Updated WebKit to 64cce10 (qtwebkit-rc1, week36)

Changes since last sync:
    [https://webkit.org/b/59927 #59927]: [SH4] AssemblerLabel does not name a type
    [https://webkit.org/b/63259 #63259]: Warnings in JSC's JIT on 32 bit
    [https://webkit.org/b/67254 #67254]: [Qt][DRT] Normalize file:///tmp/LayoutTests in LayoutTestController::pathToLocalResource()
    [https://webkit.org/b/64527 #64527]: [Qt]Update layout test results for newer Qt 4.8.x
    [https://webkit.org/b/67644 #67644]: [Qt][Symbian] REGRESSION[94105] DumpRenderTree.exe doesn't build on Symbian
    [https://webkit.org/b/67784 #67784]: frame-loading-via-document-write.html test cases have extra slash in path
    [https://webkit.org/b/67958 #67958]: (restricted bug)
    [https://webkit.org/b/61805 #61805]: (restricted bug)
    [https://webkit.org/b/64753 #64753]: (restricted bug)
    [https://webkit.org/b/67364 #67364]: (restricted bug)
    [https://webkit.org/b/67488 #67488]: (restricted bug)
    [https://webkit.org/b/67735 #67735]: (restricted bug)
    [https://webkit.org/b/67748 #67748]: (restricted bug)

27 files changed, 339 insertions, 50 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index 458898a..34446ae 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-a2bd2bb1b19949c6807da38e25bfa7d210bb4b17
+64cce100215c71575f19ca0b090c65fa97d4ba10
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
index 5aec2e3..9cda920 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,28 @@
+2011-05-23  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [SH4] AssemblerLabel does not name a type
+        https://bugs.webkit.org/show_bug.cgi?id=59927
+
+        SH4Assembler.h file shoold be included before AbstractMacroAssembler.h.
+
+        * assembler/MacroAssemblerSH4.h:
+
+2011-06-28  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Warnings in JSC's JIT on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=63259
+
+        Fairly straightforward, just use ASSERT_JIT_OFFSET_UNUSED when it applies.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+
 2011-08-30  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
         [Qt] Do not unconditionally use pkg-config in .pro files
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h b/src/3rdparty/webkit/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
index 5ef7b20..9036f0f 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
@@ -29,8 +29,8 @@
 
 #if ENABLE(ASSEMBLER) && CPU(SH4)
 
-#include "AbstractMacroAssembler.h"
 #include "SH4Assembler.h"
+#include "AbstractMacroAssembler.h"
 #include <wtf/Assertions.h>
 
 namespace JSC {
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index f18e277..c88e9ad 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -225,9 +225,9 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
     move(TrustedImm32(JSValue::CellTag), regT1);
     Jump match = jump();
     
-    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
+    ASSERT_JIT_OFFSET_UNUSED(protoObj, differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
     ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoStructureToCompare), patchOffsetMethodCheckProtoStruct);
-    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, putFunction), patchOffsetMethodCheckPutFunction);
+    ASSERT_JIT_OFFSET_UNUSED(putFunction, differenceBetween(info.structureToCompare, putFunction), patchOffsetMethodCheckPutFunction);
     
     // Link the failure cases here.
     structureCheck.link(this);
@@ -436,9 +436,9 @@ void JIT::compileGetByIdHotPath()
     
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSObject, m_propertyStorage)), regT2);
     DataLabel32 displacementLabel1 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel1), patchOffsetGetByIdPropertyMapOffset1);
+    ASSERT_JIT_OFFSET_UNUSED(displacementLabel1, differenceBetween(hotPathBegin, displacementLabel1), patchOffsetGetByIdPropertyMapOffset1);
     DataLabel32 displacementLabel2 = loadPtrWithAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel2), patchOffsetGetByIdPropertyMapOffset2);
+    ASSERT_JIT_OFFSET_UNUSED(displacementLabel2, differenceBetween(hotPathBegin, displacementLabel2), patchOffsetGetByIdPropertyMapOffset2);
     
