Updated WebKit to b4aa5e1ddc41edab895132aba3cc66d9d7129444

Integrated changes:

|| <https://webkit.org/b/38747> || mingw-w64 and JIT support ||
|| <https://webkit.org/b/38119> || [Qt] QWebPage viewMode property ||
|| <https://webkit.org/b/37097> || [Qt] Fix infinite redirection loop in QNetworkReplyHandler ||
|| <https://webkit.org/b/38668> || [Qt] Enable YARR_JIT for X86 Mac for QtWebKit ||
|| <https://webkit.org/b/38834> || [Qt] Adapt DNS pre-fetching to Qt DNS cache code ||
|| <https://webkit.org/b/38574> || [Qt] Crash in QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate when animation were used ||
|| <https://webkit.org/b/31407> || [PATCH] [Qt] Compilation with Plugins disabled is broken ||
|| <https://webkit.org/b/38514> || Crash in handleTouchEvent: using dangling node ptrs in hashmap ||
|| <https://webkit.org/b/38646> || Potential crash in EventHandler::handleTouchEvent ||
|| <https://webkit.org/b/38488> || Spatial Navigation: create a getter for the "fudgeFactor" ||
|| <https://webkit.org/b/38523> || [Qt] QtWebKit has render bugs on Google Maps markers ||
|| <https://webkit.org/b/37276> || LayoutTests/fast/canvas/pointInPath.html passed, actually it failed ||
|| <https://webkit.org/b/37023> || [Qt] Expose HTMLTokenizer yielding parameters ||

