivate::createContextMenu):
        (QWebPagePrivate::focusInEvent):
        (QWebPage::fixedContentsSize):
        (QWebPage::setContentEditable):
        (QWebPage::swallowContextMenuEvent):
        (QWebPage::findText):
        * Api/qwebpage.h:
        * Api/qwebpage_p.h:
        * Api/qwebpluginfactory.h:
        * Api/qwebsecurityorigin.h:
        * Api/qwebsecurityorigin_p.h:
        * Api/qwebsettings.cpp:
        (QWebSettingsPrivate::QWebSettingsPrivate):
        (QWebSettingsPrivate::apply):
        (QWebSettings::globalSettings):
        (QWebSettings::QWebSettings):
        (QWebSettings::fontSize):
        (QWebSettings::setUserStyleSheetUrl):
        (QWebSettings::setDefaultTextEncoding):
        (QWebSettings::setIconDatabasePath):
        (QWebSettings::iconDatabasePath):
        (QWebSettings::iconForUrl):
        (QWebSettings::setWebGraphic):
        (QWebSettings::setFontFamily):
        (QWebSettings::fontFamily):
        (QWebSettings::testAttribute):
        (qt_websettings_setLocalStorageDatabasePath):
        * Api/qwebsettings.h:
        * Api/qwebview.cpp:
        (QWebView::setPage):
        (QWebView::event):
        * Api/qwebview.h:

2009-07-20  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Simon Hausmann.

        [Qt] Add test for loading webpages...

        Performance test for loading webpages. Wait for the loadFinished
        signal to be fired. This should include a non empty layout.

        * tests/benchmarks/loading/tst_loading.cpp: Added.
        (waitForSignal):
        (tst_Loading::init):
        (tst_Loading::cleanup):
        (tst_Loading::load_data):
        (tst_Loading::load):
        * tests/benchmarks/loading/tst_loading.pro: Added.
        * tests/tests.pro:

2009-07-20  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Simon Hausmann.

        [Qt] Add a test case for drawing a simple viewrect to a QPixmap

        * tests/benchmarks/painting/tst_painting.cpp: Added.
        (waitForSignal):
        (tst_Painting::init):
        (tst_Painting::cleanup):
        (tst_Painting::paint_data):
        (tst_Painting::paint):
        * tests/benchmarks/painting/tst_painting.pro: Added.
        * tests/tests.pro:

2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Holger Freyther.

        [Qt] Add an option for QtLauncher to build without QtUiTools dependency
        https://bugs.webkit.org/show_bug.cgi?id=27438

        Based on Norbert Leser's work.

        * QtLauncher/main.cpp:
        (WebPage::createPlugin):

2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>

        Reviewed by Adam Treat.

        Coding style fixes.

        * Api/qcookiejar.cpp:
        (QCookieJarPrivate::QCookieJarPrivate):
        (qHash):
        (QCookieJar::cookieJar):
        * Api/qwebelement.cpp:
        (QWebElement::functions):
        (QWebElement::scriptableProperties):
        * Api/qwebframe.cpp:
        (QWebFrame::metaData):
        (QWebFrame::scrollBarValue):
        (QWebFrame::scroll):
        (QWebFrame::scrollPosition):
        (QWebFrame::print):
        * Api/qwebnetworkinterface.cpp:
        (decodePercentEncoding):
        (QWebNetworkRequestPrivate::init):
        (QWebNetworkRequestPrivate::setURL):
        (QWebNetworkRequest::QWebNetworkRequest):
        (QWebNetworkRequest::operator=):
        (QWebNetworkRequest::setUrl):
        (QWebNetworkRequest::setHttpHeader):
        (QWebNetworkRequest::httpHeaderField):
        (QWebNetworkRequest::setHttpHeaderField):
        (QWebNetworkRequest::setPostData):
        (QWebNetworkJob::setResponse):
        (QWebNetworkJob::frame):
        (QWebNetworkManager::add):
        (QWebNetworkManager::cancel):
        (QWebNetworkManager::started):
        (QWebNetworkManager::data):
        (QWebNetworkManager::finished):
        (QWebNetworkManager::addHttpJob):
        (QWebNetworkManager::cancelHttpJob):
        (QWebNetworkManager::httpConnectionClosed):
        (QWebNetworkInterfacePrivate::sendFileData):
        (QWebNetworkInterfacePrivate::parseDataUrl):
        (QWebNetworkManager::doWork):
        (QWebNetworkInterface::setDefaultInterface):
        (QWebNetworkInterface::defaultInterface):
        (QWebNetworkInterface::QWebNetworkInterface):
        (QWebNetworkInterface::addJob):
        (QWebNetworkInterface::cancelJob):
        (WebCoreHttp::WebCoreHttp):
        (WebCoreHttp::request):
        (WebCoreHttp::scheduleNextRequest):
        (WebCoreHttp::getConnection):
        (WebCoreHttp::onResponseHeaderReceived):
        (WebCoreHttp::onReadyRead):
        (WebCoreHttp::onRequestFinished):
        (WebCoreHttp::onAuthenticationRequired):
        (WebCoreHttp::onProxyAuthenticationRequired):
        * Api/qwebpage.cpp:
        (QWebPagePrivate::QWebPagePrivate):
        (QWebPagePrivate::mouseReleaseEvent):
        (QWebPagePrivate::inputMethodEvent):
        (QWebPagePrivate::shortcutOverrideEvent):
        (QWebPage::inputMethodQuery):
        (QWebPage::javaScriptPrompt):
        (QWebPage::updatePositionDependentActions):
        (QWebPage::userAgentForUrl):
        (QWebPagePrivate::_q_onLoadProgressChanged):
        (QWebPage::totalBytes):
        (QWebPage::bytesReceived):
        * Api/qwebsettings.cpp:
        (QWebSettings::iconForUrl):
        (QWebSettings::setObjectCacheCapacities):
        * Api/qwebview.cpp:
        (QWebView::paintEvent):
        (QWebView::changeEvent):

