Updated WebKit to 836fa24be73978fb292e954abb151fb46b1d97e0

47 files changed, 1312 insertions, 71 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index b3cdc28..6ff8541 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-4277f8277b1daf3ec33c996f5a760ccd1113af4b
+836fa24be73978fb292e954abb151fb46b1d97e0
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
index 0c8c131..ce9eee0 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,19 @@
+2011-07-08  Chang Shu  <cshu@webkit.org>
+
+        Rename "makeSecure" to "fill" and remove the support for displaying last character
+        to avoid layering violatation.
+        https://bugs.webkit.org/show_bug.cgi?id=59114
+
+        Reviewed by Alexey Proskuryakov.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::fill):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        (WTF::String::fill):
+
 2011-08-15  Gavin Barraclough  <barraclough@apple.com>
 
         Crash accessing static property on sealed object
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.cpp
index 17b4d7d..ea8770a 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.cpp
@@ -270,17 +270,15 @@ PassRefPtr<StringImpl> StringImpl::upper()
     return newImpl.release();
 }
 
-PassRefPtr<StringImpl> StringImpl::secure(UChar character, LastCharacterBehavior behavior)
+PassRefPtr<StringImpl> StringImpl::fill(UChar character)
 {
     if (!m_length)
         return this;
 
     UChar* data;
     RefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
-    unsigned lastCharacterIndex = m_length - 1;
-    for (unsigned i = 0; i < lastCharacterIndex; ++i)
+    for (unsigned i = 0; i < m_length; ++i)
         data[i] = character;
-    data[lastCharacterIndex] = (behavior == ObscureLastCharacter) ? character : m_data[lastCharacterIndex];
     return newImpl.release();
 }
 
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.h b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.h
index 81911b3..b0ec163 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -284,9 +284,7 @@ public:
     PassRefPtr<StringImpl> lower();
     PassRefPtr<StringImpl> upper();
 
-    enum LastCharacterBehavior { ObscureLastCharacter, DisplayLastCharacter };
-
-    PassRefPtr<StringImpl> secure(UChar, LastCharacterBehavior = ObscureLastCharacter);
+    PassRefPtr<StringImpl> fill(UChar);
     PassRefPtr<StringImpl> foldCase();
 
     PassRefPtr<StringImpl> stripWhiteSpace();
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/WTFString.h b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/WTFString.h
index b593d20..f29228b 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -219,7 +219,7 @@ public:
 
     void makeLower() { if (m_impl) m_impl = m_impl->lower(); }
     void makeUpper() { if (m_impl) m_impl = m_impl->upper(); }
-    void makeSecure(UChar aChar) { if (m_impl) m_impl = m_impl->secure(aChar); }
+    void fill(UChar c) { if (m_impl) m_impl = m_impl->fill(c); }
 