23 files changed, 386 insertions, 50 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index 75fc5e7..65cfdda 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-b4aa5e1ddc41edab895132aba3cc66d9d7129444
+dc5821c3df2ef60456d85263160852f5335cf946
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 1439ae0..97176ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,26 @@
+2010-05-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Disable JIT support for mingw-w64
+        https://bugs.webkit.org/show_bug.cgi?id=38747
+
+        Disale JIT for mingw-w64 as it is reportedly
+        unstable.
+
+        Thanks for Vanboxem Rruben for the investigation.
+
+        * wtf/Platform.h:
+
+2010-05-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable YARR_JIT for X86 Mac for QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=38668
+
+        * wtf/Platform.h:
+
 2010-05-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Eric Seidel.
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index c582905..8d98765 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -927,8 +927,6 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #elif CPU(X86) && OS(WINDOWS) && COMPILER(MINGW) && GCC_VERSION >= 40100
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-#elif CPU(X86_64) && OS(WINDOWS) && COMPILER(MINGW64) && GCC_VERSION >= 40100
-    #define ENABLE_JIT 1
 #elif CPU(X86) && OS(WINDOWS) && COMPILER(MSVC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
@@ -1011,7 +1009,9 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
     || (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100) \
     || (CPU(ARM_TRADITIONAL) && OS(LINUX)) \
     || (CPU(ARM_TRADITIONAL) && OS(SYMBIAN) && COMPILER(RVCT)) \
-    || (CPU(MIPS) && OS(LINUX))
+    || (CPU(MIPS) && OS(LINUX)) \
+    || (CPU(X86) && OS(DARWIN)) \
+    || (CPU(X86_64) && OS(DARWIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
 #endif
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 98debf6..24f855b 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        07b60cf799680fcfb7785ee88e14f8030a5dbfa2
+        b4aa5e1ddc41edab895132aba3cc66d9d7129444
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 6617b66..ee42878 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,166 @@
+2010-05-03  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Kenneth Christiansen.
+
+        Spatial Navigation: create a getter for the "fudgeFactor"
+        https://bugs.webkit.org/show_bug.cgi?id=38488
+
+        A couple of places in the Spatial Navigation code make use of a "fudge factor"
+        to improve precision by working around outline focus metrics and such. Patch adds
+        a helper method for unify getter operations of this value, instead of having it
+        declared locally in the various methods it is used.
+
+        No behaviour change.
+
+        * page/SpatialNavigation.cpp:
+        (WebCore::scrollIntoView):
+        (WebCore::deflateIfOverlapped):
+        * page/SpatialNavigation.h:
+        (WebCore::fudgeFactor):
+
+2010-05-10  Markus Goetz  <Markus.Goetz@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Qt after 4.6.3 has its integrated DNS cache. Therefore some
+        code is not necessary anymore.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38834
+
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookup):
+        (WebCore::DnsPrefetchHelper::lookedUp):
+
+2010-05-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix WinCE for QtWebKit.
+
+        [Qt] Compilation with Plugins disabled is broken
+        https://bugs.webkit.org/show_bug.cgi?id=31407
+
+        Rename platform/qt/TemporaryLinkStubs.cpp to avoid name collition on
+        Windows.
+
+        Thanks for Ismail "cartman" Donmez for help.
+
+        No new tests, as there is no new functionality.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp: Removed.
+        * platform/qt/TemporaryLinkStubsQt.cpp: Copied from WebCore/platform/qt/TemporaryLinkStubs.cpp.
+
+2010-04-23  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] LayoutTests/fast/canvas/pointInPath.html passed, actually it failed
+        https://bugs.webkit.org/show_bug.cgi?id=37276
+
+        QPainterPath::contains doesn't count the point on the bound.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::isPointOnPathBorder):
+        (WebCore::Path::contains):
+
+2010-05-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix rendering of -webkit-user-select: none
+
+        -webkit-user-select: none is implemented by filling
+        the area with an invalid default-constructed Color.
+        In most ports passing an invalid color down to the
+        graphics backend seems to produce transparent fills.
+
+        In Qt the behavior of painting with an invalid QColor
+        is undefined, and in practice it results in painting
+        black opaque areas.
+
+        One way to fix this would be to use Qt::transparent
+        when converting an undefined Color to a QColor, but
+        Qt does not have short circuits for fully transparent
+        painting, and we actually end up in slow code paths
+        due to the transparency. So, we're better of doing the
+        short circuit in WebKit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38523
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2010-04-05  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix infinite redirection loop in QNetworkReplyHandler
+
+        Put a maximum on consecutive redirections so we don't have to
+        worry about whether it's the same url or not.
+
+        Tolerate up to 10 consecutive redirections, anything beyond
+        that is considered a potentially infinite recursion in the
+        redirection requests. This is the same behaviour as Firefox.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37097
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2010-04-05  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde-Christiansen.
+
+        [Qt] Fix infinite redirection loop in QNetworkReplyHandler
+
+        Qt enters an infinite loop if a redirect response redirects to itself.
+
+        Fixes http/tests/xmlhttprequest/connection-error-sync.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=37097
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2010-05-07  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Potential crash in EventHandler::handleTouchEvent
+        https://bugs.webkit.org/show_bug.cgi?id=38646
+
+        Fix a ref counting bug that can cause a crash if the m_originatingouchPointTargets
+        hashmap holds the last ref to an EventTarget when the user lifts their finger.
+
+        This is very hard to reproduce in a consistent way and clearly a
+        simple logic error in the code, therefore no new tests.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTouchEvent): Don't let the RefPtr we get back from
+            the hasmap go out of scope so soon as it could delete the wrapped ptr if the
+            hashmap held the last ref (and we use the raw ptr that the RefPtr
+            wraps later in the WebCore::Touch constructor).
+
+2010-05-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Simon Hausmann.
+
+        Crash in handleTouchEvent: using dangling node ptrs in hashmap
+        https://bugs.webkit.org/show_bug.cgi?id=38514
+
+        When navigating away from a page, if you have your finger still
+        pressed and then lift it on the new page we see a crash if the
+        node got deleted as we still have a dangling pointer in the
+        m_originatingTouchPointTargets hashmap and try to use it as the
+        receiver to dispatch a touchend event.
+
+        Test: fast/events/touch/touch-stale-node-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear): Clear the hashmap of touch targets.
+
 2010-05-04  Luiz Agostini  <luiz.agostini@openbossa.org>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebCore/WebCore.gypi b/src/3rdparty/webkit/WebCore/WebCore.gypi
index caa79f2..701ad90 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/WebCore/WebCore.gypi
@@ -2640,7 +2640,7 @@
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
-            'platform/qt/TemporaryLinkStubs.cpp',
+            'platform/qt/TemporaryLinkStubsQt.cpp',
             'platform/qt/WheelEventQt.cpp',
             'platform/qt/WidgetQt.cpp',
             'platform/sql/SQLValue.cpp',
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index beeb529..e42cd8e 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -2081,7 +2081,7 @@ SOURCES += \
     platform/qt/SoundQt.cpp \
     platform/qt/LoggingQt.cpp \
     platform/text/qt/StringQt.cpp \
-    platform/qt/TemporaryLinkStubs.cpp \
+    platform/qt/TemporaryLinkStubsQt.cpp \
     platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
     platform/text/qt/TextCodecQt.cpp \
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 0a0e8c6..46dd7ae 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -230,6 +230,9 @@ void EventHandler::clear()
     m_capturingMouseEventsNode = 0;
     m_latchedWheelEventNode = 0;
     m_previousWheelScrolledNode = 0;
+#if ENABLE(TOUCH_EVENTS)
+    m_originatingTouchPointTargets.clear();
+#endif
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -2714,21 +2717,21 @@ bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
 