2009-07-17  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>

        Reviewed by Simon Hausmann.

        Overwrite the plugin directories for the DRT.
        Part of https://bugs.webkit.org/show_bug.cgi?id=27215

        * Api/qwebpage.cpp:
        (qt_drt_overwritePluginDirectories): Only set the plugin directories
        to the ones in the QTWEBKIT_PLUGIN_PATH environment variable.

2009-07-16  Xiaomei Ji  <xji@chromium.org>

        Reviewed by Dan Bernstein.

        This is the 2nd part of fixing "RTL: tooltip does not get its directionlity from its element's."
        https://bugs.webkit.org/show_bug.cgi?id=24187

        Add one extra parameter to the callee of HitTestResult::title() due to the signature change.

        * Api/qwebframe.cpp:
        (QWebHitTestResultPrivate::QWebHitTestResultPrivate): Add direction as a parameter to the callee of HitTestResult::title().
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::mouseDidMoveOverElement): Add direction as a parameter to the callee of HitTestResult::title().

2009-07-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Adam Treat.

        Add new action to qwebpage to reload without cache.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::updateAction):
        (QWebPagePrivate::updateNavigationActions):
        (QWebPage::triggerAction):
        * Api/qwebpage.h:

2009-07-16  Xiaomei Ji  <xji@chromium.org>

        Reviewed by Darin Adler.

        Fix tooltip does not get its directionality from its element's directionality.
        https://bugs.webkit.org/show_bug.cgi?id=24187

        Per mitz's suggestion in comment #6, while getting the plain-text
        title, we also get the directionality of the title. How to handle
        the directionality is up to clients. Clients could ignore it,
        or use attribute or unicode control characters to display the title
        as what they want.

        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::setToolTip): Add directionality as 2nd parameter to setToopTip() (without handling it yet).
        * WebCoreSupport/ChromeClientQt.h: Add directionality as 2nd parameter to setToolTip().

2009-07-15  Yael Aharon  <yael.aharon@nokia.com>

        Reviewed by Simon Hausmann.

        https://bugs.webkit.org/show_bug.cgi?id=27285

        When the user clicks a link with a target attribute, the newly created window should be visible.
        Make new windows created in Qtlauncher visible.

        * QtLauncher/main.cpp:
        (WebPage::createWindow):

2009-07-14  Adam Treat  <adam.treat@torchmobile.com>

        Reviewed by Zack Rusin.

        https://bugs.webkit.org/show_bug.cgi?id=26983

        The default constructed values for QSize and WebCore::IntSize are different.  The former
        produces an invalid size whereas the latter produces a size of zero.  This was causing
        a layout to be triggered when constructing a view and an assert to be hit.  This patch fixes
        the crash by taking care not to cause an unnecessary layout triggered by ScrollView::setFixedLayoutSize.

