Merge commit 's60/4.6' into mmfphonon

8 files changed, 197 insertions, 93 deletions

diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index 89d862f..7a8f025 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -334,6 +334,38 @@ static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID
     setTextDecorationProperty(style, newTextDecoration.get(), propertID);
 }
 
+static bool fontWeightIsBold(CSSStyleDeclaration* style)
+{
+    ASSERT(style);
+    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
+
+    if (!fontWeight)
+        return false;
+    if (!fontWeight->isPrimitiveValue())
+        return false;
+
+    // Because b tag can only bold text, there are only two states in plain html: bold and not bold.
+    // Collapse all other values to either one of these two states for editing purposes.
+    switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValue100:
+        case CSSValue200:
+        case CSSValue300:
+        case CSSValue400:
+        case CSSValue500:
+        case CSSValueNormal:
+            return false;
+        case CSSValueBold:
+        case CSSValue600:
+        case CSSValue700:
+        case CSSValue800:
+        case CSSValue900:
+            return true;
+    }
+
+    ASSERT_NOT_REACHED(); // For CSSValueBolder and CSSValueLighter
+    return false; // Make compiler happy
+}
+
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
 {
     ASSERT(style);
@@ -345,6 +377,9 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
     diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
     diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
 
+    if (fontWeightIsBold(result.get()) == fontWeightIsBold(computedStyle))
+        result->removeProperty(CSSPropertyFontWeight);
+
     return result;
 }
 
@@ -352,7 +387,6 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
 // e.g. when a user inserts a new paragraph, all properties listed here must be copied to the new paragraph.
 // FIXME: The current editingStyleProperties contains all inheritableProperties but we may not need to preserve all inheritable properties
 static const int editingStyleProperties[] = {
-    CSSPropertyBackgroundColor,
     // CSS inheritable properties
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index 0496a8f..1617be8 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -71,7 +71,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-CompositeEditCommand::CompositeEditCommand(Document *document) 
+CompositeEditCommand::CompositeEditCommand(Document *document)
     : EditCommand(document)
 {
 }
@@ -396,7 +396,7 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
     Node* node = position.node();
     if (!node || !node->isTextNode())
         return;
-    Text* textNode = static_cast<Text*>(node);    
+    Text* textNode = static_cast<Text*>(node);
     
     if (textNode->length() == 0)
         return;
@@ -739,6 +739,129 @@ void CompositeEditCommand::pushPartiallySelectedAnchorElementsDown()
     setEndingSelection(originalSelection);
 }
 
+// Clone the paragraph between start and end under blockElement,
+// preserving the hierarchy up to outerNode. 
+
+void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement)
+{
+    // First we clone the outerNode
+    
+    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(lastNode, blockElement);
+
+    if (start.node() != outerNode) {
+        Vector<RefPtr<Node> > ancestors;
+        
+        // Insert each node from innerNode to outerNode (excluded) in a list.
+        for (Node* n = start.node(); n && n != outerNode; n = n->parentNode())
+            ancestors.append(n);
+
+        // Clone every node between start.node() and outerBlock.
+
+        for (size_t i = ancestors.size(); i != 0; --i) {
+            Node* item = ancestors[i - 1].get();
+            RefPtr<Node> child = item->cloneNode(isTableElement(item));
+            appendNode(child, static_cast<Element *>(lastNode.get()));
+            lastNode = child.release();
+        }
+    }
+
+    // Handle the case of paragraphs with more than one node,
+    // cloning all the siblings until end.node() is reached.
+    
+    if (start.node() != end.node()) {
+        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+            RefPtr<Node> clonedNode = n->cloneNode(true);
+            insertNodeAfter(clonedNode, lastNode);
+            lastNode = clonedNode.release();
+            if (n == end.node())
+                break;
+        }
+    }
+}
+
+    
+// There are bugs in deletion when it removes a fully selected table/list.
+// It expands and removes the entire table/list, but will let content
+// before and after the table/list collapse onto one line.   
+// Deleting a paragraph will leave a placeholder. Remove it (and prune
+// empty or unrendered parents).
+
+void CompositeEditCommand::cleanupAfterDeletion()
+{
+    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
+    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
+        // Note: We want the rightmost candidate.
+        Position position = caretAfterDelete.deepEquivalent().downstream();
+        Node* node = position.node();
+        // Normally deletion will leave a br as a placeholder.
+        if (node->hasTagName(brTag))
+            removeNodeAndPruneAncestors(node);
+        // If the selection to move was empty and in an empty block that 
+        // doesn't require a placeholder to prop itself open (like a bordered
+        // div or an li), remove it during the move (the list removal code
+        // expects this behavior).
+        else if (isBlock(node))
+            removeNodeAndPruneAncestors(node);
+        else if (lineBreakExistsAtPosition(position)) {
+            // There is a preserved '\n' at caretAfterDelete.
+            // We can safely assume this is a text node.
+            Text* textNode = static_cast<Text*>(node);
+            if (textNode->length() == 1)
+                removeNodeAndPruneAncestors(node);
+            else
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
+        }
+    }
+}
+    
+// This is a version of moveParagraph that preserves style by keeping the original markup
+// It is currently used only by IndentOutdentCommand but it is meant to be used in the
+// future by several other commands such as InsertList and the align commands.
+// The blockElement parameter is the element to move the paragraph to,
+// outerNode is the top element of the paragraph hierarchy. 
+
+void CompositeEditCommand::moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode)
+{
+    ASSERT(outerNode);
+    ASSERT(blockElement);
+
+    VisiblePosition beforeParagraph = startOfParagraphToMove.previous();
+    VisiblePosition afterParagraph(endOfParagraphToMove.next());
+    
+    // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
+    Position start = startOfParagraphToMove.deepEquivalent().downstream();
+    Position end = endOfParagraphToMove.deepEquivalent().upstream();
+
+    cloneParagraphUnderNewElement(start, end, outerNode, blockElement);
+      
+    setEndingSelection(VisibleSelection(start, end, DOWNSTREAM));
+    deleteSelection(false, false, false, false);
+    
+    // There are bugs in deletion when it removes a fully selected table/list.
+    // It expands and removes the entire table/list, but will let content
+    // before and after the table/list collapse onto one line.
+       
+    cleanupAfterDeletion();
+    
+    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    // foo^
+    // <div>bar</div>
+    // baz
+    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
+    // Must recononicalize these two VisiblePositions after the pruning above.
+    beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
+    afterParagraph = VisiblePosition(afterParagraph.deepEquivalent());
+
+    if (beforeParagraph.isNotNull() && !isTableElement(beforeParagraph.deepEquivalent().node()) && (!isEndOfParagraph(beforeParagraph) || beforeParagraph == afterParagraph)) {
+        // FIXME: Trim text between beforeParagraph and afterParagraph if they aren't equal.
+        insertNodeAt(createBreakElement(document()), beforeParagraph.deepEquivalent());
+    }
+}
+    
+    
 // This moves a paragraph preserving its style.
 void CompositeEditCommand::moveParagraph(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, const VisiblePosition& destination, bool preserveSelection, bool preserveStyle)
 {
@@ -784,7 +907,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     VisiblePosition afterParagraph(endOfParagraphToMove.next());
 
     // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
-    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.    
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
     Position start = startOfParagraphToMove.deepEquivalent().downstream();
     Position end = endOfParagraphToMove.deepEquivalent().upstream();
     
@@ -793,7 +916,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     Position endRangeCompliant = rangeCompliantEquivalent(end);
     RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
-    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
+    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move. It
     // shouldn't matter though, since moved paragraphs will usually be quite small.
     RefPtr<DocumentFragment> fragment = startOfParagraphToMove != endOfParagraphToMove ? createFragmentFromMarkup(document(), createMarkup(range.get(), 0, DoNotAnnotateForInterchange, true), "") : 0;
     
@@ -813,42 +936,14 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().node()->inDocument());
-    
-    // There are bugs in deletion when it removes a fully selected table/list.  
-    // It expands and removes the entire table/list, but will let content
-    // before and after the table/list collapse onto one line.
-    
-    // Deleting a paragraph will leave a placeholder.  Remove it (and prune
-    // empty or unrendered parents).
-    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
-    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
-        // Note: We want the rightmost candidate.
-        Position position = caretAfterDelete.deepEquivalent().downstream();
-        Node* node = position.node();
-        // Normally deletion will leave a br as a placeholder.
-        if (node->hasTagName(brTag))
-            removeNodeAndPruneAncestors(node);
-        // If the selection to move was empty and in an empty block that 
-        // doesn't require a placeholder to prop itself open (like a bordered 
-        // div or an li), remove it during the move (the list removal code 
-        // expects this behavior).
-        else if (isBlock(node))
-            removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
-            // There is a preserved '\n' at caretAfterDelete.
-            Text* textNode = static_cast<Text*>(node);
-            if (textNode->length() == 1)
-                removeNodeAndPruneAncestors(node);
-            else 
-                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
-        }
-    }
 
-    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    cleanupAfterDeletion();
+
+    // Add a br if pruning an empty block level element caused a collapse. For example:
     // foo^
     // <div>bar</div>
     // baz
-    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // Imagine moving 'bar' to ^. 'bar' will be deleted and its div pruned. That would
     // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
     // Must recononicalize these two VisiblePositions after the pruning above.
     beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
@@ -912,7 +1007,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
                 removeNodePreservingChildren(listNode->parentNode());
                 newBlock = createListItemElement(document());
             }
-            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph.
         } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
             newBlock = createListItemElement(document());
     }
@@ -971,7 +1066,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     // to hold the caret before the highest blockquote.
     insertNodeBefore(br, highestBlockquote);
     VisiblePosition atBR(Position(br.get(), 0));
-    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert 
+    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert
     // a second one.
     if (!isStartOfParagraph(atBR))
         insertNodeBefore(createBreakElement(document()), br);
@@ -1002,7 +1097,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     return true;
 }
 