     Label putResult(this);
     ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, putResult), patchOffsetGetByIdPutResult);
@@ -514,8 +514,8 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
     
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel1), patchOffsetPutByIdPropertyMapOffset1);
-    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel2), patchOffsetPutByIdPropertyMapOffset2);
+    ASSERT_JIT_OFFSET_UNUSED(displacementLabel1, differenceBetween(hotPathBegin, displacementLabel1), patchOffsetPutByIdPropertyMapOffset1);
+    ASSERT_JIT_OFFSET_UNUSED(displacementLabel2, differenceBetween(hotPathBegin, displacementLabel2), patchOffsetPutByIdPropertyMapOffset2);
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index a781b1f..da9d1b2 100644..100755
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,165 @@
+2011-09-12  Adam Klein  <adamk@chromium.org>
+
+        Fix out-of-bounds access in Gradient::sortStopsIfNecessary
+        https://bugs.webkit.org/show_bug.cgi?id=67958
+
+        Reviewed by Darin Adler.
+
+        Reported by Valgrind in http://crbug.com/77049.
+
+        The errant code was added as an optimization in r67804.
+        This patch reverts that one, as all parties agree that the optimization
+        doesn't seem worthwhile, and there clearly aren't any tests covering
+        the special case.
+
+        No new tests, as existing tests should cover the remaining call to
+        |std::stable_sort|.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::sortStopsIfNecessary):
+
+2011-09-09  Dominic Mazzoni  <dmazzoni@google.com>
+
+        Assert being hit in AccessibilityRenderObject::addChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=61805
+
+        Reviewed by Chris Fleizach.
+
+        Fix nextSibling and previousSibling to handle adjacent continuations
+        properly, otherwise nodes end up appearing in the accessibility
+        tree twice (or a debug assertion could be raised).
+
+        Test: accessibility/adjacent-continuations-cause-assertion-failure.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::previousSibling):
+        (WebCore::AccessibilityRenderObject::nextSibling):
+
+2011-09-08  Abhishek Arya  <inferno@chromium.org>
+
+        :before content rendering issues with list markers and run-ins.
+        https://bugs.webkit.org/show_bug.cgi?id=67735
+
+        1) Remove the isAnonymous checks for run-in detection since the
+        run-in can belong to a node.
+        2) When the parent has block children, then the list marker will
+        be enclosed in an anonymous block. In that case, for going to the
+        next list marker, we need to traverse one level up. We don't need
+        this check when searching for generated run-in (loop 2), since we
+        know parent will have inline children, so the list marker wont be
+        enclosed in an anonymous block.
+
+        Reviewed by Dave Hyatt.
+
+        Tests: fast/lists/list-marker-before-content-table.html
+               fast/runin/runin-generated-before-content.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::beforePseudoElementRenderer):
+
+2011-09-10  Ken Buchanan <kenrb@chromium.org>
+
+        Crash due to bad data in SVGDocumentExtensions m_pendingResources
+        https://bugs.webkit.org/show_bug.cgi?id=67488
+
+        Reviewed by Nikolas Zimmermann.
+
+        Resolving a crash condition caused by the deletion of
+        elements while pending resource entries for those elements are still
+        recorded.
+
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::registerResource)
+        * svg/SVGDocumentExtensions.h:
+        (WebCore::SVGDocumentExtensions::isElementInPendingResources)
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::addPendingResource)
+        (WebCore::SVGDocumentExtensions::isElementInPendingResources)
+        (WebCore::SVGDocumentExtensions::removeElementFromPendingResources)
+        * svg/SVGStyledElement.h:
+        (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible)
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::buildPendingResourcesIfNeeded)
+        (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible)
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged)
+
+2011-09-08  Alexey Proskuryakov  <ap@apple.com>
+
+        REGRESSION (r66874): Missing RefPtr in ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=67748
+
+        Reviewed by Adam Barth.
+
+        * bindings/ScriptControllerBase.cpp: (WebCore::ScriptController::executeScript):
+
+2011-09-06  Abhishek Arya  <inferno@chromium.org>
+
+        Style not propagated to anonymous boxes and anonymous
+        inline-blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=67364
+
+        Reviewed by James Robinson.
+
+        Share propagateStyleToAnonymousChildren with RenderBlock::styleDidChange.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren):
+        * rendering/RenderObject.h:
+
+2011-09-04  Abhishek Arya  <inferno@chromium.org>
+
+        Style not propagated to anonymous boxes and anonymous
+        inline-blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=67364
+
+        Reviewed by James Robinson.
+
+        Tests: fast/ruby/ruby-block-style-not-updated-with-before-after-content.html
+               fast/ruby/ruby-block-style-not-updated.html
+               fast/ruby/ruby-inline-style-not-updated-with-before-after-content.html
+               fast/ruby/ruby-inline-style-not-updated.html
+               fast/table/table-row-style-not-updated-with-after-content.html
+               fast/table/table-row-style-not-updated-with-before-content.html
+               fast/table/table-row-style-not-updated.html
+               fast/table/table-style-not-updated.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::propagateStyleToAnonymousChildren):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBeforeAfterContent):
+        * rendering/RenderRuby.cpp:
+        (WebCore::RenderRubyAsInline::styleDidChange):
+        (WebCore::RenderRubyAsBlock::styleDidChange):
+        * rendering/RenderRuby.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange):
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::styleDidChange):
+        (WebCore::RenderTableSection::addChild):
+        * rendering/RenderTableSection.h:
+
+2011-09-05  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in RenderObjectChildList::destroyLeftOverChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=64753
+
+        Reviewed by James Robinson.
+
+        If any of the ancestors between column span element and containing
+        column's block is a continuation, then don't attempt to render the
+        column span by splitting the block into continuations.
+
+        Test: fast/multicol/column-span-parent-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+
 2011-08-30  Abhishek Arya  <inferno@chromium.org>
 