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):

26 files changed, 377 insertions, 80 deletions

diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.h b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
index 8f4852f..a836606 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-    class ClassNamesData : Noncopyable {
+    class ClassNamesData : public Noncopyable {
     public:
         ClassNamesData(const String& string, bool shouldFoldCase)
             : m_string(string), m_shouldFoldCase(shouldFoldCase), m_createdVector(false)
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 3ee00ad..228cfde 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -335,6 +335,9 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_hasOpenDatabases(false)
 #endif
     , m_usingGeolocation(false)
+#if ENABLE(WML)
+    , m_containsWMLContent(false)
+#endif
 {
     m_document.resetSkippingRef(this);
 
@@ -361,11 +364,14 @@ Document::Document(Frame* frame, bool isXHTML)
     m_inDocument = true;
     m_inStyleRecalc = false;
     m_closeAfterStyleRecalc = false;
+
     m_usesDescendantRules = false;
     m_usesSiblingRules = false;
     m_usesFirstLineRules = false;
     m_usesFirstLetterRules = false;
     m_usesBeforeAfterRules = false;
+    m_usesRemUnits = false;
+
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
  
     m_styleSelector = 0;
@@ -1132,6 +1138,11 @@ void Document::styleRecalcTimerFired(Timer<Document>*)
     updateStyleIfNeeded();
 }
 
+bool Document::childNeedsAndNotInStyleRecalc()
+{
+    return childNeedsStyleRecalc() && !m_inStyleRecalc;
+}
+
 void Document::recalcStyle(StyleChange change)
 {
     // we should not enter style recalc while painting
@@ -1678,13 +1689,14 @@ void Document::implicitClose()
     }
 
 #if PLATFORM(MAC)
-    if (f && renderObject && this == topDocument() && AXObjectCache::accessibilityEnabled())
+    if (f && renderObject && this == topDocument() && AXObjectCache::accessibilityEnabled()) {
         // The AX cache may have been cleared at this point, but we need to make sure it contains an
         // AX object to send the notification to. getOrCreate will make sure that an valid AX object
         // exists in the cache (we ignore the return value because we don't need it here). This is 
         // only safe to call when a layout is not in progress, so it can not be used in postNotification.    
         axObjectCache()->getOrCreate(renderObject);
         axObjectCache()->postNotification(renderObject, "AXLoadComplete", true);
+    }
 #endif
 
 #if ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 82f0455..6655d9b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -377,6 +377,8 @@ public:
     void setUsesFirstLetterRules(bool b) { m_usesFirstLetterRules = b; }
     bool usesBeforeAfterRules() const { return m_usesBeforeAfterRules; }
     void setUsesBeforeAfterRules(bool b) { m_usesBeforeAfterRules = b; }
+    bool usesRemUnits() const { return m_usesRemUnits; }
+    void setUsesRemUnits(bool b) { m_usesRemUnits = b; }
 
     // Machinery for saving and restoring state when you leave and then go back to a page.
     void registerFormElementWithState(Element* e) { m_formElementsWithState.add(e); }
@@ -404,6 +406,7 @@ public:
     PassRefPtr<EditingText> createEditingTextNode(const String&);
 
     virtual void recalcStyle(StyleChange = NoChange);
+    bool childNeedsAndNotInStyleRecalc();
     virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
@@ -795,6 +798,8 @@ public:
 protected:
     Document(Frame*, bool isXHTML);
 
+    void setStyleSelector(CSSStyleSelector* styleSelector) {  m_styleSelector = styleSelector; }
+
 private:
     virtual void refScriptExecutionContext() { ref(); }
     virtual void derefScriptExecutionContext() { deref(); }
@@ -903,6 +908,7 @@ private:
     bool m_usesFirstLineRules;
     bool m_usesFirstLetterRules;
     bool m_usesBeforeAfterRules;
+    bool m_usesRemUnits;
     bool m_gotoAnchorNeededAfterStylesheetsLoad;
     bool m_isDNSPrefetchEnabled;
     bool m_haveExplicitlyDisabledDNSPrefetch;
@@ -1029,6 +1035,9 @@ public:
     bool usingGeolocation() const { return m_usingGeolocation; };
 