     void truncate(unsigned len);
     void remove(unsigned pos, int len = 1);
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index 97db9dd..98af823 100644
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,246 @@
+2011-08-23  Chang Shu  <cshu@webkit.org>
+
+        Added support for momentarily revealing last typed character in password input.
+        Code change was partially based on Apple's iOS code and Samuel Nevala's work.
+        https://bugs.webkit.org/show_bug.cgi?id=32509
+
+        Reviewed by Alexey Proskuryakov.
+
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        * rendering/RenderText.cpp:
+        (WebCore::SecureTextTimer::SecureTextTimer):
+        (WebCore::SecureTextTimer::restartWithNewText):
+        (WebCore::SecureTextTimer::invalidate):
+        (WebCore::SecureTextTimer::lastTypedCharacterOffset):
+        (WebCore::SecureTextTimer::fired):
+        (WebCore::RenderText::willBeDestroyed):
+        (WebCore::RenderText::setTextInternal):
+        (WebCore::RenderText::secureText):
+        (WebCore::RenderText::momentarilyRevealLastTypedCharacter):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::isSecure):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setPasswordEchoEnabled): Fixed some silly coding in Internals.
+        (WebCore::Internals::setPasswordEchoDurationInSeconds):
+        (WebCore::Internals::reset):
+
+2011-07-08  Chang Shu  <cshu@webkit.org>
+
+        Update calling sites after function renamed.
+        https://bugs.webkit.org/show_bug.cgi?id=59114
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests, just refactoring.
+
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setTextInternal):
+
+2011-08-18  Chang Shu  <cshu@webkit.org>
+
+        Add support of setPasswordEchoEnabled and setPasswordEchoDuration for password echo feature
+        https://bugs.webkit.org/show_bug.cgi?id=66052
+
+        Reviewed by Alexey Proskuryakov.
+
+        Added runtime settings in WebCore.
+        Added support in window.internals for testing.
+
+        Tests: editing/input/password-echo-passnode.html
+               editing/input/password-echo-passnode2.html
+               editing/input/password-echo-passnode3.html
+               editing/input/password-echo-textnode.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setPasswordEchoEnabled):
+        (WebCore::Settings::passwordEchoEnabled):
+        (WebCore::Settings::setPasswordEchoDurationInSeconds):
+        (WebCore::Settings::passwordEchoDurationInSeconds):
+        * testing/Internals.cpp:
+        (WebCore::Internals::Internals):
+        (WebCore::Internals::setPasswordEchoEnabled):
+        (WebCore::Internals::setPasswordEchoDurationInSeconds):
+        (WebCore::Internals::reset):
+        * testing/Internals.h:
+        * testing/Internals.idl:
+
+2011-08-16  Chang Shu  <cshu@webkit.org>
+
+        Support reset in WebCore::Internals
+        https://bugs.webkit.org/show_bug.cgi?id=66307
+
+        Reviewed by Dimitri Glazkov.
+
+        New tests will be added when function reset is implemented.
+
+        Added framework code in WebCoreTestSupport. The real implementation of
+        Internals::reset() depends on the need from the settings that require a reset.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::reset):
+        * testing/Internals.h:
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject):
+        * testing/js/WebCoreTestSupport.h:
+        * testing/v8/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject):
+        * testing/v8/WebCoreTestSupport.h:
+
+2011-06-09  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Teach Qt about window.internals
+        https://bugs.webkit.org/show_bug.cgi?id=61074
+
+        A weakness of the Qt DRT setup is that things like JSContextRef are abstracted
+        away from the QtWebKit API so we need DumpRenderTreeSupportQt to access WebCore internals.
+        Since the window.internals object requires JSContextRef we need to implement it in DumpRenderTreeSupportQt
+        where we can access it. DumpRenderTreeSupportQt cannot be compiled outside Qt's WebCore and as it
+        is our only possible route into the WebCoreTestSupport class neither can the new window.internals plumbing.
+        Likewise we can't put the accessor in WebCoreTestSupport because it would then need to know about QWebFrame
+        and others. The only alternative seems like a compile time guard which we would have to teach the bots about.
+
+        * CodeGenerators.pri:
+        * WebCore.pri:
+        * WebCore.pro:
+
+2011-06-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add build logistics and plumbing for window.internals object.
+        https://bugs.webkit.org/show_bug.cgi?id=60313
+
+        Test: fast/harness/internals-object.html
+
+        * Configurations/WebCoreTestSupport.xcconfig: Added.
+        * DerivedSources.make: Added support for generating from Internals.idl.
+        * WebCore.gyp/WebCore.gyp: Added new webcore_test_support library.
+        * WebCore.gypi: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Added WebCoreTestSupport library.
+        * testing/Internals.cpp: Added.
+        * testing/Internals.h: Added.
+        * testing/Internals.idl: Added.
+        * testing/js/WebCoreTestSupport.cpp: Added.
+        * testing/js/WebCoreTestSupport.h: Added.
+        * testing/v8/WebCoreTestSupport.cpp: Added.
+        * testing/v8/WebCoreTestSupport.h: Added.
+
+2011-08-22  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in FocusController::advanceFocusInDocumentOrder
+        https://bugs.webkit.org/show_bug.cgi?id=66678
+
+        RefPtr the focusable node to prevent getting deleted by mutation
+        event.
+
+        Reviewed by Dave Hyatt.
+
+        Test: fast/frames/focus-controller-crash-change-event.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusInDocumentOrder):
+
+2011-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        SimplifiedBackwardsTextIterator returns incorrect offset with first-letter rule
+        https://bugs.webkit.org/show_bug.cgi?id=66086
+
+        Reviewed by Darin Adler.
+
+        The bug was caused by SimplifiedBackwardsTextIterator's not taking care of first-letter at all.
+        Fixing the bug by detecting RenderTextFragment in handleTextNode.
+
+        Also added m_shouldHandleFirstLetter to SimplifiedBackwardsTextIterator to keep track of whether or not
+        the next call to handleTextNode needs to process the first-letter part of the text fragment.
+
+        Test: editing/text-iterator/backward-textiterator-first-letter-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::firstRenderTextInFirstLetter): Extracted from handleTextNodeFirstLetter.
+        (WebCore::TextIterator::handleTextNodeFirstLetter): Calls firstRenderTextInFirstLetter.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode):
+        (WebCore::SimplifiedBackwardsTextIterator::handleFirstLetter): Added.
+        * editing/TextIterator.h:
+
+2011-08-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix build on Lion
+
+        https://bugs.webkit.org/show_bug.cgi?id=66770
+
+        Reviewed by Andreas Kling.
+
+        We were mistakenly picking up mac/WebCoreSystemInterface.h instead of
+        the Qt one, and building on Lion revealed this when a typedef for
+        IOSurfaceRef was wrapped in PLATFORM(MAC).
+
+        For now we fix this by including WebCoreSystemInterface using
+        brackets, so that we'll pick up the right file based on the
+        include paths. This also means exposing a few missing enums
+        in our own version of the file, so those were added.
+
+        Lasty, we need to link against the right system interface library
+        on Lion.
+
+        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
+        * platform/qt/WebCoreSystemInterface.h:
+
+2011-08-08  Cris Neckar  <cdn@chromium.org>
+
+        Remove counter nodes from the tree and fix-up children when they are removed from the counter map.
+        https://bugs.webkit.org/show_bug.cgi?id=65346
+
+        Reviewed by Adam Barth.
+
+        Covered by existing CSS counter tests.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::~CounterNode):
+
+2011-08-17  Oliver Hunt  <oliver@apple.com>
+
+        Move towards supporting user controlled prototypes on CanvasPixelArray
+        https://bugs.webkit.org/show_bug.cgi?id=66429
+
+        Reviewed by Gavin Barraclough.
+
+        Start using a per-global object structure for canvas pixel array.
+
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+
+2011-08-17  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Document::recalcStyleSelector
+        https://bugs.webkit.org/show_bug.cgi?id=66335
+
+        Reviewed by Simon Fraser.
+
+        When node is getting destroyed and its removedFromDocument
+        is not called due to entire document structure torn down(using
+        removeAllChildren), make sure to clear out the stylesheet
+        candidate node from document's structures in its destructor.
+
+        Test: svg/dom/stylesheet-candidate-node-crash-main.html
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::~ProcessingInstruction):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::~HTMLLinkElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::~HTMLStyleElement):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::~SVGStyleElement):
+
 2011-08-12  Abhishek Arya  <inferno@chromium.org>
 