         // Increment the platform touch id by 1 to avoid storing a key of 0 in the hashmap.
         unsigned touchPointTargetKey = point.id() + 1;
-        EventTarget* touchTarget = 0;
+        RefPtr<EventTarget> touchTarget;
         if (point.state() == PlatformTouchPoint::TouchPressed) {
             m_originatingTouchPointTargets.set(touchPointTargetKey, target);
             touchTarget = target;
         } else if (point.state() == PlatformTouchPoint::TouchReleased || point.state() == PlatformTouchPoint::TouchCancelled) {
             // The target should be the original target for this touch, so get it from the hashmap. As it's a release or cancel
             // we also remove it from the map.
-            touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey).get();
+            touchTarget = m_originatingTouchPointTargets.take(touchPointTargetKey);
         } else
-            touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey).get();
+            touchTarget = m_originatingTouchPointTargets.get(touchPointTargetKey);
 
-        if (!touchTarget)
+        if (!touchTarget.get())
             continue;
 
-        RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget, point.id(),
+        RefPtr<Touch> touch = Touch::create(doc->frame(), touchTarget.get(), point.id(),
                                             point.screenPos().x(), point.screenPos().y(),
                                             adjustedPageX, adjustedPageY);
 
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
index 890eacd..d7eaf25 100644
--- a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.cpp
@@ -477,9 +477,8 @@ void scrollIntoView(Element* element)
     // it is preferable to inflate |element|'s bounding rect a bit before
     // scrolling it for accurate reason.
     // Element's scrollIntoView method does not provide this flexibility.
-    static const int fudgeFactor = 2;
     IntRect bounds = element->getRect();
-    bounds.inflate(fudgeFactor);
+    bounds.inflate(fudgeFactor());
     element->renderer()->enclosingLayer()->scrollRectToVisible(bounds);
 }
 
@@ -497,14 +496,14 @@ static void deflateIfOverlapped(IntRect& a, IntRect& b)
     if (!a.intersects(b) || a.contains(b) || b.contains(a))
         return;
 
-    static const int fudgeFactor = -2;
+    int deflateFactor = -fudgeFactor();
 
     // Avoid negative width or height values.
-    if ((a.width() + 2 * fudgeFactor > 0) && (a.height() + 2 * fudgeFactor > 0))
-        a.inflate(fudgeFactor);
+    if ((a.width() + 2 * deflateFactor > 0) && (a.height() + 2 * deflateFactor > 0))
+        a.inflate(deflateFactor);
 
-    if ((b.width() + 2 * fudgeFactor > 0) && (b.height() + 2 * fudgeFactor > 0))
-        b.inflate(fudgeFactor);
+    if ((b.width() + 2 * deflateFactor > 0) && (b.height() + 2 * deflateFactor > 0))
+        b.inflate(deflateFactor);
 }
 
 static bool checkNegativeCoordsForNode(Node* node, const IntRect& curRect)
diff --git a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
index 90ff1cf..309b095 100644
--- a/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
+++ b/src/3rdparty/webkit/WebCore/page/SpatialNavigation.h
@@ -40,6 +40,11 @@ inline long long maxDistance()
     return numeric_limits<long long>::max();
 }
 
+inline unsigned int fudgeFactor()
+{
+    return 2;
+}
+
 // Spatially speaking, two given elements in a web page can be:
 // 1) Fully aligned: There is a full intersection between the rects, either
 //    vertically or horizontally.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index edac268..0100b72 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -641,12 +641,12 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     }
 }
 
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace colorSpace)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || !color.isValid())
         return;
 