 #if ENABLE(WML)
+    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
+    bool containsWMLContent() const { return m_containsWMLContent; }
+
     void resetWMLPageState();
     void initializeWMLPageState();
 #endif
@@ -1111,6 +1120,10 @@ private:
 #endif
     
     bool m_usingGeolocation;
+
+#if ENABLE(WML)
+    bool m_containsWMLContent;
+#endif
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 0e6c245..1956be4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -33,7 +33,6 @@
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "Document.h"
-#include "Editor.h"
 #include "ElementRareData.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
@@ -45,9 +44,7 @@
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
-#include "PlatformString.h"
-#include "RenderBlock.h"
-#include "SelectionController.h"
+#include "RenderView.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
 
@@ -382,8 +379,10 @@ int Element::clientWidth()
     bool inCompatMode = document()->inCompatMode();
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
-        if (FrameView* view = document()->view())
-            return adjustForAbsoluteZoom(view->layoutWidth(), document()->renderer());
+        if (FrameView* view = document()->view()) {
+            if (RenderView* renderView = document()->renderView())
+                return adjustForAbsoluteZoom(view->layoutWidth(), renderView);
+        }
     }
     
     if (RenderBox* rend = renderBox())
@@ -401,8 +400,10 @@ int Element::clientHeight()
 
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
-        if (FrameView* view = document()->view())
-            return adjustForAbsoluteZoom(view->layoutHeight(), document()->renderer());
+        if (FrameView* view = document()->view()) {
+            if (RenderView* renderView = document()->renderView())
+                return adjustForAbsoluteZoom(view->layoutHeight(), renderView);
+        }
     }
     
     if (RenderBox* rend = renderBox())
@@ -590,6 +591,12 @@ PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const
 
 void Element::attributeChanged(Attribute* attr, bool)
 {
+    recalcStyleIfNeededAfterAttributeChanged(attr);
+    updateAfterAttributeChanged(attr);
+}
+
+void Element::updateAfterAttributeChanged(Attribute* attr)
+{
     if (!document()->axObjectCache()->accessibilityEnabled())
         return;
 
@@ -602,7 +609,13 @@ void Element::attributeChanged(Attribute* attr, bool)
         document()->axObjectCache()->handleAriaRoleChanged(renderer());
     }
 }
-
+    
+void Element::recalcStyleIfNeededAfterAttributeChanged(Attribute* attr)
+{
+    if (document()->attached() && document()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
+        setNeedsStyleRecalc();
+}
+        
 void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 {
     document()->incDOMTreeVersion();
@@ -854,7 +867,11 @@ void Element::recalcStyle(StyleChange change)
              setRenderStyle(newStyle);
 
         if (change != Force) {
-            if ((document()->usesDescendantRules() || hasPositionalRules) && styleChangeType() >= FullStyleChange)
+            // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
+            // all the way down the tree.  This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
+            if (document()->usesRemUnits() && ch != NoChange && currentStyle && newStyle && currentStyle->fontSize() != newStyle->fontSize() && document()->documentElement() == this)
+                change = Force;
+            else if ((document()->usesDescendantRules() || hasPositionalRules) && styleChangeType() >= FullStyleChange)
                 change = Force;
             else
                 change = ch;
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index b0bbeb3..0ff2ed1 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -136,6 +136,11 @@ public:
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
+    // The implementation of Element::attributeChanged() calls the following two functions.
+    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
+    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
+    void updateAfterAttributeChanged(Attribute*);
+
     // not part of the DOM
     void setAttributeMap(PassRefPtr<NamedNodeMap>);
 
@@ -207,6 +212,8 @@ public:
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
     virtual bool isTextFormControl() const { return false; }
+    virtual bool isOptionalFormControl() const { return false; }
+    virtual bool isRequiredFormControl() const { return false; }
 
