Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-29062009 ( 22aadba1b4356ad7d8e9446b95baccb6b2c037b0 )

Changes in WebKit/qt since the last update:

2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>

        Fix the Qt build, add missing isSpeaking() implementation to
        ContextMenuClient.

        * WebCoreSupport/ContextMenuClientQt.cpp:
        (WebCore::ContextMenuClientQt::isSpeaking):
        * WebCoreSupport/ContextMenuClientQt.h:

2009-06-28  Sriram Yadavalli  <sriram.yadavalli@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Fix build break for Qt
        https://bugs.webkit.org/show_bug.cgi?id=26779

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-27  Simon Hausmann  <simon.hausmann@nokia.com>

        Build fix for Qt under Windows.

        * Api/qwebhistory.h: Use consistent export linkage for the datastream operators.

2009-06-26  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Simon Fraser.

        Changed call of scrollbarUnderMouse to scrollbarUnderPoint to match new API.

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for saving and loading of QWebHistory to and from a QByteArray.

        This includes streaming operators for QWebHistory. for convenience.

        New autotests that test QWebHistory and QWebHistoryItem serialization.

        * Api/qwebhistory.cpp:
        (QWebHistory::restoreState):
        (QWebHistory::saveState):
        (operator<<):
        (operator>>):
        * Api/qwebhistory.h:
        * Api/qwebhistory_p.h:
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::):
        (tst_QWebHistory::init):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::itemAt):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        (tst_QWebHistory::serialize_1):
        (tst_QWebHistory::serialize_2):
        (tst_QWebHistory::serialize_3):
        (tst_QWebHistory::saveAndRestore_1):
        (tst_QWebHistory::saveAndRestore_2):
        (tst_QWebHistory::saveAndRestore_3):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix the behaviour of QWebHistory::itemAt to interpret the specified index as absolute index.

        Returns an invalid QWebHistoryItem if the index is out of range.

        * Api/qwebhistory.cpp:
        (QWebHistory::itemAt):
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::itemAt):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Added a few autotest to QWebHistory.

        * tests/qwebhistory/data/page1.html: Added.
        * tests/qwebhistory/data/page2.html: Added.
        * tests/qwebhistory/data/page3.html: Added.
        * tests/qwebhistory/data/page4.html: Added.
        * tests/qwebhistory/data/page5.html: Added.
        * tests/qwebhistory/data/page6.html: Added.
        * tests/qwebhistory/qwebhistory.pro: Added.
        * tests/qwebhistory/tst_qwebhistory.cpp: Added.
        (tst_QWebHistory::):
        (tst_QWebHistory::tst_QWebHistory):
        (tst_QWebHistory::~tst_QWebHistory):
        (tst_QWebHistory::init):
        (tst_QWebHistory::cleanup):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        * tests/qwebhistory/tst_qwebhistory.qrc: Added.
        * tests/tests.pro:

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix support for documenting functions prefixed with QWEBKIT_EXPORT

        Add QWEBKIT_EXPORT to the list of macros to ignore by qdoc.

        * docs/qtwebkit.qdocconf:

2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Bug 20303: [Qt] Key events are not working in frames.

        Send scrolling events to current focused frame, bubble the event
        up to parent frame if it is not handled.  Use EventHandler's new
        shared scrolling code.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):
        (QWebPagePrivate::handleScrolling):
        * Api/qwebpage_p.h:

2009-06-25  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Adam Treat.

        Add highlight functionality to the QWebPage::findText() method. Introduced is
        new HighlightAllOccurrences flag which passed to the function will make it mark
        all existing occurrences of specified string in the page.

        * Api/qwebpage.cpp:
        (QWebPage::findText):
        * Api/qwebpage.h:
        * Api/qwebview.cpp:

17 files changed, 68 insertions, 68 deletions

diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
index 300cbf6..aac99db 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 
 WMLAnchorElement::WMLAnchorElement(const QualifiedName& tagName, Document* doc)
     : WMLAElement(tagName, doc)
+    , m_task(0)
 {
     // Calling setIsLink(true), and returning a non-null value on CSSStyleSelectors' linkAttribute
     // method, makes it possible to 'appear as link' (just like <a href="..">) without the need to
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index c8e92af..3713c59 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -206,6 +206,11 @@ void WMLCardElement::handleDeckLevelTaskOverridesIfNeeded()
         (*it)->setActive(!cardDoElementNames.contains((*it)->name()));
 }
 