-    m_data->solidColor.setColor(c);
+    m_data->solidColor.setColor(color);
     QPainter* p = m_data->p();
     if (m_common->state.shadowColor.isValid())
         drawBorderlessRectShadow(this, p, rect);
@@ -655,7 +655,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c, ColorSpace
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
-    if (paintingDisabled() || !color.alpha())
+    if (paintingDisabled() || !color.isValid() || !color.alpha())
         return;
 
     Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
@@ -717,7 +717,7 @@ void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int of
  */
 void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int /* width */, int /* offset */, const Color& color)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || !color.isValid())
         return;
 
     unsigned rectCount = rects.size();
@@ -1141,8 +1141,9 @@ void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
 
 void GraphicsContext::setPlatformStrokeColor(const Color& color, ColorSpace colorSpace)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || !color.isValid())
         return;
+
     QPainter* p = m_data->p();
     QPen newPen(p->pen());
     m_data->solidColor.setColor(color);
@@ -1172,8 +1173,9 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 
 void GraphicsContext::setPlatformFillColor(const Color& color, ColorSpace colorSpace)
 {
-    if (paintingDisabled())
+    if (paintingDisabled() || !color.isValid())
         return;
+
     m_data->solidColor.setColor(color);
     m_data->p()->setBrush(m_data->solidColor);
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index ee4af7f..4b0c21f 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -69,12 +69,41 @@ Path& Path::operator=(const Path& other)
     return *this;
 }
 
+// Check whether a point is on the border
+bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
+{
+    QPointF p1 = border.at(0);
+    QPointF p2;
+
+    for (int i = 1; i < border.size(); ++i) {
+        p2 = border.at(i);
+        //  (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2)  && (y2-y1)(x-x1) == (y-y1)(x2-x1)
+        //  In which, (y2-y1)(x-x1) == (y-y1)(x2-x1) is from (y2-y1)/(x2-x1) == (y-y1)/(x-x1)
+        //  it want to check the slope between p1 and p2 is same with slope between p and p1,
+        //  if so then the three points lie on the same line.
+        //  In which, (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2) want to make sure p is
+        //  between p1 and p2, not outside.
+        if (((p.x() <= p1.x() && p.x() >= p2.x()) || (p.x() >= p1.x() && p.x() <= p2.x()))
+            && ((p.y() <= p1.y() && p.y() >= p2.y()) || (p.y() >= p1.y() && p.y() <= p2.y()))
+            && (p2.y() - p1.y()) * (p.x() - p1.x()) == (p.y() - p1.y()) * (p2.x() - p1.x())) {
+            return true;
+        }
+        p1 = p2;
+    }
+    return false;
+}
+
 bool Path::contains(const FloatPoint& point, WindRule rule) const
 {
     Qt::FillRule savedRule = m_path.fillRule();
     const_cast<QPainterPath*>(&m_path)->setFillRule(rule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
 
     bool contains = m_path.contains(point);
+    
+    if (!contains) {
+        // check whether the point is on the border
+        contains = isPointOnPathBorder(m_path.toFillPolygon(), point);
+    }
 
     const_cast<QPainterPath*>(&m_path)->setFillRule(savedRule);
     return contains;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
index 0d98fcb..e355025 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -42,6 +42,13 @@ namespace WebCore {
             if (currentLookups >= 10)
                 return; // do not launch more than 10 lookups at the same time
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 3)
+            currentLookups++;
+            QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
+#else
+            // This code is only needed for Qt versions that do not have
+            // the small Qt DNS cache yet.
+
             QTime* entryTime = lookupCache.object(hostname);
             if (entryTime && entryTime->elapsed() > 300*1000) {
                 // delete knowledge about lookup if it is already 300 seconds old
@@ -54,6 +61,7 @@ namespace WebCore {
                 currentLookups++;
                 QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
             }
+#endif
         }
 
         void lookedUp(const QHostInfo&)
@@ -61,11 +69,14 @@ namespace WebCore {
             // we do not cache the result, we throw it away.
             // we currently rely on the OS to cache the results. If it does not do that
             // then at least the ISP nameserver did it.
+            // Since Qt 4.6.3, Qt also has a small DNS cache.
             currentLookups--;
         }
 
     protected:
+#if QT_VERSION < QT_VERSION_CHECK(4, 6, 3)
         QCache<QString, QTime> lookupCache; // 100 entries
+#endif
         int currentLookups;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 403718f..abeb895 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -49,6 +49,7 @@
 #define SIGNAL_CONN Qt::QueuedConnection
 #endif
 
