Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-24062009 ( 6d5a2a0472a6af0b7f781da018e76bb8522d57a5 )

++ b/WebKit/qt/ChangeLog
2009-06-19  Daniel <qt-info@nokia.com>

        Reviewed by Simon Hausmann.

        Remove warnings for QString() constructions from const char *

        By explicitly wrapping it with QLatin1String() / QLatin1Char()

        * Api/qwebelement.cpp:
        (QWebElement::classes): Use QLatin1String.
        (QWebElement::addClass): Ditto.
        (QWebElement::removeClass): Ditto.
        (QWebElement::toggleClass): Ditto.

2009-06-18  Friedemann Kleint  <Friedemann.Kleint@nokia.com>

        Reviewed by Simon Hausmann.

        Fixed MinGW compilation.

        * Api/qwebelement.cpp:
        (QWebElement::evaluateScript):

2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>

        Reviewed by Simon Hausman.

        Clarify in docs how to compile with debug information.

        * docs/qtwebkit.qdoc:

2009-06-17  Markus Goetz <Markus.Goetz@nokia.com>

        Reviewed by Simon Hausmann.

        QWebPage: Don't call supportsSsl()

        This stops QWebPage from loading the OpenSSL libs,
        certificates etc. when they are not needed for the non-HTTPS case.

        Loading the SSL libraries can be a very slow operation.

        * Api/qwebpage.cpp:
        (QWebPage::userAgentForUrl):

2009-06-15  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>

        Reviewed by Adam Treat.

        Support the back/forward/stop/refresh multimedia keys and accept the
        event when handling backspace and shift backspace as we should.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):

2009-06-15  Andre Pedralho  <andre.pedralho@openbossa.org>

        Reviewed by Adam Treat.

        https://bugs.webkit.org/show_bug.cgi?id=26351
        Remove bool QWebHitTestResult::isScrollBar() const and make sure a null QWebHitTestResult is returned instead.

        * Api/qwebframe.cpp:
        (QWebFrame::hitTestContent):
        * Api/qwebframe.h:
        * Api/qwebpage.cpp:
        (QWebPage::updatePositionDependentActions):

2009-06-15  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Adam Treat.

        Fix the logic for disabling the fixed layout feature, when an invalid
        QSize is set.

        * Api/qwebpage.cpp:
        (QWebPage::setFixedContentsSize):

2009-06-13  Adam Barth  <abarth@webkit.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=24492

        Move registerURLSchemeAsLocal from FrameLoader to SecurityOrigin.

        * Api/qwebpage.cpp:
        (QWebPage::acceptNavigationRequest):

        Rubber-stamped by Simon Hausmann.
2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Renamed QWebSettings::AllowUniversalAccessFromFileUrls to
        LocalContentCanAccessRemoteUrls, as discussed in the API review.

        * Api/qwebsettings.cpp:
        (QWebSettingsPrivate::apply):
        (QWebSettings::QWebSettings):
        * Api/qwebsettings.h:

2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Merged useFixedLayout property with fixedLayoutSize and
        renamed the latter to fixedContentsSize.

        * Api/qwebpage.cpp:
        (QWebPage::fixedContentsSize):
        (QWebPage::setFixedContentsSize):
        * Api/qwebpage.h:
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):

2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Renamed QWebHitTestResult::linkTarget to linkElement() and made it return
        a QWebElement. The link target itself is always the target DOM attribute.

        * Api/qwebframe.cpp:
        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
        (QWebHitTestResult::linkElement):
        * Api/qwebframe.h:
        * Api/qwebframe_p.h:
        * tests/qwebframe/tst_qwebframe.cpp:

35 files changed, 174 insertions, 338 deletions

diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
index 11d1213..4c466fa 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -49,10 +49,8 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 {
 }
 
-void CachedCSSStyleSheet::addClient(CachedResourceClient *c)
+void CachedCSSStyleSheet::didAddClient(CachedResourceClient *c)
 {
-    CachedResource::addClient(c);
-
     if (!m_loading)
         c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), this);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
index fa0b31a..e782f2e 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
         const String sheetText(bool enforceMIMEType = true) const;
 
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         
         virtual void allClientsRemoved();
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
index ef2f5a9..af18cc9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
@@ -71,10 +71,8 @@ void CachedFont::load(DocLoader*)
     m_loading = true;
 }
 
-void CachedFont::addClient(CachedResourceClient* c)
+void CachedFont::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
-    
     if (!m_loading)
         c->fontLoaded(this);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.h b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
index e4414c6..05b28f3 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
@@ -51,7 +51,7 @@ public:
     
     virtual void load(DocLoader* docLoader);
 
-    virtual void addClient(CachedResourceClient*);
+    virtual void didAddClient(CachedResourceClient*);
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error();
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
index 74f9b01..e610ad1 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
@@ -86,10 +86,8 @@ void CachedImage::load(DocLoader* docLoader)
         m_loading = false;
 }
 
-void CachedImage::addClient(CachedResourceClient* c)
+void CachedImage::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
-
     if (m_decodedDataDeletionTimer.isActive())
         m_decodedDataDeletionTimer.stop();
     
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.h b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
index 22a3774..2aa35ac 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
@@ -60,7 +60,7 @@ public:
     IntSize imageSize(float multiplier) const;  // returns the size of the complete image.
     IntRect imageRect(float multiplier) const;  // The size of the currently decoded portion of the image.
 