+String WMLCardElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 void WMLCardElement::parseMappedAttribute(MappedAttribute* attr)
 {
     WMLIntrinsicEventType eventType = WMLIntrinsicEventUnknown;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
index 972961e..e033e3d 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
@@ -47,6 +47,7 @@ public:
     void handleIntrinsicEventIfNeeded();
     void handleDeckLevelTaskOverridesIfNeeded();
 
+    virtual String title() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
index 916bc6e..f553fff 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
@@ -98,8 +98,6 @@ void WMLDoElement::parseMappedAttribute(MappedAttribute* attr)
         m_type = parseValueForbiddingVariableReferences(attr->value());
     else if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::labelAttr)
-        m_label = parseValueSubstitutingVariableReferences(attr->value());
     else if (attr->name() == optionalAttr)
         m_isOptional = (attr->value() == "true");
     else
@@ -145,6 +143,11 @@ void WMLDoElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+String WMLDoElement::label() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::labelAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
index 98e97cc..51e37c4 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
@@ -42,7 +42,7 @@ public:
     void registerTask(WMLTaskElement* task) { m_task = task; }
 
     bool isActive() const { return m_isActive; }
-    String label() const { return m_label; }
+    String label() const;
     String name() const { return m_name; }
 
     void setActive(bool active) { m_isActive = active; }
@@ -53,7 +53,6 @@ private:
     bool m_isActive;
     bool m_isNoop;
     bool m_isOptional;
-    String m_label;
     String m_name;
     String m_type;
 };
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index e818f9d..f59a3a1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -87,7 +87,7 @@ RenderObject* WMLElement::createRenderer(RenderArena*, RenderStyle* style)
     return RenderObject::createObject(this, style);
 }
 
-String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode)
+String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode) const
 {
     bool isValid = false;
     if (!containsVariableReference(value, isValid))
@@ -101,7 +101,7 @@ String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString&
     return substituteVariableReferences(value, document());
 }
 
-String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value)
+String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value) const
 {
     bool isValid = false;
     if (containsVariableReference(value, isValid)) {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.h b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
index 61bd98f..04e28d0 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
@@ -42,8 +42,8 @@ public:
 
 protected:
     // Helper function for derived classes
-    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference);
-    String parseValueForbiddingVariableReferences(const AtomicString&);
+    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
+    String parseValueForbiddingVariableReferences(const AtomicString&) const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
index 8146375..c0b4bc5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
@@ -43,19 +43,12 @@ WMLFieldSetElement::~WMLFieldSetElement()
 {
 }
 
-void WMLFieldSetElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::titleAttr)
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLFieldSetElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    if (m_title.isEmpty())
+    String title = parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+    if (title.isEmpty())
         return;
 
     m_insertedLegendElement = WMLElementFactory::createWMLElement(insertedLegendTag, document());
@@ -67,7 +60,7 @@ void WMLFieldSetElement::insertedIntoDocument()
     ASSERT(ec == 0);
 
     // Create text node holding the 'title' attribute value
-    m_insertedLegendElement->appendChild(document()->createTextNode(m_title), ec);
+    m_insertedLegendElement->appendChild(document()->createTextNode(title), ec);
     ASSERT(ec == 0);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
index 2043364..1087fa1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
@@ -31,14 +31,12 @@ public:
     WMLFieldSetElement(const QualifiedName& tagName, Document*);
     virtual ~WMLFieldSetElement();
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 private:
-    String m_title;
     RefPtr<WMLElement> m_insertedLegendElement;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
index d70731c..3614c6c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
@@ -44,6 +44,11 @@ WMLOptGroupElement::~WMLOptGroupElement()
 {
 }
 
+String WMLOptGroupElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 const AtomicString& WMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
@@ -120,11 +125,6 @@ void WMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChang
 
 void WMLOptGroupElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == HTMLNames::titleAttr) {
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-        return;
-    }
-
     WMLFormControlElement::parseMappedAttribute(attr);
     recalcSelectOptions();
 }
@@ -154,7 +154,7 @@ RenderStyle* WMLOptGroupElement::nonRendererRenderStyle() const
 
 String WMLOptGroupElement::groupLabelText() const
 {
-    String itemText = document()->displayStringModifiedByEncoding(m_title);
+    String itemText = document()->displayStringModifiedByEncoding(title());
 
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     itemText = itemText.stripWhiteSpace();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
index 1ba5ac1..0460056 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
@@ -32,7 +32,7 @@ public:
     WMLOptGroupElement(const QualifiedName& tagName, Document*);
     virtual ~WMLOptGroupElement();
 
-    String title() const { return m_title; }
+    String title() const;
 
     virtual const AtomicString& formControlType() const;
 