+static const int gMaxRecursionLimit = 10;
 
 namespace WebCore {
 
@@ -139,6 +140,7 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
     , m_shouldFinish(false)
     , m_shouldSendResponse(false)
     , m_shouldForwardData(false)
+    , m_redirectionTries(gMaxRecursionLimit)
 {
     const ResourceRequest &r = m_resourceHandle->request();
 
@@ -336,9 +338,18 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
+        QUrl newUrl = m_reply->url().resolved(redirection);
+
+        m_redirectionTries--;
+        if (m_redirectionTries == 0) { // 10 or more redirections to the same url is considered infinite recursion
+            ResourceError error(newUrl.host(), 400 /*bad request*/,
+                                newUrl.toString(),
+                                QCoreApplication::translate("QWebPage", "Redirection limit reached"));
+            client->didFail(m_resourceHandle, error);
+            return;
+        }
         m_redirected = true;
 
-        QUrl newUrl = m_reply->url().resolved(redirection);
         ResourceRequest newRequest = m_resourceHandle->request();
         newRequest.setURL(newUrl);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
index eb5ae3c..1abad4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -82,6 +82,7 @@ private:
     bool m_shouldFinish;
     bool m_shouldSendResponse;
     bool m_shouldForwardData;
+    int m_redirectionTries;
 };
 
 // Self destructing QIODevice for FormData
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
index 814f961..814f961 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/TemporaryLinkStubsQt.cpp
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index 0c13e43..75a23d9 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -82,7 +82,6 @@ public:
         , page(0)
         , resizesToContents(false)
 #if USE(ACCELERATED_COMPOSITING)
-        , rootGraphicsLayer(0)
         , shouldSync(false)
 #endif
     {
@@ -158,7 +157,7 @@ public:
     enum { RootGraphicsLayerZValue, OverlayZValue };
 
 #if USE(ACCELERATED_COMPOSITING)
-    QGraphicsItem* rootGraphicsLayer;
+    QWeakPointer<QGraphicsObject> rootGraphicsLayer;
     // we need to sync the layers if we get a special call from the WebCore
     // compositor telling us to do so. We'll get that call from ChromeClientQt
     bool shouldSync;
@@ -171,12 +170,11 @@ public:
 QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (rootGraphicsLayer) {
-        // we don't need to delete the root graphics layer
-        // The lifecycle is managed in GraphicsLayerQt.cpp
-        rootGraphicsLayer->setParentItem(0);
-        q->scene()->removeItem(rootGraphicsLayer);
-    }
+    if (!rootGraphicsLayer)
+        return;
+    // we don't need to delete the root graphics layer. The lifecycle is managed in GraphicsLayerQt.cpp.
+    rootGraphicsLayer.data()->setParentItem(0);
+    q->scene()->removeItem(rootGraphicsLayer.data());
 #endif
 }
 
@@ -204,12 +202,12 @@ void QGraphicsWebViewPrivate::createOrDeleteOverlay()
 void QGraphicsWebViewPrivate::setRootGraphicsLayer(QGraphicsItem* layer)
 {
     if (rootGraphicsLayer) {
-        rootGraphicsLayer->setParentItem(0);
-        q->scene()->removeItem(rootGraphicsLayer);
+        rootGraphicsLayer.data()->setParentItem(0);
+        q->scene()->removeItem(rootGraphicsLayer.data());
         QWebFramePrivate::core(q->page()->mainFrame())->view()->syncCompositingStateRecursive();
     }
 
-    rootGraphicsLayer = layer;
+    rootGraphicsLayer = layer ? layer->toGraphicsObject() : 0;
 
     if (layer) {
         layer->setFlag(QGraphicsItem::ItemClipsChildrenToShape, true);
@@ -231,7 +229,7 @@ void QGraphicsWebViewPrivate::updateCompositingScrollPosition()
 {
     if (rootGraphicsLayer && q->page() && q->page()->mainFrame()) {
         const QPoint scrollPosition = q->page()->mainFrame()->scrollPosition();
-        rootGraphicsLayer->setPos(-scrollPosition);
+        rootGraphicsLayer.data()->setPos(-scrollPosition);
     }
 }
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index b8b50b7..e9ebce5 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -119,15 +119,6 @@
 
 using namespace WebCore;
 