         Crash in WebCore::editingIgnoresContent
diff --git a/src/3rdparty/webkit/Source/WebCore/CodeGenerators.pri b/src/3rdparty/webkit/Source/WebCore/CodeGenerators.pri
index cc29660..db6f7af 100644
--- a/src/3rdparty/webkit/Source/WebCore/CodeGenerators.pri
+++ b/src/3rdparty/webkit/Source/WebCore/CodeGenerators.pri
@@ -509,6 +509,7 @@ IDL_BINDINGS += \
     svg/SVGUseElement.idl \
     svg/SVGViewElement.idl \
     svg/SVGVKernElement.idl \
+    testing/Internals.idl \
     webaudio/AudioBuffer.idl \
     webaudio/AudioBufferSourceNode.idl \
     webaudio/AudioChannelMerger.idl \
@@ -613,6 +614,7 @@ idl.commands = perl -I$$PWD/bindings/scripts $$idl.wkScript \
                --include $$PWD/svg \
                --include $$PWD/storage \
                --include $$PWD/css \
+               --include $$PWD/testing \
                --include $$PWD/webaudio \
                --include $$PWD/workers \
                --outputDir $$WC_GENERATED_SOURCES_DIR \
diff --git a/src/3rdparty/webkit/Source/WebCore/WebCore.exp.in b/src/3rdparty/webkit/Source/WebCore/WebCore.exp.in
index a183d66..982a8ef 100644
--- a/src/3rdparty/webkit/Source/WebCore/WebCore.exp.in
+++ b/src/3rdparty/webkit/Source/WebCore/WebCore.exp.in
@@ -263,6 +263,7 @@ __ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
 __ZN7WebCore12IconDatabase5closeEv
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12IconDatabaseC1Ev
+__ZN7WebCore12JSDOMWrapper34virtualFunctionToPreventWeakVtableEv
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
@@ -1011,6 +1012,8 @@ __ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
 __ZN7WebCore9pageCacheEv
 __ZN7WebCore9plainTextEPKNS_5RangeENS_20TextIteratorBehaviorE
 __ZN7WebCore9toElementEN3JSC7JSValueE
+__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
+__ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
 __ZNK3JSC8Bindings10RootObject12globalObjectEv
 __ZNK3WTF6String14createCFStringEv
 __ZNK7WebCore5Frame26getDocumentBackgroundColorEv
@@ -1304,6 +1307,7 @@ __ZNK7WebCore9FrameView28isEnclosedInCompositingLayerEv
 __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZTVN7WebCore12ChromeClientE
+__ZTVN7WebCore12JSDOMWrapperE
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
@@ -1636,8 +1640,6 @@ __ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
 __ZN3JSC8Bindings8InstanceD2Ev
 __ZN7WebCore13IdentifierRep7isValidEPS0_
 __ZN7WebCore16ScriptController16createRootObjectEPv
-__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
-__ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
 __ZNK3JSC8Bindings13RuntimeObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZTVN3JSC13RuntimeMethodE
 #endif
diff --git a/src/3rdparty/webkit/Source/WebCore/WebCore.gypi b/src/3rdparty/webkit/Source/WebCore/WebCore.gypi
index e418f7f..7383db1 100644
--- a/src/3rdparty/webkit/Source/WebCore/WebCore.gypi
+++ b/src/3rdparty/webkit/Source/WebCore/WebCore.gypi
@@ -6054,6 +6054,17 @@
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
         ],
+        'webcore_test_support_idl_files': [
+          'testing/Internals.idl',
+        ],
+        'webcore_test_support_files': [
+            'testing/v8/WebCoreTestSupport.cpp',
+            'testing/v8/WebCoreTestSupport.h',
+            'testing/js/WebCoreTestSupport.cpp',
+            'testing/js/WebCoreTestSupport.h',
+            'testing/Internals.cpp',
+            'testing/Internals.h',
+        ],
         'webcore_resource_files': [
             'English.lproj/Localizable.strings',
             'English.lproj/localizedStrings.js',
diff --git a/src/3rdparty/webkit/Source/WebCore/WebCore.pri b/src/3rdparty/webkit/Source/WebCore/WebCore.pri
index 97644ed..82311d2 100644
--- a/src/3rdparty/webkit/Source/WebCore/WebCore.pri
+++ b/src/3rdparty/webkit/Source/WebCore/WebCore.pri
@@ -48,14 +48,16 @@ v8 {
         $$SOURCE_DIR/WebCore/bindings/v8 \
         $$SOURCE_DIR/WebCore/bindings/v8/custom \
         $$SOURCE_DIR/WebCore/bindings/v8/specialization \
-        $$SOURCE_DIR/WebCore/bridge/qt/v8
+        $$SOURCE_DIR/WebCore/bridge/qt/v8 \
+        $$SOURCE_DIR/WebCore/testing/v8
 