@@ -59,7 +59,6 @@ private:
     void recalcSelectOptions();
 
 private:
-    String m_title;
     RefPtr<RenderStyle> m_style;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
index 69f61f5..7d001e1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
@@ -26,7 +26,6 @@
 #include "CString.h"
 #include "TextEncoding.h"
 #include "HTMLNames.h"
-#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLGoElement.h"
 #include "WMLNames.h"
@@ -40,16 +39,6 @@ WMLPostfieldElement::WMLPostfieldElement(const QualifiedName& tagName, Document*
 {
 }
 
-void WMLPostfieldElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::nameAttr)
-        m_name = parseValueSubstitutingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLPostfieldElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
@@ -63,6 +52,16 @@ void WMLPostfieldElement::insertedIntoDocument()
     static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
 }
 
+String WMLPostfieldElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr));
+}
+
+String WMLPostfieldElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 static inline CString encodedString(const TextEncoding& encoding, const String& data)
 {
     return encoding.encode(data.characters(), data.length(), EntitiesForUnencodables);
@@ -70,8 +69,8 @@ static inline CString encodedString(const TextEncoding& encoding, const String&
 
 void WMLPostfieldElement::encodeData(const TextEncoding& encoding, CString& name, CString& value)
 {
-    name = encodedString(encoding, m_name);
-    value = encodedString(encoding, m_value);
+    name = encodedString(encoding, this->name());
+    value = encodedString(encoding, this->value());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
index 59b7f64..945e6d3 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
@@ -30,18 +30,13 @@ class WMLPostfieldElement : public WMLElement {
 public:
     WMLPostfieldElement(const QualifiedName& tagName, Document*);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
+    String name() const;
+    String value() const;
 
     // Encode name() and value() in a CString using the passed encoding
     void encodeData(const TextEncoding&, CString& name, CString& value);
-
-private:
-    String m_name;
-    String m_value;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
index da9a1f4..f0c50cc 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
@@ -43,16 +43,11 @@ WMLSetvarElement::~WMLSetvarElement()
 void WMLSetvarElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr) {
-        String name = parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName);
-        if (!isValidVariableName(name)) {
+        if (!isValidVariableName(parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName))) {
             reportWMLError(document(), WMLErrorInvalidVariableName);
             return;
         }
-
-        m_name = name;
-    } else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
+    } else
         WMLElement::parseMappedAttribute(attr);
 }
 
@@ -70,6 +65,16 @@ void WMLSetvarElement::insertedIntoDocument()
         static_cast<WMLTaskElement*>(parent)->registerVariableSetter(this);
 }
 
+String WMLSetvarElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr), WMLErrorInvalidVariableName);
+}
+
+String WMLSetvarElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
index ebedbc8..12400a5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
@@ -34,12 +34,8 @@ public:
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
-
-private:
-    String m_name;
-    String m_value;
+    String name() const;
+    String value() const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
index 00c7036..a41daf5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
@@ -46,8 +46,6 @@ void WMLTimerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
     else
         WMLElement::parseMappedAttribute(attr);
 }
@@ -57,7 +55,7 @@ void WMLTimerElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     // If the value of timeout is not a positive integer, ignore it
-    if (m_value.toInt() <= 0)
+    if (value().toInt() <= 0)
         return;
 
     Node* parent = parentNode();
@@ -81,10 +79,12 @@ void WMLTimerElement::timerFired(Timer<WMLTimerElement>*)
     if (!pageState)
         return;
 
+    String value = this->value();
+
     // When the timer expires, set the name varialbe of timer to '0'
     if (!m_name.isEmpty()) {
-        m_value = "0";
-        pageState->storeVariable(m_name, m_value);
+        value = "0";
+        pageState->storeVariable(m_name, value);
     }
 
     WMLIntrinsicEventType eventType = WMLIntrinsicEventOnTimer;
@@ -114,7 +114,7 @@ void WMLTimerElement::start(int interval)
     }
 
     if (interval <= 0)
-        interval = m_value.toInt();
+        interval = value().toInt();
 
     if (interval > 0)
         m_timer.startOneShot(interval / 10.0f);
@@ -137,6 +137,11 @@ void WMLTimerElement::storeIntervalToPageState()
         pageState->storeVariable(m_name, String::number(interval));
 }
 
+String WMLTimerElement::value() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
index eecacf3..b367eb9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
@@ -42,10 +42,11 @@ public:
     void stop();
     void storeIntervalToPageState();
 
+    String value() const;
+
 private:
     WMLCardElement* m_card;
     String m_name;
-    String m_value;
     Timer<WMLTimerElement> m_timer;
 };