-    virtual void addClient(CachedResourceClient*);
+    virtual void didAddClient(CachedResourceClient*);
     
     virtual void allClientsRemoved();
     virtual void destroyDecodedData();
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index dceeec0..478873f 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -35,6 +35,7 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 using namespace WTF;
@@ -172,7 +173,13 @@ void CachedResource::setRequest(Request* request)
         delete this;
 }
 
-void CachedResource::addClient(CachedResourceClient *c)
+void CachedResource::addClient(CachedResourceClient* client)
+{
+    addClientToSet(client);
+    didAddClient(client);
+}
+
+void CachedResource::addClientToSet(CachedResourceClient* client)
 {
     ASSERT(!isPurgeable());
 
@@ -186,21 +193,28 @@ void CachedResource::addClient(CachedResourceClient *c)
     }
     if (!hasClients() && inCache())
         cache()->addToLiveResourcesSize(this);
-    m_clients.add(c);
+    m_clients.add(client);
 }
 
-void CachedResource::removeClient(CachedResourceClient *c)
+void CachedResource::removeClient(CachedResourceClient* client)
 {
-    ASSERT(m_clients.contains(c));
-    m_clients.remove(c);
+    ASSERT(m_clients.contains(client));
+    m_clients.remove(client);
+
     if (canDelete() && !inCache())
         delete this;
     else if (!hasClients() && inCache()) {
         cache()->removeFromLiveResourcesSize(this);
         cache()->removeFromLiveDecodedResourcesList(this);
         allClientsRemoved();
-        cache()->prune();
+        if (response().cacheControlContainsNoStore()) {
+            // RFC2616 14.9.2:
+            // "no-store: ...MUST make a best-effort attempt to remove the information from volatile storage as promptly as possible"
+            cache()->remove(this);
+        } else
+            cache()->prune();
     }
+    // This object may be dead here.
 }
 
 void CachedResource::deleteIfPossible()
@@ -329,10 +343,15 @@ void CachedResource::switchClientsToRevalidatedResource()
     }
     // Equivalent of calling removeClient() for all clients
     m_clients.clear();
-    
+
     unsigned moveCount = clientsToMove.size();
     for (unsigned n = 0; n < moveCount; ++n)
-        m_resourceToRevalidate->addClient(clientsToMove[n]);
+        m_resourceToRevalidate->addClientToSet(clientsToMove[n]);
+    for (unsigned n = 0; n < moveCount; ++n) {
+        // Calling didAddClient for a client may end up removing another client. In that case it won't be in the set anymore.
+        if (m_resourceToRevalidate->m_clients.contains(clientsToMove[n]))
+            m_resourceToRevalidate->didAddClient(clientsToMove[n]);
+    }
 }
     
 void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& validatingResponse)
@@ -354,18 +373,32 @@ void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& val
     
 bool CachedResource::canUseCacheValidator() const
 {
-    return !m_loading && (!m_response.httpHeaderField("Last-Modified").isEmpty() || !m_response.httpHeaderField("ETag").isEmpty());
+    if (m_loading || m_errorOccurred)
+        return false;
+
+    if (m_response.cacheControlContainsNoStore())
+        return false;
+
+    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
+    DEFINE_STATIC_LOCAL(const AtomicString, eTagHeader, ("etag"));
+    return !m_response.httpHeaderField(lastModifiedHeader).isEmpty() || !m_response.httpHeaderField(eTagHeader).isEmpty();
 }
     
 bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 {
+    if (m_errorOccurred)
+        return true;
+
     if (m_loading)
         return false;
+    
+    if (m_response.cacheControlContainsNoCache() || m_response.cacheControlContainsNoStore())
+        return true;
 
     if (cachePolicy == CachePolicyCache)
-        return m_response.cacheControlContainsNoCache() || (isExpired() && m_response.cacheControlContainsMustRevalidate());
+        return m_response.cacheControlContainsMustRevalidate() && isExpired();
 
-    return isExpired() || m_response.cacheControlContainsNoCache();
+    return isExpired();
 }
 
 bool CachedResource::isSafeToMakePurgeable() const
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.h b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
index 16cce26..babdf89 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
@@ -87,7 +87,7 @@ public:
     const String &url() const { return m_url; }
     Type type() const { return m_type; }
 