 } else {
     WEBCORE_INCLUDEPATH = \
         $$SOURCE_DIR/WebCore/bridge/jsc \
         $$SOURCE_DIR/WebCore/bindings/js \
         $$SOURCE_DIR/WebCore/bindings/js/specialization \
-        $$SOURCE_DIR/WebCore/bridge/c
+        $$SOURCE_DIR/WebCore/bridge/c \
+        $$SOURCE_DIR/WebCore/testing/js
 }
 
 WEBCORE_INCLUDEPATH = \
@@ -110,6 +112,7 @@ WEBCORE_INCLUDEPATH = \
     $$SOURCE_DIR/WebCore/svg/graphics \
     $$SOURCE_DIR/WebCore/svg/graphics/filters \
     $$SOURCE_DIR/WebCore/svg/properties \
+    $$SOURCE_DIR/WebCore/testing \
     $$SOURCE_DIR/WebCore/webaudio \
     $$SOURCE_DIR/WebCore/websockets \
     $$SOURCE_DIR/WebCore/wml \
diff --git a/src/3rdparty/webkit/Source/WebCore/WebCore.pro b/src/3rdparty/webkit/Source/WebCore/WebCore.pro
index 141290d..a305549 100644
--- a/src/3rdparty/webkit/Source/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/Source/WebCore/WebCore.pro
@@ -222,7 +222,8 @@ v8 {
         bindings/v8/custom/V8NotificationCenterCustom.cpp \
         bindings/v8/custom/V8ConsoleCustom.cpp \
         bindings/v8/custom/V8SQLTransactionSyncCustom.cpp \
-        bindings/v8/V8WorkerContextErrorHandler.cpp
+        bindings/v8/V8WorkerContextErrorHandler.cpp \
+        testing/v8/WebCoreTestSupport.cpp
 } else {
     SOURCES += \
         bindings/ScriptControllerBase.cpp \
@@ -374,7 +375,8 @@ v8 {
         bridge/runtime_array.cpp \
         bridge/runtime_method.cpp \
         bridge/runtime_object.cpp \
-        bridge/runtime_root.cpp
+        bridge/runtime_root.cpp \
+        testing/js/WebCoreTestSupport.cpp
 }
 