     virtual bool formControlValueMatchesRenderer() const { return false; }
     virtual void setFormControlValueMatchesRenderer(bool) { }
diff --git a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.cpp b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.cpp
new file mode 100644
index 0000000..2627d01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "ErrorEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+
+ErrorEvent::ErrorEvent()
+{
+}
+
+ErrorEvent::ErrorEvent(const String& message, const String& fileName, unsigned lineNumber)
+    : Event(eventNames().errorEvent, false, true)
+    , m_message(message)
+    , m_fileName(fileName)
+    , m_lineNumber(lineNumber)
+{
+}
+
+ErrorEvent::~ErrorEvent()
+{
+}
+
+void ErrorEvent::initErrorEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& message, const String& fileName, unsigned lineNumber)
+{
+    if (dispatched())
+        return;
+        
+    initEvent(type, canBubble, cancelable);
+    
+    m_message = message;
+    m_fileName = fileName;
+    m_lineNumber = lineNumber;
+}
+
+bool ErrorEvent::isErrorEvent() const 
+{
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.h b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.h
new file mode 100644
index 0000000..f81530a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ErrorEvent_h
+#define ErrorEvent_h
+
+#if ENABLE(WORKERS)
+
+#include "Event.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class ErrorEvent : public Event {
+    public:
+        static PassRefPtr<ErrorEvent> create()
+        {
+            return adoptRef(new ErrorEvent);
+        }
+        static PassRefPtr<ErrorEvent> create(const String& message, const String& fileName, unsigned lineNumber)
+        {
+            return adoptRef(new ErrorEvent(message, fileName, lineNumber));
+        }
+        virtual ~ErrorEvent();
+
+        void initErrorEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& message, const String& fileName, unsigned lineNumber);
+
+        const String& message() const { return m_message; }
+        const String& filename() const { return m_fileName; }
+        unsigned lineno() const { return m_lineNumber; }
+
+        virtual bool isErrorEvent() const;
+
+    private:    
+        ErrorEvent();
+        ErrorEvent(const String& message, const String& fileName, unsigned lineNumber);
+
+        String m_message;
+        String m_fileName;
+        unsigned m_lineNumber;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // ErrorEvent_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
new file mode 100644
index 0000000..6125e1e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ErrorEvent.idl
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+
+    interface [
+        Conditional=WORKERS,
+        GenerateConstructor,
+        NoStaticTables
+    ] ErrorEvent : Event {
+
+        readonly attribute DOMString message;
+        readonly attribute DOMString filename;
+        readonly attribute unsigned long lineno;
+
+        void initErrorEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString messageArg, in DOMString filenameArg, in unsigned long linenoArg);
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index b4b87ed..9d1d079 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -158,6 +158,13 @@ bool Event::isStorageEvent() const
 }
 #endif
 
+#if ENABLE(WORKERS)
+bool Event::isErrorEvent() const
+{
+    return false;
+}
+#endif
+    
 bool Event::storesResultAsString() const
 {
     return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index 6984215..823ff20 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -119,7 +119,10 @@ namespace WebCore {
 #if ENABLE(DOM_STORAGE)
         virtual bool isStorageEvent() const;
 #endif
-
+#if ENABLE(WORKERS)
+        virtual bool isErrorEvent() const;
+#endif
+        
         bool propagationStopped() const { return m_propagationStopped; }
 
         bool defaultPrevented() const { return m_defaultPrevented; }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index dbc41b2..d288c8d 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -21,6 +21,7 @@
 #ifndef EventListener_h
 #define EventListener_h
 
+#include "PlatformString.h"
 #include <wtf/RefCounted.h>
 
 namespace JSC {
@@ -35,6 +36,8 @@ namespace WebCore {
     public:
         virtual ~EventListener() { }
         virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
+        // Return true to indicate that the error is handled.
+        virtual bool reportError(const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index 437f5ba..42668e3 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -89,7 +89,7 @@ Worker* EventTarget::toWorker()
     return 0;
 }
 
-WorkerContext* EventTarget::toWorkerContext()
+DedicatedWorkerContext* EventTarget::toDedicatedWorkerContext()
 {
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 73a32e3..f0c794f 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
     class AbstractWorker;
     class AtomicString;
+    class DedicatedWorkerContext;
     class DOMApplicationCache;
     class DOMWindow;
     class Event;
@@ -48,7 +49,6 @@ namespace WebCore {
     class ScriptExecutionContext;
     class SharedWorker;
     class Worker;
-    class WorkerContext;
     class XMLHttpRequest;
     class XMLHttpRequestUpload;
 
@@ -69,7 +69,7 @@ namespace WebCore {
 #endif
 #if ENABLE(WORKERS)
         virtual Worker* toWorker();
-        virtual WorkerContext* toWorkerContext();
+        virtual DedicatedWorkerContext* toDedicatedWorkerContext();
 #endif
 
 #if ENABLE(SHARED_WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
index 108d17e..b25cd5c 100644
--- a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -116,6 +116,8 @@ void InputElement::updateSelectionRange(InputElement* inputElement, Element* ele
     if (!inputElement->isTextField())
         return;
 
+    element->document()->updateLayoutIgnorePendingStylesheets();
+
     if (RenderTextControl* renderer = toRenderTextControl(element->renderer()))
         renderer->setSelectionRange(start, end);
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
index 3841020..93b224b 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -48,7 +48,7 @@ namespace WebCore {
 