-    virtual void addClient(CachedResourceClient*);
+    void addClient(CachedResourceClient*);
     void removeClient(CachedResourceClient*);
     bool hasClients() const { return !m_clients.isEmpty(); }
     void deleteIfPossible();
@@ -100,7 +100,8 @@ public:
     };
     PreloadResult preloadResult() const { return m_preloadResult; }
     void setRequestedFromNetworkingLayer() { m_requestedFromNetworkingLayer = true; }
-        
+
+    virtual void didAddClient(CachedResourceClient*) = 0;
     virtual void allClientsRemoved() { }
 
     unsigned count() const { return m_clients.size(); }
@@ -204,6 +205,8 @@ protected:
     bool m_errorOccurred;
 
 private:
+    void addClientToSet(CachedResourceClient*);
+                                        
     // These are called by the friendly Cache only
     void setResourceToRevalidate(CachedResource*);
     void switchClientsToRevalidatedResource();
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
index ebf0898..31483d6 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
@@ -49,9 +49,8 @@ CachedScript::~CachedScript()
 {
 }
 
-void CachedScript::addClient(CachedResourceClient* c)
+void CachedScript::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
     if (!m_loading)
         c->notifyFinished(this);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.h b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
index e1c3ee0..13afa89 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
         const String& script();
 
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         virtual void allClientsRemoved();
 
         virtual void setEncoding(const String&);
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
index f221664..5da0abf 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
@@ -45,10 +45,8 @@ CachedXSLStyleSheet::CachedXSLStyleSheet(const String &url)
     setAccept("text/xml, application/xml, application/xhtml+xml, text/xsl, application/rss+xml, application/atom+xml");
 }
 
-void CachedXSLStyleSheet::addClient(CachedResourceClient *c)
-{
-    CachedResource::addClient(c);
-    
+void CachedXSLStyleSheet::didAddClient(CachedResourceClient* c)
+{  
     if (!m_loading)
         c->setXSLStyleSheet(m_url, m_sheet);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
index 9eca098..b6b0585 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
         const String& sheet() const { return m_sheet; }
         
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         
         virtual void setEncoding(const String&);
         virtual String encoding() const;
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
index c0e3f6f..06d96bc 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
@@ -61,6 +61,9 @@ DocLoader::DocLoader(Document* doc)
 
 DocLoader::~DocLoader()
 {
+    if (m_requestCount)
+        m_cache->loader()->cancelRequests(this);
+
     clearPreloads();
     DocumentResourceMap::iterator end = m_documentResources.end();
     for (DocumentResourceMap::iterator it = m_documentResources.begin(); it != end; ++it)
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
index e4cbe4c..87cb725 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
@@ -883,7 +883,7 @@ bool DocumentLoader::shouldLoadResourceFromApplicationCache(const ResourceReques
     if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
         return false;
 
-    // If the resource's URL is an master entry, the manifest, an explicit entry, a fallback entry, or a dynamic entry
+    // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
     // in the application cache, then get the resource from the cache (instead of fetching it).
     resource = cache->resourceForURL(request.url());
 
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
index 643c067..ae6702b 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -77,23 +77,26 @@ void DocumentThreadableLoader::loadResourceSynchronously(Document* document, con
     client.didFinishLoading(identifier);
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
 {
     ASSERT(document);
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
     : m_client(client)
     , m_document(document)
     , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
+    , m_denyCrossOriginRedirect(crossOriginRedirectPolicy == DenyCrossOriginRedirect)
 {
     ASSERT(document);
     ASSERT(client);
+    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
+    ASSERT(crossOriginRedirectPolicy == DenyCrossOriginRedirect || crossOriginRedirectPolicy == AllowCrossOriginRedirect);
     m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
 }
 
@@ -120,7 +123,7 @@ void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, Resour
     ASSERT_UNUSED(loader, loader == m_loader);
 
     // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (!m_document->securityOrigin()->canRequest(request.url())) {
+    if (m_denyCrossOriginRedirect && !m_document->securityOrigin()->canRequest(request.url())) {
         RefPtr<DocumentThreadableLoader> protect(this);
         m_client->didFailRedirectCheck();
         request = ResourceRequest();
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
index c612f72..465475f 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
@@ -45,7 +45,7 @@ namespace WebCore {
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
     public:
         static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -58,7 +58,7 @@ namespace WebCore {
         virtual void derefThreadableLoader() { deref(); }
 
     private:
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
@@ -76,6 +76,7 @@ namespace WebCore {
         Document* m_document;
         bool m_allowStoredCredentials;
         bool m_sameOriginRequest;
+        bool m_denyCrossOriginRedirect;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 107b8be..81ebf1f 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -144,6 +144,12 @@ public:
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
 
     virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) {}
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) {};
+    virtual void setNeedsOneShotDrawingSynchronization() {};
+    virtual void scheduleViewUpdate() {};
+#endif
 };
 