-void QWEBKIT_EXPORT qt_wrt_setViewMode(QWebPage* page, const QString& mode)
-{
-    QWebPagePrivate::priv(page)->viewMode = mode;
-    WebCore::Frame* frame = QWebFramePrivate::core(page->mainFrame());
-    WebCore::FrameView* view = frame->view();
-    frame->document()->updateStyleSelector();
-    view->forceLayout();
-}
-
 void QWEBKIT_EXPORT qt_drt_overwritePluginDirectories()
 {
     PluginDatabase* db = PluginDatabase::installedPlugins(/* populate */ false);
@@ -1361,6 +1352,26 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
     ev->accept();
 }
 
+void QWebPagePrivate::dynamicPropertyChangeEvent(QDynamicPropertyChangeEvent* event)
+{
+    if (event->propertyName() == "_q_viewMode") {
+        QString mode = q->property("_q_viewMode").toString();
+        if (mode != viewMode) {
+            viewMode = mode;
+            WebCore::Frame* frame = QWebFramePrivate::core(q->mainFrame());
+            WebCore::FrameView* view = frame->view();
+            frame->document()->updateStyleSelector();
+            view->forceLayout();
+        }
+    } else if (event->propertyName() == "_q_HTMLTokenizerChunkSize") {
+        int chunkSize = q->property("_q_HTMLTokenizerChunkSize").toInt();
+        q->handle()->page->setCustomHTMLTokenizerChunkSize(chunkSize);
+    } else if (event->propertyName() == "_q_HTMLTokenizerTimeDelay") {
+        double timeDelay = q->property("_q_HTMLTokenizerTimeDelay").toDouble();
+        q->handle()->page->setCustomHTMLTokenizerTimeDelay(timeDelay);
+    }
+}
+
 void QWebPagePrivate::shortcutOverrideEvent(QKeyEvent* event)
 {
     WebCore::Frame* frame = page->focusController()->focusedOrMainFrame();
@@ -2708,6 +2719,9 @@ bool QWebPage::event(QEvent *ev)
         d->touchEvent(static_cast<QTouchEvent*>(ev));
         break;
 #endif
+    case QEvent::DynamicPropertyChange:
+        d->dynamicPropertyChangeEvent(static_cast<QDynamicPropertyChangeEvent*>(ev));
+        break;
     default:
         return QObject::event(ev);
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index 0712d0c..5350cd9 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -112,6 +112,8 @@ public:
 
     void inputMethodEvent(QInputMethodEvent*);
 