     // MessagePortChannel is a platform-independent interface to the remote side of a message channel.
     // It acts as a wrapper around the platform-dependent PlatformMessagePortChannel implementation which ensures that the platform-dependent close() method is invoked before destruction.
-    class MessagePortChannel : Noncopyable {
+    class MessagePortChannel : public Noncopyable {
     public:
         static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
 
@@ -95,6 +95,8 @@ namespace WebCore {
 
         ~MessagePortChannel();
 
+        PlatformMessagePortChannel* channel() const { return m_channel.get(); }
+
     private:
         MessagePortChannel(PassRefPtr<PlatformMessagePortChannel>);
         RefPtr<PlatformMessagePortChannel> m_channel;
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index 57f73ec..b434ec9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -70,7 +70,7 @@ public:
     // For creating offset positions:
     Position(PassRefPtr<Node> anchorNode, int offset, AnchorType);
 
-    AnchorType anchorType() const { return m_anchorType; }
+    AnchorType anchorType() const { return static_cast<AnchorType>(m_anchorType); }
 
     void clear() { m_anchorNode.clear(); m_offset = 0; m_anchorType = PositionIsOffsetInAnchor; m_isLegacyEditingPosition = false; }
 
@@ -172,7 +172,7 @@ private:
     // returns true, then other places in editing will treat m_offset == 0 as "before the anchor"
     // and m_offset > 0 as "after the anchor node".  See rangeCompliantEquivalent for more info.
     int m_offset;
-    AnchorType m_anchorType : 2;
+    unsigned m_anchorType : 2;
     bool m_isLegacyEditingPosition : 1;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 879bf62..806bf92 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -123,7 +123,7 @@ void ProcessingInstruction::checkStyleSheet()
         bool isCSS = type.isEmpty() || type == "text/css";
 #if ENABLE(XSLT)
         m_isXSL = (type == "text/xml" || type == "text/xsl" || type == "application/xml" ||
-                   type == "application/xhtml+xml" || type == "application/rss+xml" || type == "application/atom=xml");
+                   type == "application/xhtml+xml" || type == "application/rss+xml" || type == "application/atom+xml");
         if (!isCSS && !m_isXSL)
 #else
         if (!isCSS)
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index e7fd8a2..edee305 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -90,6 +90,7 @@ PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, PassRefPtr<N
 
 PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, const Position& start, const Position& end)
 {
+    // FIXME: we shouldn't be using deprecatedEditingOffset here
     return adoptRef(new Range(ownerDocument, start.node(), start.deprecatedEditingOffset(), end.node(), end.deprecatedEditingOffset()));
 }
 
@@ -294,7 +295,7 @@ bool Range::isPointInRange(Node* refNode, int offset, ExceptionCode& ec)
         && compareBoundaryPoints(refNode, offset, m_end.container(), m_end.offset()) <= 0;
 }
 
-short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec)
+short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec) const
 {
     // http://developer.mozilla.org/en/docs/DOM:range.comparePoint
     // This method returns -1, 0 or 1 depending on if the point described by the 
@@ -332,7 +333,7 @@ short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec)
     return 0;
 }
 
-Range::CompareResults Range::compareNode(Node* refNode, ExceptionCode& ec)
+Range::CompareResults Range::compareNode(Node* refNode, ExceptionCode& ec) const
 {
     // http://developer.mozilla.org/en/docs/DOM:range.compareNode
     // This method returns 0, 1, 2, or 3 based on if the node is before, after,
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 115f442..1487a7c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -59,10 +59,10 @@ public:
     void setStart(PassRefPtr<Node> container, int offset, ExceptionCode&);
     void setEnd(PassRefPtr<Node> container, int offset, ExceptionCode&);
     void collapse(bool toStart, ExceptionCode&);
-    bool isPointInRange(Node* refNode, int offset, ExceptionCode& ec);
-    short comparePoint(Node* refNode, int offset, ExceptionCode& ec);
+    bool isPointInRange(Node* refNode, int offset, ExceptionCode&);
+    short comparePoint(Node* refNode, int offset, ExceptionCode&) const;
     enum CompareResults { NODE_BEFORE, NODE_AFTER, NODE_BEFORE_AND_AFTER, NODE_INSIDE };
-    CompareResults compareNode(Node* refNode, ExceptionCode&);
+    CompareResults compareNode(Node* refNode, ExceptionCode&) const;
     enum CompareHow { START_TO_START, START_TO_END, END_TO_END, END_TO_START };
     short compareBoundaryPoints(CompareHow, const Range* sourceRange, ExceptionCode&) const;
     static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB);
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index 7552c56..45f3bd8 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -47,10 +47,17 @@
 #include "WMLSelectElement.h"
 #endif
 