 class EmptyFrameLoaderClient : public FrameLoaderClient {
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index 7a9ef32..9a09e49 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -90,6 +90,7 @@
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
 #include "XMLTokenizer.h"
+#include "XSSAuditor.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
@@ -115,35 +116,6 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
-
-static URLSchemesMap& localSchemes()
-{
-    DEFINE_STATIC_LOCAL(URLSchemesMap, localSchemes, ());
-
-    if (localSchemes.isEmpty()) {
-        localSchemes.add("file");
-#if PLATFORM(MAC)
-        localSchemes.add("applewebdata");
-#endif
-#if PLATFORM(QT)
-        localSchemes.add("qrc");
-#endif
-    }
-
-    return localSchemes;
-}
-
-static URLSchemesMap& noAccessSchemes()
-{
-    DEFINE_STATIC_LOCAL(URLSchemesMap, noAccessSchemes, ());
-
-    if (noAccessSchemes.isEmpty())
-        noAccessSchemes.add("data");
-
-    return noAccessSchemes;
-}
-
 struct ScheduledRedirection {
     enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
@@ -993,7 +965,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     restoreDocumentState();
 
     document->implicitOpen();
-
+    
     if (m_frame->view())
         m_frame->view()->setContentsSize(IntSize());
 }
@@ -1645,6 +1617,11 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
+    
+    if (!m_frame->script()->xssAuditor()->canLoadObject(url)) {
+        // It is unsafe to honor the request for this object.
+        return false;
+    }
 
     KURL completedURL;
     if (!url.isEmpty())
@@ -2196,7 +2173,7 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
         referrer = m_outgoingReferrer;
 
     ASSERT(frame()->document());
-    if (shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
+    if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
         if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
@@ -2411,7 +2388,7 @@ bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Documen
 bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
 {
     // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!shouldTreatURLAsLocal(url.string()))
+    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
         return true;
 
     // If we were provided a document, we let its local file policy dictate the result,
@@ -2419,7 +2396,7 @@ bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Securit
     if (securityOrigin)
         return securityOrigin->canLoadLocalResources();
     if (!referrer.isEmpty())
-        return shouldTreatURLAsLocal(referrer);
+        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
     return false;
 }
 
@@ -3053,6 +3030,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     }
 
     open(*cachedPage.cachedMainFrame());
+    cachedPage.restore(m_frame->page());
 
     checkCompleted();
 }
@@ -5140,59 +5118,6 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
     }
 }
 
-void FrameLoader::registerURLSchemeAsLocal(const String& scheme)
-{
-    localSchemes().add(scheme);
-}
-
-bool FrameLoader::shouldTreatURLAsLocal(const String& url)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (url.length() >= 5) {
-        const UChar* s = url.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p' && s[4] == ':')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e' && s[4] == ':')
-            return true;
-    }
-
-    int loc = url.find(':');
-    if (loc == -1)
-        return false;
-
-    String scheme = url.left(loc);
-    return localSchemes().contains(scheme);
-}
-
-bool FrameLoader::shouldTreatURLSchemeAsLocal(const String& scheme)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (scheme.length() == 4) {
-        const UChar* s = scheme.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e')
-            return true;
-    }
-
-    if (scheme.isEmpty())
-        return false;
-
-    return localSchemes().contains(scheme);
-}
-
-void FrameLoader::registerURLSchemeAsNoAccess(const String& scheme)
-{
-    noAccessSchemes().add(scheme);
-}
-
-bool FrameLoader::shouldTreatURLSchemeAsNoAccess(const String& scheme)
-{
-    return noAccessSchemes().contains(scheme);
-}
-
 void FrameLoader::dispatchDidCommitLoad()
 {
     if (m_creatingInitialEmptyDocument)
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index a0c1c29..d96329f 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -365,13 +365,6 @@ namespace WebCore {
         static bool restrictAccessToLocal();
         static bool allowSubstituteDataAccessToLocal();
 
-        static void registerURLSchemeAsLocal(const String&);
-        static bool shouldTreatURLAsLocal(const String&);
-        static bool shouldTreatURLSchemeAsLocal(const String&);
-
-        static void registerURLSchemeAsNoAccess(const String&);
-        static bool shouldTreatURLSchemeAsNoAccess(const String&);
-
         bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
 
         void iconLoadDecisionAvailable();
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
index ee81326..db68441 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
@@ -509,11 +509,13 @@ bool TextResourceDecoder::checkForCSSCharset(const char* data, size_t len, bool&
 static inline void skipComment(const char*& ptr, const char* pEnd)
 {
     const char* p = ptr;
+    if (p == pEnd)
+      return;
     // Allow <!-->; other browsers do.
     if (*p == '>') {
         p++;
     } else {
-        while (p != pEnd) {
+        while (p + 2 < pEnd) {
             if (*p == '-') {
                 // This is the real end of comment, "-->".
                 if (p[1] == '-' && p[2] == '>') {
@@ -521,7 +523,7 @@ static inline void skipComment(const char*& ptr, const char* pEnd)
                     break;
                 }
                 // This is the incorrect end of comment that other browsers allow, "--!>".
-                if (p[1] == '-' && p[2] == '!' && p[3] == '>') {
+                if (p + 3 < pEnd && p[1] == '-' && p[2] == '!' && p[3] == '>') {
                     p += 4;
                     break;
                 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
index 3927624..b174af7 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
@@ -40,18 +40,18 @@
 
 namespace WebCore {
 
-PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials) 
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy) 
 {
     ASSERT(client);
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext())
-        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials);
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials);
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
 }
 
 void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
@@ -60,7 +60,7 @@ void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext()) {
-        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials);
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, DenyCrossOriginRedirect);
         return;
     }
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
index b0cff7d..87ae229 100644
--- a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
@@ -58,12 +58,17 @@ namespace WebCore {
         DoNotAllowStoredCredentials
     };
 