 SOURCES += \
@@ -1173,6 +1175,7 @@ SOURCES += \
     rendering/style/StyleSurroundData.cpp \
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
+    testing/Internals.cpp \
     xml/DOMParser.cpp \
     xml/XMLHttpRequest.cpp \
     xml/XMLHttpRequestProgressEventThrottle.cpp \
@@ -2420,6 +2423,7 @@ HEADERS += \
     svg/SVGVKernElement.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
+    testing/Internals.h \
     workers/AbstractWorker.h \
     workers/DedicatedWorkerContext.h \
     workers/DedicatedWorkerThread.h \
diff --git a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.cpp b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.cpp
index 60c0ed1..d54fe74 100644
--- a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -32,12 +32,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-#ifndef NDEBUG
-
-JSDOMWrapper::~JSDOMWrapper()
+void JSDOMWrapper::virtualFunctionToPreventWeakVtable()
 {
+    ASSERT_NOT_REACHED();
 }
 
-#endif
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.h b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.h
index 2f5bebd..9a4aca5 100644
--- a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.h
+++ b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSDOMWrapper.h
@@ -48,6 +48,10 @@ public:
     }
 
 protected:
+    // An inline function cannot be the first non-abstract virtual function declared
+    // in the class as it results in the vtable being generated as a weak symbol.
+    virtual void virtualFunctionToPreventWeakVtable();
+
     explicit JSDOMWrapper(JSC::Structure* structure, JSC::JSGlobalObject* globalObject) 
         : JSObjectWithGlobalObject(globalObject, structure)
     {
@@ -56,10 +60,6 @@ protected:
         // needing to reach through the frame to get to the Document*.  See bug 27640.
         // ASSERT(globalObject->scriptExecutionContext());
     }
-
-#ifndef NDEBUG
-    virtual ~JSDOMWrapper();
-#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSImageDataCustom.cpp
index 420b60c..6e242b0 100644
--- a/src/3rdparty/webkit/Source/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -48,8 +48,10 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     wrapper = CREATE_DOM_WRAPPER(exec, globalObject, ImageData, imageData);
     Identifier dataName(exec, "data");
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", &JSByteArray::Base::s_info, 0, 0 };
-    DEFINE_STATIC_LOCAL(Strong<Structure>, cpaStructure, (exec->globalData(), JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo)));
-    wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure.get(), imageData->data()->data()), DontDelete | ReadOnly);
+    Structure* cpaStructure = getCachedDOMStructure(globalObject, &cpaClassInfo);
+    if (!cpaStructure)
+        cpaStructure = cacheDOMStructure(globalObject, JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo), &cpaClassInfo);
+    wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data()), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/Source/WebCore/dom/ProcessingInstruction.cpp
index 30111d8..f7dcfd2 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/ProcessingInstruction.cpp
@@ -62,6 +62,9 @@ ProcessingInstruction::~ProcessingInstruction()
 
     if (m_cachedSheet)
         m_cachedSheet->removeClient(this);
+
+    if (inDocument())
+        document()->removeStyleSheetCandidateNode(this);
 }
 
 void ProcessingInstruction::setData(const String& data, ExceptionCode&)
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.cpp b/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.cpp
index 5b0e2ad..3bed5ae 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.cpp
@@ -84,6 +84,15 @@ void StyleElement::removedFromDocument(Document* document, Element* element)
         document->styleSelectorChanged(DeferRecalcStyle);
 }
 