-// Operations use this function to avoid inserting content into an anchor when at the start or the end of 
+// Operations use this function to avoid inserting content into an anchor when at the start or the end of
 // that anchor, as in NSTextView.
 // FIXME: This is only an approximation of NSTextViews insertion behavior, which varies depending on how
 // the caret was made. 
@@ -1022,7 +1117,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
         VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
         VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
-        // If visually just after the anchor, insert *inside* the anchor unless it's the last 
+        // If visually just after the anchor, insert *inside* the anchor unless it's the last
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
             // Make sure anchors are pushed down before avoiding them so that we don't
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
index 2c6403e..0cceaaa 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
@@ -102,6 +102,9 @@ protected:
     
     void moveParagraph(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
     void moveParagraphs(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
+    void moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode);
+    void cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement);
+    void cleanupAfterDeletion();
     
     bool breakOutOfEmptyListItem();
     bool breakOutOfEmptyMailBlockquotedParagraph();
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index abd0174..3379b3c 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1291,10 +1291,10 @@ static String valueForeColor(Frame* frame, Event*)
 
 // Map of functions
 
+struct CommandEntry { const char* name; EditorInternalCommand command; };
+
 static const CommandMap& createCommandMap()
 {
-    struct CommandEntry { const char* name; EditorInternalCommand command; };
-    
     static const CommandEntry commands[] = {
         { "AlignCenter", { executeJustifyCenter, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "AlignJustified", { executeJustifyFull, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 84fa147..808a2f8 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -67,37 +67,6 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 {
 }
 
-// This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
-// correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
-PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
-{
-    int currentBlockquoteLevel = 0;
-    int lastBlockquoteLevel = 0;
-    Node* node = currentParagraph.deepEquivalent().node();
-    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
-        currentBlockquoteLevel++;
-    node = lastBlockquote.get();
-    while ((node = enclosingNodeWithTag(Position(node->parentNode(), 0), blockquoteTag)))
-        lastBlockquoteLevel++;
-    while (currentBlockquoteLevel > lastBlockquoteLevel) {
-        RefPtr<Element> newBlockquote = createIndentBlockquoteElement(document());
-        appendNode(newBlockquote, lastBlockquote);
-        lastBlockquote = newBlockquote;
-        lastBlockquoteLevel++;
-    }
-    while (currentBlockquoteLevel < lastBlockquoteLevel) {
-        lastBlockquote = static_cast<Element*>(enclosingNodeWithTag(Position(lastBlockquote->parentNode(), 0), blockquoteTag));
-        lastBlockquoteLevel--;
-    }
-    RefPtr<Element> placeholder = createBreakElement(document());
-    appendNode(placeholder, lastBlockquote);
-    // Add another br before the placeholder if it collapsed.
-    VisiblePosition visiblePos(Position(placeholder.get(), 0));
-    if (!isStartOfParagraph(visiblePos))
-        insertNodeBefore(createBreakElement(document()), placeholder);
-    return placeholder.release();
-}
-
 bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
 {
     // If our selection is not inside a list, bail out.
@@ -117,13 +86,9 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     Element* nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
-    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
-    RefPtr<Element> placeholder = createBreakElement(document());
     insertNodeBefore(newList, selectedListItem);
-    appendNode(newListItem, newList);
-    appendNode(placeholder, newListItem);
 
-    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, newList.get(), selectedListItem);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -137,25 +102,31 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
 {
     Node* enclosingCell = 0;
 
+    Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+    enclosingCell = enclosingNodeOfType(start, &isTableCell);
+    Node* nodeToSplitTo;
+    if (enclosingCell)
+        nodeToSplitTo = enclosingCell;
+    else if (enclosingList(start.node()))
+        nodeToSplitTo = enclosingBlock(start.node());
+    else
+        nodeToSplitTo = editableRootForPosition(start);
+
+    RefPtr<Node> outerBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+
     if (!targetBlockquote) {
         // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
         targetBlockquote = createIndentBlockquoteElement(document());
-        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-        enclosingCell = enclosingNodeOfType(start, &isTableCell);
-        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
-        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
-        insertNodeBefore(targetBlockquote, startOfNewBlock);
+        insertNodeBefore(targetBlockquote, outerBlock);
     }
 
-    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
-
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, targetBlockquote.get(), outerBlock.get());
+    
     // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
     // the next paragraph is in the same cell.
     if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
         targetBlockquote = 0;
-
-    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
 }
 
 void IndentOutdentCommand::indentRegion()
@@ -191,8 +162,6 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else
             indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
-            // blockquoteForNextIndent maybe updated
-            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index 419f832f..817b4c8 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -49,7 +49,6 @@ private:
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
-    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
     bool tryIndentingAsListItem(const VisiblePosition&);
     void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index 21ca924..0874201 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -57,7 +57,9 @@ static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeT
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
-    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+    Node* nextChild;
+    for (Node* child = nodeToReplace->firstChild(); child; child = nextChild) {
+        nextChild = child->nextSibling();
         newNode->appendChild(child, ec);
         ASSERT(!ec);
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index 7d99916..00672f2 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -725,6 +725,8 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     if (userTriggered)
         m_frame->setSelectionGranularity(CharacterGranularity);
 
+    m_lastChangeWasHorizontalExtension = alter == EXTEND;
+
     return true;
 }