+    enum CrossOriginRedirectPolicy {
+        DenyCrossOriginRedirect,
+        AllowCrossOriginRedirect
+    };
+
     // Useful for doing loader operations from any thread (not threadsafe, 
     // just able to run on threads other than the main thread).
     class ThreadableLoader : Noncopyable {
     public:
         static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
 
         virtual void cancel() = 0;
         void ref() { refThreadableLoader(); }
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
index beaf061..4d12b8d 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -40,7 +40,7 @@
 #include "ResourceResponse.h"
 #include "ThreadableLoader.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
+#include "WorkerLoaderProxy.h"
 #include "WorkerThread.h"
 #include <memory>
 #include <wtf/OwnPtr.h>
@@ -53,13 +53,11 @@ namespace WebCore {
 
 static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
 
-// FIXME: The assumption that we can upcast worker object proxy to WorkerMessagingProxy will not be true in multi-process implementation.
 WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
-                                               ContentSniff contentSniff, StoredCredentials storedCredentials)
+                                               ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, *(static_cast<WorkerMessagingProxy*>(m_workerContext->thread()->workerObjectProxy())), taskMode, request, callbacksSetting,
-                                      contentSniff, storedCredentials)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy)))
 {
 }
 
@@ -68,7 +66,7 @@ WorkerThreadableLoader::~WorkerThreadableLoader()
     m_bridge.destroy();
 }
 
-void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
 {
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -77,7 +75,7 @@ void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerCont
     mode.append(String::number(runLoop.createUniqueId()));
 
     ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
-    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials);
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, crossOriginRedirectPolicy);
 
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     while (!loader->done() && result != MessageQueueTerminated)
@@ -92,32 +90,26 @@ void WorkerThreadableLoader::cancel()
     m_bridge.cancel();
 }
 
-WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerMessagingProxy& messagingProxy, const String& taskMode,
-                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
+                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
+                                                           CrossOriginRedirectPolicy crossOriginRedirectPolicy)
     : m_workerClientWrapper(workerClientWrapper)
-    , m_messagingProxy(messagingProxy)
+    , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.copy())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
 {
-    // FIXME: This assert fails for nested workers.  Removing the assert would allow it to work,
-    // but then there would be one WorkerThreadableLoader in every intermediate worker simply
-    // chaining the requests, which is not very good. Instead, the postTaskToWorkerObject should be a
-    // postTaskToDocumentContext.
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
 
-    if (thisPtr->m_messagingProxy.askedToTerminate())
-        return;
-
     // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
     // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
     // needs to be examined for how it should take into account a different originator.
@@ -125,7 +117,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExec
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials);
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
@@ -142,7 +134,7 @@ void WorkerThreadableLoader::MainThreadBridge::destroy()
     clearClientWrapper();
 
     // "delete this" and m_mainThreadLoader::deref() on the worker object's thread.
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
 }
 
 void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
@@ -158,7 +150,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionC
 
 void WorkerThreadableLoader::MainThreadBridge::cancel()
 {
-    m_messagingProxy.postTaskToWorkerObject(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
     ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
     if (!clientWrapper->done()) {
         // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
@@ -183,7 +175,7 @@ static void workerContextDidSendData(ScriptExecutionContext* context, RefPtr<Thr
 
 void WorkerThreadableLoader::MainThreadBridge::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
 }
 
 static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
@@ -195,7 +187,7 @@ static void workerContextDidReceiveResponse(ScriptExecutionContext* context, Ref
 
 void WorkerThreadableLoader::MainThreadBridge::didReceiveResponse(const ResourceResponse& response)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
 }
 
 static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<Vector<char> > vectorData)
@@ -208,7 +200,7 @@ void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data,
 {
     auto_ptr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an auto_ptr for usage with createCallbackTask.
     memcpy(vector->data(), data, lengthReceived);
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
 }
 
 static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long identifier)
@@ -219,7 +211,7 @@ static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPt
 
 void WorkerThreadableLoader::MainThreadBridge::didFinishLoading(unsigned long identifier)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
 }
 
 static void workerContextDidFail(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, const ResourceError& error)
@@ -230,7 +222,7 @@ static void workerContextDidFail(ScriptExecutionContext* context, RefPtr<Threada
 
 void WorkerThreadableLoader::MainThreadBridge::didFail(const ResourceError& error)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
 }
 
 static void workerContextDidFailRedirectCheck(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper)
@@ -241,7 +233,7 @@ static void workerContextDidFailRedirectCheck(ScriptExecutionContext* context, R
 
 void WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck()
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
 }
 
 static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
@@ -253,7 +245,7 @@ static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionCon
 
 void WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation(const ResourceResponse& response)
 {
-    m_messagingProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
index 9817fea..8b11b70 100644
--- a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
@@ -49,16 +49,16 @@ namespace WebCore {
     class ResourceError;
     struct ResourceRequest;
     class WorkerContext;
-    class WorkerMessagingProxy;
+    class WorkerLoaderProxy;
     struct CrossThreadResourceResponseData;
     struct CrossThreadResourceRequestData;
 
     class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
     public:
-        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials)
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, CrossOriginRedirectPolicy);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
         {
-            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials));
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
         }
 