-#if PLATFORM(MAC)
+// Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
+// (PLATFORM(MAC) is always false in Chromium, hence the extra test.)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
+#define SPACE_OR_RETURN_POP_MENU 0
+#elif PLATFORM(GTK)
+#define ARROW_KEYS_POP_MENU 0
+#define SPACE_OR_RETURN_POP_MENU 1
 #else
 #define ARROW_KEYS_POP_MENU 0
+#define SPACE_OR_RETURN_POP_MENU 0
 #endif
 
 using std::min;
@@ -509,6 +516,29 @@ void SelectElement::reset(SelectElementData& data, Element* element)
 
     element->setNeedsStyleRecalc();
 }
+    
+#if !ARROW_KEYS_POP_MENU
+enum SkipDirection {
+    SkipBackwards = -1,
+    SkipForwards = 1
+};
+
+// Returns the index of the next valid list item |skip| items past |listIndex| in direction |direction|.
+static int nextValidIndex(const Vector<Element*>& listItems, int listIndex, SkipDirection direction, int skip)
+{
+    int lastGoodIndex = listIndex;
+    int size = listItems.size();
+    for (listIndex += direction; listIndex >= 0 && listIndex < size; listIndex += direction) {
+        --skip;
+        if (!listItems[listIndex]->disabled() && isOptionElement(listItems[listIndex])) {
+            lastGoodIndex = listIndex;
+            if (skip <= 0)
+                break;
+        }
+    }
+    return lastGoodIndex;
+}
+#endif
 
 void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
@@ -535,24 +565,30 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
         }
 #else
         const Vector<Element*>& listItems = data.listItems(element);
-        int size = listItems.size();
 
         int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
         if (keyIdentifier == "Down" || keyIdentifier == "Right") {
-            for (listIndex += 1;
-                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
-                 ++listIndex) { }
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            listIndex = nextValidIndex(listItems, listIndex, SkipForwards, 1);
             handled = true;
         } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
-            for (listIndex -= 1;
-                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
-                 --listIndex) { }
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            listIndex = nextValidIndex(listItems, listIndex, SkipBackwards, 1);
+            handled = true;
+        } else if (keyIdentifier == "PageDown") {
+            listIndex = nextValidIndex(listItems, listIndex, SkipForwards, 3);
+            handled = true;
+        } else if (keyIdentifier == "PageUp") {
+            listIndex = nextValidIndex(listItems, listIndex, SkipBackwards, 3);
+            handled = true;
+        } else if (keyIdentifier == "Home") {
+            listIndex = nextValidIndex(listItems, -1, SkipForwards, 1);
+            handled = true;
+        } else if (keyIdentifier == "End") {
+            listIndex = nextValidIndex(listItems, listItems.size(), SkipBackwards, 1);
             handled = true;
         }
+        
+        if (handled && listIndex >= 0 && listIndex < listItems.size())
+            setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
 #endif
         if (handled)
             event->setDefaultHandled();
@@ -567,7 +603,17 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
         int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
         bool handled = false;
 
-#if ARROW_KEYS_POP_MENU
+#if SPACE_OR_RETURN_POP_MENU
+        if (keyCode == ' ' || keyCode == '\r') {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        }
+#elif ARROW_KEYS_POP_MENU
         if (keyCode == ' ') {
             element->focus();
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index c22ecf9..456cc52 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -194,8 +194,8 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
     if (needToParse)
         parseMappedAttribute(mappedAttr);
 
-    if (entry == eNone && ownerDocument()->attached() && ownerDocument()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
-        setNeedsStyleRecalc();
+    if (entry == eNone)
+        recalcStyleIfNeededAfterAttributeChanged(attr);
 
     if (checkDecl && mappedAttr->decl()) {
         // Add the decl to the table in the appropriate spot.
@@ -206,7 +206,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
         if (namedAttrMap)
             mappedAttributes()->declAdded();
     }
-    Element::attributeChanged(attr, preserveDecls);
+    updateAfterAttributeChanged(attr);
 }
 
 bool StyledElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index 04e499a..bbd926b 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -260,6 +260,19 @@ RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
 
 void Text::attach()
 {
+#if ENABLE(WML)
+    if (document()->isWMLDocument() && !containsOnlyWhitespace()) {
+        String text = m_data;
+        ASSERT(!text.isEmpty());
+
+        text = substituteVariableReferences(text, document());
+
+        ExceptionCode code = 0;
+        setData(text, code);
+        ASSERT(!code);
+    }
+#endif
+
     createRendererIfNeeded();
     CharacterData::attach();
 }
@@ -319,29 +332,6 @@ PassRefPtr<Text> Text::createWithLengthLimit(Document* doc, const String& text,
     return new Text(doc, nodeText);
 }
 