         Removed m_owner accessed in custom scrollbars.
diff --git a/src/3rdparty/webkit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 25078c5..9725a6b 100644
--- a/src/3rdparty/webkit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -302,8 +302,12 @@ AccessibilityObject* AccessibilityRenderObject::previousSibling() const
 
     // Case 2: Anonymous block parent of the end of a continuation - skip all the way to before
     // the parent of the start, since everything in between will be linked up via the continuation.
-    else if (m_renderer->isAnonymousBlock() && firstChildIsInlineContinuation(m_renderer))
-        previousSibling = startOfContinuations(m_renderer->firstChild())->parent()->previousSibling();
+    else if (m_renderer->isAnonymousBlock() && firstChildIsInlineContinuation(m_renderer)) {
+        RenderObject* firstParent = startOfContinuations(m_renderer->firstChild())->parent();
+        while (firstChildIsInlineContinuation(firstParent))
+            firstParent = startOfContinuations(firstParent->firstChild())->parent();
+        previousSibling = firstParent->previousSibling();
+    }
 
     // Case 3: The node has an actual previous sibling
     else if (RenderObject* ps = m_renderer->previousSibling())
@@ -340,8 +344,12 @@ AccessibilityObject* AccessibilityRenderObject::nextSibling() const
 
     // Case 2: Anonymous block parent of the start of a continuation - skip all the way to
     // after the parent of the end, since everything in between will be linked up via the continuation.
-    else if (m_renderer->isAnonymousBlock() && lastChildHasContinuation(m_renderer))
-        nextSibling = endOfContinuations(m_renderer->lastChild())->parent()->nextSibling();
+    else if (m_renderer->isAnonymousBlock() && lastChildHasContinuation(m_renderer)) {
+        RenderObject* lastParent = endOfContinuations(m_renderer->lastChild())->parent();
+        while (lastChildHasContinuation(lastParent))
+            lastParent = endOfContinuations(lastParent->lastChild())->parent();
+        nextSibling = lastParent->nextSibling();
+    }
 