         ~WorkerThreadableLoader();
@@ -86,7 +86,7 @@ namespace WebCore {
         //
         // case 1. worker.terminate is called.
         //    In this case, no more tasks are posted from the worker object's thread to the worker
-        //    context's thread -- WorkerMessagingProxy enforces this.
+        //    context's thread -- WorkerContextProxy implementation enforces this.
         //
         // case 2. xhr gets aborted and the worker context continues running.
         //    The ThreadableLoaderClientWrapper has the underlying client cleared, so no more calls
@@ -97,7 +97,7 @@ namespace WebCore {
         class MainThreadBridge : ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerMessagingProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
             void cancel();
             void destroy();
 
@@ -109,7 +109,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -127,13 +127,13 @@ namespace WebCore {
             RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
 
             // May be used on either thread.
-            WorkerMessagingProxy& m_messagingProxy;
+            WorkerLoaderProxy& m_loaderProxy;
 
             // For use on the main thread.
             String m_taskMode;
         };
 
-        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials);
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
 
         RefPtr<WorkerContext> m_workerContext;
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
index 42f5b6a..3033718 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
@@ -81,7 +81,7 @@ void ApplicationCache::addResource(PassRefPtr<ApplicationCacheResource> resource
     
     if (m_storageID) {
         ASSERT(!resource->storageID());
-        ASSERT(resource->type() & (ApplicationCacheResource::Dynamic | ApplicationCacheResource::Master));
+        ASSERT(resource->type() & ApplicationCacheResource::Master);
         
         // Add the resource to the storage.
         cacheStorage().store(resource.get(), this);
@@ -129,32 +129,6 @@ ApplicationCacheResource* ApplicationCache::resourceForRequest(const ResourceReq
     return resourceForURL(request.url());
 }
 
-unsigned ApplicationCache::numDynamicEntries() const
-{
-    // FIXME: Implement
-    return 0;
-}
-    
-String ApplicationCache::dynamicEntry(unsigned) const
-{
-    // FIXME: Implement
-    return String();
-}
-    
-bool ApplicationCache::addDynamicEntry(const String& url)
-{
-    if (!equalIgnoringCase(m_group->manifestURL().protocol(), KURL(url).protocol()))
-        return false;
-
-    // FIXME: Implement (be sure to respect private browsing state).
-    return true;
-}
-    
-void ApplicationCache::removeDynamicEntry(const String&)
-{
-    // FIXME: Implement (be sure to respect private browsing state).
-}
-
 void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
 {
     ASSERT(m_onlineWhitelist.isEmpty());
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
index afdab27..9609f8d 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
@@ -65,12 +65,6 @@ public:
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
-    unsigned numDynamicEntries() const;
-    String dynamicEntry(unsigned index) const;
-    
-    bool addDynamicEntry(const String& url);
-    void removeDynamicEntry(const String& url);
-    
     void setOnlineWhitelist(const Vector<KURL>& onlineWhitelist);
     const Vector<KURL>& onlineWhitelist() const { return m_onlineWhitelist; }
     bool isURLInOnlineWhitelist(const KURL&); // There is an entry in online whitelist that has the same origin as the resource's URL and that is a prefix match for the resource's URL.
@@ -103,9 +97,6 @@ private:
     Vector<KURL> m_onlineWhitelist;
     FallbackURLVector m_fallbackURLs;
 
-    // While an update is in progress, changes in dynamic entries are queued for later execution.
-    Vector<std::pair<KURL, bool> > m_pendingDynamicEntryActions;
-
     unsigned m_storageID;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 48d3942..6ba8f7b 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -631,7 +631,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
         ApplicationCache::ResourceMap::const_iterator end = m_newestCache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = m_newestCache->begin(); it != end; ++it) {
             unsigned type = it->second->type();
-            if (type & (ApplicationCacheResource::Master | ApplicationCacheResource::Dynamic))
+            if (type & ApplicationCacheResource::Master)
                 addEntry(it->first, type);
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
index 7c1241b..4beb76a 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
@@ -57,8 +57,6 @@ void ApplicationCacheResource::dumpType(unsigned type)
         printf("foreign ");
     if (type & Fallback)
         printf("fallback ");
-    if (type & Dynamic)
-        printf("dynamic ");
     
     printf("\n");
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
index 28d8280..0a8d6c2 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -39,8 +39,7 @@ public:
         Manifest = 1 << 1,
         Explicit = 1 << 2,
         Foreign = 1 << 3,
-        Fallback = 1 << 4,
-        Dynamic = 1 << 5
+        Fallback = 1 << 4
     };
         
     static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create())
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 1c59581..7e611cd 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -615,9 +615,6 @@ bool ApplicationCacheStorage::storeUpdatedType(ApplicationCacheResource* resourc
     ASSERT_UNUSED(cache, cache->storageID());
     ASSERT(resource->storageID());
 