+void StyleElement::clearDocumentData(Document* document, Element* element)
+{
+    if (m_sheet)
+        m_sheet->clearOwnerNode();
+
+    if (element->inDocument())
+        document->removeStyleSheetCandidateNode(element);
+}
+
 void StyleElement::childrenChanged(Element* element)
 {
     ASSERT(element);
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.h b/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.h
index 4356c17..1f50c6e 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.h
+++ b/src/3rdparty/webkit/Source/WebCore/dom/StyleElement.h
@@ -44,6 +44,7 @@ protected:
 
     void insertedIntoDocument(Document*, Element*);
     void removedFromDocument(Document*, Element*);
+    void clearDocumentData(Document*, Element*);
     void childrenChanged(Element*);
     void finishParsingChildren(Element*);
 
diff --git a/src/3rdparty/webkit/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp b/src/3rdparty/webkit/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
index b1a455b..0fbc2af 100644
--- a/src/3rdparty/webkit/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -27,6 +27,8 @@
 #include "InsertIntoTextNodeCommand.h"
 
 #include "AXObjectCache.h"
+#include "RenderText.h"
+#include "Settings.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -46,7 +48,13 @@ void InsertIntoTextNodeCommand::doApply()
 {
     if (!m_node->rendererIsEditable())
         return;
-    
+
+    if (document()->settings() && document()->settings()->passwordEchoEnabled()) {
+        RenderText* renderText = toRenderText(m_node->renderer());
+        if (renderText && renderText->isSecure())
+            renderText->momentarilyRevealLastTypedCharacter(m_offset + m_text.length() - 1);
+    }
+
     ExceptionCode ec;
     m_node->insertData(m_offset, m_text, ec);
 
diff --git a/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.cpp
index 3de365b..38ade02 100644
--- a/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.cpp
@@ -602,21 +602,30 @@ void TextIterator::handleTextBox()
     }
 }
 
+static inline RenderText* firstRenderTextInFirstLetter(RenderObject* firstLetter)
+{
+    if (!firstLetter)
+        return 0;
+
+    // FIXME: Should this check descendent objects?
+    for (RenderObject* current = firstLetter->firstChild(); current; current = current->nextSibling()) {
+        if (current->isText())
+            return toRenderText(current);
+    }
+    return 0;
+}
+
 void TextIterator::handleTextNodeFirstLetter(RenderTextFragment* renderer)
 {
     if (renderer->firstLetter()) {
         RenderObject* r = renderer->firstLetter();
         if (r->style()->visibility() != VISIBLE && !m_ignoresStyleVisibility)
             return;
-        for (RenderObject *currChild = r->firstChild(); currChild; currChild->nextSibling()) {
-            if (currChild->isText()) {
-                RenderText* firstLetter = toRenderText(currChild);
-                m_handledFirstLetter = true;
-                m_remainingTextBox = m_textBox;
-                m_textBox = firstLetter->firstTextBox();
-                m_firstLetterText = firstLetter;
-                return;
-            }
+        if (RenderText* firstLetter = firstRenderTextInFirstLetter(r)) {
+            m_handledFirstLetter = true;
+            m_remainingTextBox = m_textBox;
+            m_textBox = firstLetter->firstTextBox();
+            m_firstLetterText = firstLetter;
         }
     }
     m_handledFirstLetter = true;
@@ -1042,14 +1051,46 @@ Node* TextIterator::node() const
 SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator()
     : m_behavior(TextIteratorDefaultBehavior)
     , m_node(0)
+    , m_offset(0)
+    , m_handledNode(false)
+    , m_handledChildren(false)
+    , m_startNode(0)
+    , m_startOffset(0)
+    , m_endNode(0)
+    , m_endOffset(0)
     , m_positionNode(0)
+    , m_positionStartOffset(0)
+    , m_positionEndOffset(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
+    , m_lastTextNode(0)
+    , m_lastCharacter(0)
+    , m_singleCharacterBuffer(0)
+    , m_havePassedStartNode(false)
+    , m_shouldHandleFirstLetter(false)
 {
 }
 
 SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range* r, TextIteratorBehavior behavior)
     : m_behavior(behavior)
     , m_node(0)
+    , m_offset(0)
+    , m_handledNode(false)
+    , m_handledChildren(false)
+    , m_startNode(0)
+    , m_startOffset(0)
+    , m_endNode(0)
+    , m_endOffset(0)
     , m_positionNode(0)
+    , m_positionStartOffset(0)
+    , m_positionEndOffset(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
+    , m_lastTextNode(0)
+    , m_lastCharacter(0)
+    , m_singleCharacterBuffer(0)
+    , m_havePassedStartNode(false)
+    , m_shouldHandleFirstLetter(false)
 {
     ASSERT(m_behavior == TextIteratorDefaultBehavior);
 