     // Case 3: node has an actual next sibling
     else if (RenderObject* ns = m_renderer->nextSibling())
diff --git a/src/3rdparty/webkit/Source/WebCore/bindings/ScriptControllerBase.cpp b/src/3rdparty/webkit/Source/WebCore/bindings/ScriptControllerBase.cpp
index 4190637..254a6c2 100644
--- a/src/3rdparty/webkit/Source/WebCore/bindings/ScriptControllerBase.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/bindings/ScriptControllerBase.cpp
@@ -59,6 +59,8 @@ ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
     bool wasInExecuteScript = m_inExecuteScript;
     m_inExecuteScript = true;
 
+    RefPtr<Frame> protect(m_frame); // Script execution can destroy the frame, and thus the ScriptController.
+
     ScriptValue result = evaluate(sourceCode);
 
     if (!wasInExecuteScript) {
diff --git a/src/3rdparty/webkit/Source/WebCore/platform/graphics/Gradient.cpp b/src/3rdparty/webkit/Source/WebCore/platform/graphics/Gradient.cpp
index 7e3984f..fc7b741 100644
--- a/src/3rdparty/webkit/Source/WebCore/platform/graphics/Gradient.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/platform/graphics/Gradient.cpp
@@ -124,10 +124,6 @@ void Gradient::sortStopsIfNecessary()
     if (!m_stops.size())
         return;
 
-    // Shortcut for the ideal case (ordered 2-stop gradient)
-    if (m_stops.size() == 2 && compareStops(*m_stops.begin(), *m_stops.end()))
-        return;
-
     std::stable_sort(m_stops.begin(), m_stops.end(), compareStops);
 }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
index df30adb..4ad1bfe 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
@@ -241,21 +241,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
         }
     }
 
-    // FIXME: We could save this call when the change only affected non-inherited properties
-    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->isAnonymousBlock()) {
-            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
-            if (style()->specifiesColumns()) {
-                if (child->style()->specifiesColumns())
-                    newStyle->inheritColumnPropertiesFrom(style());
-                if (child->style()->columnSpan())
-                    newStyle->setColumnSpan(true);
-            }
-            newStyle->setDisplay(BLOCK);
-            child->setStyle(newStyle.release());
-        }
-    }
-
+    propagateStyleToAnonymousChildren(true);    
     m_lineHeight = -1;
 
     // Update pseudos for :before and :after now.
@@ -654,8 +640,22 @@ RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
         && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
         if (style()->specifiesColumns())
             columnsBlockAncestor = this;
-        else if (!isInline() && parent() && parent()->isRenderBlock())
+        else if (!isInline() && parent() && parent()->isRenderBlock()) {
             columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
+            
+            if (columnsBlockAncestor) {
+                // Make sure that none of the parent ancestors have a continuation.
+                // If yes, we do not want split the block into continuations.
+                RenderObject* curr = this;
+                while (curr && curr != columnsBlockAncestor) {
+                    if (curr->isRenderBlock() && toRenderBlock(curr)->continuation()) {
+                        columnsBlockAncestor = 0;
+                        break;
+                    }
+                    curr = curr->parent();
+                }
+            }
+        }
     }
     return columnsBlockAncestor;
 }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.cpp
index a81e668..c1f5ba0 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.cpp
@@ -1811,6 +1811,24 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderObject::propagateStyleToAnonymousChildren(bool blockChildrenOnly)
+{
+    // FIXME: We could save this call when the change only affected non-inherited properties.
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        if (blockChildrenOnly ? child->isAnonymousBlock() : child->isAnonymous() && !child->isBeforeOrAfterContent()) {
+            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
+            if (style()->specifiesColumns()) {
+                if (child->style()->specifiesColumns())
+                    newStyle->inheritColumnPropertiesFrom(style());
+                if (child->style()->columnSpan())
+                    newStyle->setColumnSpan(true);
+            }
+            newStyle->setDisplay(blockChildrenOnly ? BLOCK : child->style()->display());
+            child->setStyle(newStyle.release());
+        }
+    }
+}
+
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
 {
     // Optimize the common case
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.h
index 44ee43c..2ba0114 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObject.h
@@ -322,8 +322,10 @@ public:
 