-    // FIXME: If the resource gained a Dynamic bit, it should be re-inserted at the end for correct order.
-    ASSERT(!(resource->type() & ApplicationCacheResource::Dynamic));
-    
     // First, insert the data
     SQLiteStatement entryStatement(m_database, "UPDATE CacheEntries SET type=? WHERE resource=?");
     if (entryStatement.prepare() != SQLResultOk)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
index 90d2930..5ea5d4f 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -38,7 +38,6 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "StaticStringList.h"
 
 namespace WebCore {
 
@@ -127,65 +126,6 @@ void DOMApplicationCache::swapCache(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
 }
 
-PassRefPtr<DOMStringList> DOMApplicationCache::items()
-{
-    Vector<String> result;
-    if (ApplicationCache* cache = associatedCache()) {
-        unsigned numEntries = cache->numDynamicEntries();
-        result.reserveInitialCapacity(numEntries);
-        for (unsigned i = 0; i < numEntries; ++i)
-            result.append(cache->dynamicEntry(i));
-    }
-    return StaticStringList::adopt(result);
-}
-
-bool DOMApplicationCache::hasItem(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return false;
-    }
-
-    if (!url.isValid()) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    ApplicationCacheResource* resource = cache->resourceForURL(url.string());
-    return resource && (resource->type() & ApplicationCacheResource::Dynamic);
-}
-    
-void DOMApplicationCache::add(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
- 
-    if (!url.isValid()) {
-        ec = SYNTAX_ERR;
-        return;
-    }
-        
-    if (!cache->addDynamicEntry(url)) {
-        // This should use the (currently not specified) security exceptions in HTML5 4.3.4
-        ec = SECURITY_ERR;
-    }
-}
-
-void DOMApplicationCache::remove(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-    
-    cache->removeDynamicEntry(url);
-}
-
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
     return m_frame->document();
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
index b76542d..4fe1511 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
@@ -40,7 +40,6 @@ namespace WebCore {
 
 class ApplicationCache;
 class AtomicStringImpl;
-class DOMStringList;
 class Frame;
 class KURL;
 class String;
@@ -64,11 +63,6 @@ public:
     void update(ExceptionCode&);
     void swapCache(ExceptionCode&);
     
-    PassRefPtr<DOMStringList> items();
-    bool hasItem(const KURL&, ExceptionCode&);
-    void add(const KURL&, ExceptionCode&);
-    void remove(const KURL&, ExceptionCode&);
-
     virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
     virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
     virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
index 1156c9c..ebc1d19 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -43,17 +43,6 @@ module offline {
         void swapCache()
             raises(DOMException);
 
-#if defined(ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES) && ENABLE_APPLICATION_CACHE_DYNAMIC_ENTRIES
-        // dynamic entries
-        readonly attribute DOMStringList items;
-        [Custom] boolean hasItem(in DOMString url)
-            raises(DOMException);
-        [Custom] void add(in DOMString uri)
-            raises(DOMException);
-        [Custom] void remove(in DOMString uri)
-            raises(DOMException);
-#endif
-
         // events
         attribute EventListener onchecking;
         attribute EventListener onerror;
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.cpp b/src/3rdparty/webkit/WebCore/loader/loader.cpp
index ad87b1d..d10877f 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/loader.cpp
@@ -57,10 +57,10 @@ static const unsigned maxRequestsInFlightForNonHTTPProtocols = 10000;
 #endif
 
 Loader::Loader()
-    : m_nonHTTPProtocolHost(AtomicString(), maxRequestsInFlightForNonHTTPProtocols)
-    , m_requestTimer(this, &Loader::requestTimerFired)
+    : m_requestTimer(this, &Loader::requestTimerFired)
     , m_isSuspendingPendingRequests(false)
 {
+    m_nonHTTPProtocolHost = Host::create(AtomicString(), maxRequestsInFlightForNonHTTPProtocols);
     maxRequestsInFlightPerHost = initializeMaximumHTTPConnectionCountPerHost();
 }
 
@@ -99,17 +99,17 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     ASSERT(docLoader);
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
-    Host* host;
+    RefPtr<Host> host;
     KURL url(resource->url());
     if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
-            host = new Host(hostName, maxRequestsInFlightPerHost);
+            host = Host::create(hostName, maxRequestsInFlightPerHost);
             m_hosts.add(hostName.impl(), host);
         }
     } else 
-        host = &m_nonHTTPProtocolHost;
+        host = m_nonHTTPProtocolHost;
     
     bool hadRequests = host->hasRequests();
     Priority priority = determinePriority(resource);
@@ -143,17 +143,20 @@ void Loader::servePendingRequests(Priority minimumPriority)
 
     m_requestTimer.stop();
     