+    void dynamicPropertyChangeEvent(QDynamicPropertyChangeEvent*);
+
     void shortcutOverrideEvent(QKeyEvent*);
     void leaveEvent(QEvent*);
     void handleClipboard(QEvent*, Qt::MouseButton);
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 555b14d..6ddaa2b 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,61 @@
+2010-05-09  Noam Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Crash in QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate when animation were used
+        https://bugs.webkit.org/show_bug.cgi?id=38574
+
+        The fix uses a QWeakPointer for rootGraphicsLayer, protecting from a crash in case the layer is deleted before the QGraphicsWebView.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::QGraphicsWebViewPrivate):
+        (QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate):
+        (QGraphicsWebViewPrivate::setRootGraphicsLayer):
+        (QGraphicsWebViewPrivate::updateCompositingScrollPosition):
+
+2010-05-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Expose HTMLTokenizer yielding parameters
+        https://bugs.webkit.org/show_bug.cgi?id=37023
+
+        Enables to set TimeDelay and ChunkSize for 
+        HTMLTokenizer.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+
+2010-05-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPage viewMode property
+        https://bugs.webkit.org/show_bug.cgi?id=38119
+
+        Rename the property from wrt_viewMode to _q_viewMode.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::viewModes):
+
+2010-04-28  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QWebPage viewMode property
+        https://bugs.webkit.org/show_bug.cgi?id=38119
+
+        Replacing method qt_wrt_setViewMode by wrt_viewMode property.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::dynamicPropertyChangeEvent):
+        (QWebPage::event):
+        * Api/qwebpage_p.h:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::wrt_viewModes):
+
 2010-04-09  Tasuku Suzuki  <tasuku.suzuki@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/symbian/bwins/QtWebKitu.def b/src/3rdparty/webkit/WebKit/qt/symbian/bwins/QtWebKitu.def
index a450f9e..910ba8f 100644
--- a/src/3rdparty/webkit/WebKit/qt/symbian/bwins/QtWebKitu.def
+++ b/src/3rdparty/webkit/WebKit/qt/symbian/bwins/QtWebKitu.def
@@ -642,7 +642,7 @@ EXPORTS
 	?qt_drt_webinspector_executeScript@@YAXPAVQWebPage@@JABVQString@@@Z @ 641 NONAME ; void qt_drt_webinspector_executeScript(class QWebPage *, long, class QString const &)
 	?qt_drt_webinspector_show@@YAXPAVQWebPage@@@Z @ 642 NONAME ; void qt_drt_webinspector_show(class QWebPage *)
 	?qt_drt_workerThreadCount@@YAHXZ @ 643 NONAME ; int qt_drt_workerThreadCount(void)
-	?qt_wrt_setViewMode@@YAXPAVQWebPage@@ABVQString@@@Z @ 644 NONAME ; void qt_wrt_setViewMode(class QWebPage *, class QString const &)
+	?qt_wrt_setViewMode@@YAXPAVQWebPage@@ABVQString@@@Z @ 644 NONAME ABSENT ; void qt_wrt_setViewMode(class QWebPage *, class QString const &)
 	?qtwebkit_webframe_scrollRecursively@@YAXPAVQWebFrame@@HHABVQPoint@@@Z @ 645 NONAME ; void qtwebkit_webframe_scrollRecursively(class QWebFrame *, int, int, class QPoint const &)
 	?resizesToContents@QGraphicsWebView@@QBE_NXZ @ 646 NONAME ; bool QGraphicsWebView::resizesToContents(void) const
 	?scrollToAnchor@QWebFrame@@QAEXABVQString@@@Z @ 647 NONAME ; void QWebFrame::scrollToAnchor(class QString const &)
diff --git a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
index 145fe0b..ca462d0 100644
--- a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -716,7 +716,7 @@ EXPORTS
 	_ZN13QWebInspector10closeEventEP11QCloseEvent @ 715 NONAME
 	_ZN16QGraphicsWebView26setTiledBackingStoreFrozenEb @ 716 NONAME
 	_ZNK16QGraphicsWebView25isTiledBackingStoreFrozenEv @ 717 NONAME
-	_Z18qt_wrt_setViewModeP8QWebPageRK7QString @ 718 NONAME
+	_Z18qt_wrt_setViewModeP8QWebPageRK7QString @ 718 NONAME ABSENT
 	_Z19qt_drt_setMediaTypeP9QWebFrameRK7QString @ 719 NONAME
 	_Z26qt_drt_enableCaretBrowsingP8QWebPageb @ 720 NONAME
 	_ZNK12QWebSettings12inspectorUrlEv @ 721 NONAME
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index f7eddd5..834a394 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -110,6 +110,8 @@ private slots:
     void userAgentApplicationName();
     void userAgentLocaleChange();
 
+    void viewModes();
+
     void crashTests_LazyInitializationOfMainFrame();
 
     void screenshot_data();
@@ -357,6 +359,21 @@ void tst_QWebPage::userStyleSheet()
     QCOMPARE(networkManager->requestedUrls.at(0), QUrl("http://does.not/exist.png"));
 }
 
+void tst_QWebPage::viewModes()
+{
+    m_view->setHtml("<body></body>");
+    m_page->setProperty("_q_viewMode", "minimized");
+
+    QVariant empty = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode)\")");
+    QVERIFY(empty.type() == QVariant::Bool && empty.toBool());
+
+    QVariant minimized = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode: minimized)\")");
+    QVERIFY(minimized.type() == QVariant::Bool && minimized.toBool());
+
+    QVariant maximized = m_page->mainFrame()->evaluateJavaScript("window.styleMedia.matchMedium(\"(-webkit-view-mode: maximized)\")");
+    QVERIFY(maximized.type() == QVariant::Bool && !maximized.toBool());
+}
+
 void tst_QWebPage::modified()
 {
     m_page->mainFrame()->setUrl(QUrl("data:text/html,<body>blub"));