     inline bool isBeforeContent() const;
     inline bool isAfterContent() const;
+    inline bool isBeforeOrAfterContent() const;
     static inline bool isBeforeContent(const RenderObject* obj) { return obj && obj->isBeforeContent(); }
     static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
+    static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
 
     bool childrenInline() const { return m_childrenInline; }
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
@@ -791,6 +793,7 @@ protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     // Overrides should call the superclass at the start
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+    void propagateStyleToAnonymousChildren(bool blockChildrenOnly = false);
 
     void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2, bool antialias = false);
@@ -932,6 +935,11 @@ inline bool RenderObject::isAfterContent() const
     return true;
 }
 
+inline bool RenderObject::isBeforeOrAfterContent() const
+{
+    return isBeforeContent() || isAfterContent();
+}
+
 inline void RenderObject::setNeedsLayout(bool b, bool markParents)
 {
     bool alreadyNeededLayout = m_needsLayout;
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
index a6c2da9..28703c5 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -271,7 +271,12 @@ RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObj
     do {
         // Skip list markers and generated run-ins
         first = first->firstChild();
-        while (first && (first->isListMarker() || (first->isRenderInline() && first->isRunIn() && first->isAnonymous())))
+        while (first && first->isListMarker()) {
+            if (first->parent() != owner && first->parent()->isAnonymousBlock())
+                first = first->parent();
+            first = first->nextSibling();
+        }
+        while (first && first->isRenderInline() && first->isRunIn())
             first = first->nextSibling();
     } while (first && first->isAnonymous() && first->style()->styleType() == NOPSEUDO);
 
@@ -293,7 +298,7 @@ RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObj
         // We still need to skip any list markers that could exist before the run-in.
         while (first && first->isListMarker())
             first = first->nextSibling();
-        if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn() && first->isAnonymous())
+        if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn())
             return first;
     }
     return 0;
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.cpp
index e0137de..41604d6 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.cpp
@@ -119,6 +119,12 @@ RenderRubyAsInline::~RenderRubyAsInline()
 {
 }
 
+void RenderRubyAsInline::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderInline::styleDidChange(diff, oldStyle);
+    propagateStyleToAnonymousChildren();
+}
+
 void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Insert :before and :after content before/after the RenderRubyRun(s)
@@ -220,6 +226,12 @@ RenderRubyAsBlock::~RenderRubyAsBlock()
 {
 }
 
+void RenderRubyAsBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBlock::styleDidChange(diff, oldStyle);
+    propagateStyleToAnonymousChildren();
+}
+
 void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Insert :before and :after content before/after the RenderRubyRun(s)
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.h b/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.h
index 24ac0db..2ab964c 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.h
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderRuby.h
@@ -59,6 +59,9 @@ public:
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
 
+protected:
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
 private:
     virtual bool isRuby() const { return true; }
     virtual const char* renderName() const { return "RenderRuby (inline)"; }
@@ -75,6 +78,9 @@ public:
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject* child);
 
+protected:
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
 private:
     virtual bool isRuby() const { return true; }
     virtual const char* renderName() const { return "RenderRuby (block)"; }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTable.cpp
index 4e90ffc..73b0801 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTable.cpp
@@ -73,6 +73,7 @@ RenderTable::~RenderTable()
 void RenderTable::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
+    propagateStyleToAnonymousChildren();
 
     ETableLayout oldTableLayout = oldStyle ? oldStyle->tableLayout() : TAUTO;
 
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
index dd44577..686bc3a 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
@@ -74,10 +74,10 @@ void RenderTableRow::updateBeforeAndAfterContent()
 void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
+    propagateStyleToAnonymousChildren();
 
     if (parent())
         updateBeforeAndAfterContent();
-
 }
 
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
@@ -90,7 +90,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous() && last->isTableCell() && !isAfterContent(last) && !isBeforeContent(last)) {
+        if (last && last->isAnonymous() && last->isTableCell() && !last->isBeforeOrAfterContent()) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -98,7 +98,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         }
 