-    m_nonHTTPProtocolHost.servePendingRequests(minimumPriority);
+    m_nonHTTPProtocolHost->servePendingRequests(minimumPriority);
 
     Vector<Host*> hostsToServe;
-    copyValuesToVector(m_hosts, hostsToServe);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToServe.append(i->second.get());
+        
     for (unsigned n = 0; n < hostsToServe.size(); ++n) {
         Host* host = hostsToServe[n];
         if (host->hasRequests())
             host->servePendingRequests(minimumPriority);
         else if (!host->processingResource()){
             AtomicString name = host->name();
-            delete host;
             m_hosts.remove(name.impl());
         }
     }
@@ -169,7 +172,7 @@ void Loader::resumePendingRequests()
 {
     ASSERT(m_isSuspendingPendingRequests);
     m_isSuspendingPendingRequests = false;
-    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost.hasRequests())
+    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost->hasRequests())
         scheduleServePendingRequests();
 }
 
@@ -177,11 +180,15 @@ void Loader::cancelRequests(DocLoader* docLoader)
 {
     docLoader->clearPendingPreloads();
 
-    if (m_nonHTTPProtocolHost.hasRequests())
-        m_nonHTTPProtocolHost.cancelRequests(docLoader);
+    if (m_nonHTTPProtocolHost->hasRequests())
+        m_nonHTTPProtocolHost->cancelRequests(docLoader);
     
     Vector<Host*> hostsToCancel;
-    copyValuesToVector(m_hosts, hostsToCancel);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToCancel.append(i->second.get());
+
     for (unsigned n = 0; n < hostsToCancel.size(); ++n) {
         Host* host = hostsToCancel[n];
         if (host->hasRequests())
@@ -293,12 +300,12 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
 
 void Loader::Host::didFinishLoading(SubresourceLoader* loader)
 {
+    RefPtr<Host> myProtector(this);
+
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
     
-    ProcessingResource processingResource(this);
-
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
@@ -339,13 +346,13 @@ void Loader::Host::didFail(SubresourceLoader* loader, const ResourceError&)
 
 void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
 {
+    RefPtr<Host> myProtector(this);
+
     loader->clearClient();
 
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
-
-    ProcessingResource processingResource(this);
     
     Request* request = i->second;
     m_requestsLoading.remove(i);
@@ -379,6 +386,8 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
 
 void Loader::Host::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     
     // FIXME: This is a workaround for <rdar://problem/5236843>
@@ -440,6 +449,8 @@ void Loader::Host::didReceiveResponse(SubresourceLoader* loader, const ResourceR
 
 void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, int size)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     if (!request)
         return;
@@ -449,9 +460,7 @@ void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, i
     
     if (resource->errorOccurred())
         return;
-    
-    ProcessingResource processingResource(this);
-    
+        
     if (resource->response().httpStatusCode() / 100 == 4) {
         // Treat a 4xx response like a network error for all resources but images (which will ignore the error and continue to load for 
         // legacy compatibility).
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.h b/src/3rdparty/webkit/WebCore/loader/loader.h
index 888da11..c5b9416 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.h
+++ b/src/3rdparty/webkit/WebCore/loader/loader.h
@@ -59,9 +59,12 @@ namespace WebCore {
         
         void requestTimerFired(Timer<Loader>*);
 
-        class Host : private SubresourceLoaderClient {
+        class Host : public RefCounted<Host>, private SubresourceLoaderClient {
         public:
-            Host(const AtomicString& name, unsigned maxRequestsInFlight);
+            static PassRefPtr<Host> create(const AtomicString& name, unsigned maxRequestsInFlight) 
+            {
+                return adoptRef(new Host(name, maxRequestsInFlight));
+            }
             ~Host();
             
             const AtomicString& name() const { return m_name; }
@@ -73,22 +76,7 @@ namespace WebCore {
             bool processingResource() const { return m_numResourcesProcessing != 0; }
 
         private:
-            class ProcessingResource {
-            public:
-                ProcessingResource(Host* host)
-                    : m_host(host)
-                {
-                    m_host->m_numResourcesProcessing++;
-                }
-
-                ~ProcessingResource()
-                {
-                    m_host->m_numResourcesProcessing--;
-                }
-
-            private:
-                Host* m_host;
-            };
+            Host(const AtomicString&, unsigned);
 
             virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
             virtual void didReceiveData(SubresourceLoader*, const char*, int);
@@ -107,9 +95,9 @@ namespace WebCore {
             const int m_maxRequestsInFlight;
             int m_numResourcesProcessing;
         };
-        typedef HashMap<AtomicStringImpl*, Host*> HostMap;
+        typedef HashMap<AtomicStringImpl*, RefPtr<Host> > HostMap;
         HostMap m_hosts;
-        Host m_nonHTTPProtocolHost;
+        RefPtr<Host> m_nonHTTPProtocolHost;
         
         Timer<Loader> m_requestTimer;