-#if ENABLE(WML)
-void Text::insertedIntoDocument()
-{
-    CharacterData::insertedIntoDocument();
-
-    if (!parentNode()->isWMLElement() || !length())
-        return;
-
-    WMLPageState* pageState = wmlPageStateForDocument(document());
-    if (!pageState->hasVariables())
-        return;
-
-    String text = data();
-    if (!text.impl() || text.impl()->containsOnlyWhitespace())
-        return;
-
-    text = substituteVariableReferences(text, document());
-
-    ExceptionCode ec;
-    setData(text, ec);
-}
-#endif
-
 #ifndef NDEBUG
 void Text::formatForDebugger(char *buffer, unsigned length) const
 {
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.h b/src/3rdparty/webkit/WebCore/dom/Text.h
index 5e711d0..e5a6e69 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.h
+++ b/src/3rdparty/webkit/WebCore/dom/Text.h
@@ -59,10 +59,6 @@ public:
 
     static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned maxChars = cTextNodeLengthLimit);
 
-#if ENABLE(WML)
-    virtual void insertedIntoDocument();
-#endif
-
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 95f63e9..4387a66 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -72,7 +72,7 @@ using namespace std;
 
 namespace WebCore {
 
-class PendingCallbacks : Noncopyable {
+class PendingCallbacks : public Noncopyable {
 public:
     ~PendingCallbacks()
     {
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
index a3c1188..c29b796 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
     class DocLoader;
 
-    class XMLTokenizerScope : Noncopyable {
+    class XMLTokenizerScope : public Noncopyable {
     public:
         XMLTokenizerScope(DocLoader* docLoader);
         ~XMLTokenizerScope();
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index 12f0ec7..e6d59a0 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -875,22 +875,23 @@ sub printWrapperFunctions
         }
 
         # Hack for the media tags
+        # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
         if ($tags{$tagName}{"wrapperOnlyIfMediaIsAvailable"}) {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
 {
     if (!MediaPlayer::isAvailable())
-        return CREATE_DOM_NODE_WRAPPER(exec, $parameters{'namespace'}Element, element.get());
-    return CREATE_DOM_NODE_WRAPPER(exec, ${JSInterfaceName}, element.get());
+        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
 
 END
 ;
         } else {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
 {
-    return CREATE_DOM_NODE_WRAPPER(exec, ${JSInterfaceName}, element.get());
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
 
 END
@@ -931,7 +932,7 @@ namespace WebCore {
 
 using namespace $parameters{'namespace'}Names;
 
-typedef JSNode* (*Create$parameters{'namespace'}ElementWrapperFunction)(ExecState*, PassRefPtr<$parameters{'namespace'}Element>);
+typedef JSNode* (*Create$parameters{'namespace'}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
 
 END
 ;
@@ -939,7 +940,7 @@ END
     printWrapperFunctions($F);
 
     print F <<END
-JSNode* createJS$parameters{'namespace'}Wrapper(ExecState* exec, PassRefPtr<$parameters{'namespace'}Element> element)
+JSNode* createJS$parameters{'namespace'}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
 {   
     typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{'namespace'}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
@@ -969,8 +970,8 @@ END
     }
     Create$parameters{'namespace'}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
-        return createWrapperFunction(exec, element);
-    return CREATE_DOM_NODE_WRAPPER(exec, $parameters{'namespace'}Element, element.get());
+        return createWrapperFunction(exec, globalObject, element);
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
 }
 
 }
@@ -1006,9 +1007,10 @@ namespace JSC {
 namespace WebCore {
 
     class JSNode;
+    class JSDOMGlobalObject;
     class $parameters{'namespace'}Element;
 
-    JSNode* createJS$parameters{'namespace'}Wrapper(JSC::ExecState*, PassRefPtr<$parameters{'namespace'}Element>);
+    JSNode* createJS$parameters{'namespace'}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
 
 }