@@ -1177,23 +1218,62 @@ bool SimplifiedBackwardsTextIterator::handleTextNode()
 {
     m_lastTextNode = m_node;
 
-    RenderText* renderer = toRenderText(m_node->renderer());
-    String str = renderer->text();
+    int startOffset;
+    int offsetInNode;
+    RenderText* renderer = handleFirstLetter(startOffset, offsetInNode);
+    if (!renderer)
+        return true;
 
-    if (!renderer->firstTextBox() && str.length() > 0)
+    String text = renderer->text();
+    if (!renderer->firstTextBox() && text.length() > 0)
         return true;
 
     m_positionEndOffset = m_offset;
-
-    m_offset = (m_node == m_startNode) ? m_startOffset : 0;
+    m_offset = startOffset + offsetInNode;
     m_positionNode = m_node;
     m_positionStartOffset = m_offset;
+
+    ASSERT(0 <= m_positionStartOffset - offsetInNode && m_positionStartOffset - offsetInNode <= static_cast<int>(text.length()));
+    ASSERT(1 <= m_positionEndOffset - offsetInNode && m_positionEndOffset - offsetInNode <= static_cast<int>(text.length()));
+    ASSERT(m_positionStartOffset <= m_positionEndOffset);
+
     m_textLength = m_positionEndOffset - m_positionStartOffset;
-    m_textCharacters = str.characters() + m_positionStartOffset;
+    m_textCharacters = text.characters() + (m_positionStartOffset - offsetInNode);
+    ASSERT(m_textCharacters >= text.characters());
+    ASSERT(m_textCharacters + m_textLength <= text.characters() + static_cast<int>(text.length()));
 
-    m_lastCharacter = str[m_positionEndOffset - 1];
+    m_lastCharacter = text[m_positionEndOffset - 1];
 
-    return true;
+    return !m_shouldHandleFirstLetter;
+}
+
+RenderText* SimplifiedBackwardsTextIterator::handleFirstLetter(int& startOffset, int& offsetInNode)
+{
+    RenderText* renderer = toRenderText(m_node->renderer());
+    startOffset = (m_node == m_startNode) ? m_startOffset : 0;
+
+    if (!renderer->isTextFragment()) {
+        offsetInNode = 0;
+        return renderer;
+    }
+
+    RenderTextFragment* fragment = toRenderTextFragment(renderer);
+    int offsetAfterFirstLetter = fragment->start();
+    if (startOffset >= offsetAfterFirstLetter) {
+        ASSERT(!m_shouldHandleFirstLetter);
+        offsetInNode = offsetAfterFirstLetter;
+        return renderer;
+    }
+
+    if (!m_shouldHandleFirstLetter && offsetAfterFirstLetter < m_offset) {
+        m_shouldHandleFirstLetter = true;
+        offsetInNode = offsetAfterFirstLetter;
+        return renderer;
+    }
+
+    m_shouldHandleFirstLetter = false;
+    offsetInNode = 0;
+    return firstRenderTextInFirstLetter(fragment->firstLetter());
 }
 
 bool SimplifiedBackwardsTextIterator::handleReplacedElement()
diff --git a/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.h b/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.h
index 9fe4ceb..8820388 100644
--- a/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.h
+++ b/src/3rdparty/webkit/Source/WebCore/editing/TextIterator.h
@@ -203,6 +203,7 @@ public:
 private:
     void exitNode();
     bool handleTextNode();
+    RenderText* handleFirstLetter(int& startOffset, int& offsetInNode);
     bool handleReplacedElement();
     bool handleNonTextNode();
     void emitCharacter(UChar, Node*, int startOffset, int endOffset);
@@ -240,6 +241,9 @@ private:
 
     // Whether m_node has advanced beyond the iteration range (i.e. m_startNode).
     bool m_havePassedStartNode;
+
+    // Should handle first-letter renderer in the next call to handleTextNode.
+    bool m_shouldHandleFirstLetter;
 };
 