         // If beforeChild is inside an anonymous cell, insert into the cell.
-        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous() && !isAfterContent(last->parent()) && !isBeforeContent(last->parent())) {
+        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
             last->parent()->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
index 3f84404..7d414a0 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
@@ -74,6 +74,12 @@ RenderTableSection::~RenderTableSection()
     clearGrid();
 }
 
+void RenderTableSection::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBox::styleDidChange(diff, oldStyle);
+    propagateStyleToAnonymousChildren();
+}
+
 void RenderTableSection::destroy()
 {
     RenderTable* recalcTable = table();
@@ -96,7 +102,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous() && !isAfterContent(last) && !isBeforeContent(last)) {
+        if (last && last->isAnonymous() && !last->isBeforeOrAfterContent()) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -108,7 +114,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* lastBox = last;
         while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableRow())
             lastBox = lastBox->parent();
-        if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox) && !isBeforeContent(lastBox)) {
+        if (lastBox && lastBox->isAnonymous() && !lastBox->isBeforeOrAfterContent()) {
             lastBox->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.h b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.h
index cc969e8..db6edc2 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.h
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.h
@@ -118,6 +118,9 @@ public:
 
     int getBaseline(int row) { return m_grid[row].baseline; }
 
+protected:
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 79e8e1e..db4027b 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -168,7 +168,7 @@ void RenderSVGResourceContainer::registerResource()
     const SVGDocumentExtensions::SVGPendingElements::const_iterator end = clients->end();
     for (SVGDocumentExtensions::SVGPendingElements::const_iterator it = clients->begin(); it != end; ++it) {
         ASSERT((*it)->hasPendingResources());
-        (*it)->setHasPendingResources(false);
+        (*it)->clearHasPendingResourcesIfPossible();
         RenderObject* renderer = (*it)->renderer();
         if (!renderer)
             continue;
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.cpp b/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.cpp
index d74f646..4b339ca 100644..100755
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -227,7 +227,7 @@ void SVGDocumentExtensions::addPendingResource(const AtomicString& id, SVGStyled
         m_pendingResources.add(id, set);
     }
 
-    element->setHasPendingResources(true);
+    element->setHasPendingResources();
 }
 
 bool SVGDocumentExtensions::hasPendingResources(const AtomicString& id) const
@@ -238,6 +238,24 @@ bool SVGDocumentExtensions::hasPendingResources(const AtomicString& id) const
     return m_pendingResources.contains(id);
 }
 
+bool SVGDocumentExtensions::isElementInPendingResources(SVGStyledElement* element) const
+{
+    ASSERT(element);
+
+    if (m_pendingResources.isEmpty())
+        return false;
+
+    HashMap<AtomicString, SVGPendingElements*>::const_iterator end = m_pendingResources.end();
+    for (HashMap<AtomicString, SVGPendingElements*>::const_iterator it = m_pendingResources.begin(); it != end; ++it) {
+        SVGPendingElements* elements = it->second;
+        ASSERT(elements);
+
+        if (elements->contains(element))
+            return true;
+    }
+    return false;
+}
+
 void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement* element)
 {
     ASSERT(element);
@@ -245,8 +263,6 @@ void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement*
     if (m_pendingResources.isEmpty() || !element->hasPendingResources())
         return;
 
-    element->setHasPendingResources(false);
-
     Vector<AtomicString> toBeRemoved;
     HashMap<AtomicString, SVGPendingElements*>::iterator end = m_pendingResources.end();
     for (HashMap<AtomicString, SVGPendingElements*>::iterator it = m_pendingResources.begin(); it != end; ++it) {
@@ -259,6 +275,8 @@ void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement*
             toBeRemoved.append(it->first);
     }
 
+    element->clearHasPendingResourcesIfPossible();
+
     if (toBeRemoved.isEmpty())
         return;
 
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.h b/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.h
index a66b066..8ad44f8 100644..100755
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.h
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGDocumentExtensions.h
@@ -81,6 +81,7 @@ public:
     // For instance, dynamically build gradients / patterns / clippers...
     void addPendingResource(const AtomicString& id, SVGStyledElement*);
     bool hasPendingResources(const AtomicString& id) const;
+    bool isElementInPendingResources(SVGStyledElement*) const;
     void removeElementFromPendingResources(SVGStyledElement*);
     PassOwnPtr<SVGPendingElements> removePendingResource(const AtomicString& id);
 };
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.cpp b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.cpp
index c1a6449..0693eb0 100644..100755
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.cpp
@@ -380,7 +380,7 @@ void SVGStyledElement::insertedIntoDocument()
     for (SVGDocumentExtensions::SVGPendingElements::const_iterator it = clients->begin(); it != end; ++it) {
         ASSERT((*it)->hasPendingResources());
         (*it)->buildPendingResource();
-        (*it)->setHasPendingResources(false);
+        (*it)->clearHasPendingResourcesIfPossible();
     }
 }
 
@@ -453,9 +453,15 @@ bool SVGStyledElement::hasPendingResources() const
     return hasRareSVGData() && rareSVGData()->hasPendingResources();
 }
 
-void SVGStyledElement::setHasPendingResources(bool value)
+void SVGStyledElement::setHasPendingResources()
 {
-    ensureRareSVGData()->setHasPendingResources(value);
+    ensureRareSVGData()->setHasPendingResources(true);
+}
+
+void SVGStyledElement::clearHasPendingResourcesIfPossible()
+{
+    if (!document()->accessSVGExtensions()->isElementInPendingResources(this))
+        ensureRareSVGData()->setHasPendingResources(false);
 }
 
 AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CTMScope) const
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.h b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.h
index f48513c..fdad347 100644..100755
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.h
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyledElement.h
@@ -53,7 +53,8 @@ public:
     void setInstanceUpdatesBlocked(bool);
 
     bool hasPendingResources() const;
-    void setHasPendingResources(bool);
+    void setHasPendingResources();
+    void clearHasPendingResourcesIfPossible();
 
     AnimatedAttributeType animatedPropertyTypeForCSSProperty(const QualifiedName&);
     static bool isAnimatableCSSProperty(const QualifiedName&);
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGUseElement.cpp b/src/3rdparty/webkit/Source/WebCore/svg/SVGUseElement.cpp
index d8f9674..7de1f4c 100644
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGUseElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGUseElement.cpp
@@ -172,11 +172,11 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
             const SVGDocumentExtensions::SVGPendingElements::const_iterator end = clients->end();
             for (SVGDocumentExtensions::SVGPendingElements::const_iterator it = clients->begin(); it != end; ++it) {
                 ASSERT((*it)->hasPendingResources());
-                (*it)->setHasPendingResources(false);
+                (*it)->clearHasPendingResourcesIfPossible();
             }
 
             m_resourceId = String();
-            setHasPendingResources(false);
+            clearHasPendingResourcesIfPossible();
         }
 
         invalidateShadowTree();
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
index 4758de0..32428f1 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,13 @@
+2011-09-06  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        [Qt][Symbian] REGRESSION[94105] DumpRenderTree.exe doesn't build on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=67644
+
+        Reviewed by Csaba Osztrogonác.
+
+        * symbian/eabi/QtWebKitu.def: add missing entry for
+        FrameLoaderClientQt::dumpProgressFinishedCallback(bool)
+
 2011-08-31  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
 
         [Qt] Unskip API test for load signals order
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
index 0a1c6cb..b67d3f8 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -880,3 +880,4 @@ EXPORTS
 	_ZN8QDRTNodeaSERKS_ @ 879 NONAME

 	_ZN23DumpRenderTreeSupportQt21injectInternalsObjectEP9QWebFrame @ 880 NONAME

 	_ZN23DumpRenderTreeSupportQt20resetInternalsObjectEP9QWebFrame @ 881 NONAME

+	_ZN23DumpRenderTreeSupportQt28dumpProgressFinishedCallbackEb @ 882 NONAME

diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index aeaa22c..6a40345 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        a2bd2bb1b19949c6807da38e25bfa7d210bb4b17
+        64cce100215c71575f19ca0b090c65fa97d4ba10