 // Builds on the text iterator, adding a character position so we can walk one
diff --git a/src/3rdparty/webkit/Source/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/Source/WebCore/editing/visible_units.cpp
index ff683a5..b2b52f3 100644
--- a/src/3rdparty/webkit/Source/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/editing/visible_units.cpp
@@ -101,7 +101,7 @@ static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearch
         else {
             // Treat bullets used in the text security mode as regular characters when looking for boundaries
             String iteratorString(it.characters(), it.length());
-            iteratorString = iteratorString.impl()->secure('x');
+            iteratorString.fill('x');
             string.prepend(iteratorString.characters(), iteratorString.length());
         }
         next = searchFunction(string.data(), string.size(), string.size() - suffixLength, MayHaveMoreContext, needMoreContext);
@@ -176,7 +176,7 @@ static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunc
         else {
             // Treat bullets used in the text security mode as regular characters when looking for boundaries
             String iteratorString(it.characters(), it.length());
-            iteratorString = iteratorString.impl()->secure('x');
+            iteratorString.fill('x');
             string.append(iteratorString.characters(), iteratorString.length());
         }
         next = searchFunction(string.data(), string.size(), prefixLength, MayHaveMoreContext, needMoreContext);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.cpp b/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.cpp
new file mode 100644
index 0000000..1a29b36
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.cpp
@@ -0,0 +1,134 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSInternals.h"
+
+#include "ExceptionCode.h"
+#include "Internals.h"
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include <runtime/Error.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInternals);
+
+/* Hash table for prototype */
+#if ENABLE(JIT)
+#define THUNK_GENERATOR(generator) , generator
+#else
+#define THUNK_GENERATOR(generator)
+#endif
+
+static const HashTableValue JSInternalsPrototypeTableValues[3] =
+{
+    { "setPasswordEchoEnabled", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsInternalsPrototypeFunctionSetPasswordEchoEnabled), (intptr_t)2 THUNK_GENERATOR(0) },
+    { "setPasswordEchoDurationInSeconds", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsInternalsPrototypeFunctionSetPasswordEchoDurationInSeconds), (intptr_t)2 THUNK_GENERATOR(0) },
+    { 0, 0, 0, 0 THUNK_GENERATOR(0) }
+};
+
+#undef THUNK_GENERATOR
+static JSC_CONST_HASHTABLE HashTable JSInternalsPrototypeTable = { 5, 3, JSInternalsPrototypeTableValues, 0 };
+const ClassInfo JSInternalsPrototype::s_info = { "InternalsPrototype", &JSC::JSObjectWithGlobalObject::s_info, &JSInternalsPrototypeTable, 0 };
+
+JSObject* JSInternalsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSInternals>(exec, globalObject);
+}
+
+bool JSInternalsPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSInternalsPrototypeTable, this, propertyName, slot);
+}
+
+bool JSInternalsPrototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticFunctionDescriptor<JSObject>(exec, &JSInternalsPrototypeTable, this, propertyName, descriptor);
+}
+
+const ClassInfo JSInternals::s_info = { "Internals", &JSDOMWrapper::s_info, 0, 0 };
+
+JSInternals::JSInternals(Structure* structure, JSDOMGlobalObject* globalObject, PassRefPtr<Internals> impl)
+    : JSDOMWrapper(structure, globalObject)
+    , m_impl(impl)
+{
+    ASSERT(inherits(&s_info));
+}
+
+JSObject* JSInternals::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSInternalsPrototype(exec->globalData(), globalObject, JSInternalsPrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInternalsPrototypeFunctionSetPasswordEchoEnabled(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSInternals::s_info))
+        return throwVMTypeError(exec);
+    JSInternals* castedThis = static_cast<JSInternals*>(asObject(thisValue));
+    Internals* imp = static_cast<Internals*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    Document* document(toDocument(exec->argument(0)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    bool enabled(exec->argument(1).toBoolean(exec));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    imp->setPasswordEchoEnabled(document, enabled, ec);
+    setDOMException(exec, ec);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsInternalsPrototypeFunctionSetPasswordEchoDurationInSeconds(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSInternals::s_info))
+        return throwVMTypeError(exec);
+    JSInternals* castedThis = static_cast<JSInternals*>(asObject(thisValue));
+    Internals* imp = static_cast<Internals*>(castedThis->impl());
+    ExceptionCode ec = 0;
+    Document* document(toDocument(exec->argument(0)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    double durationInSeconds(exec->argument(1).toNumber(exec));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+
+    imp->setPasswordEchoDurationInSeconds(document, durationInSeconds, ec);
+    setDOMException(exec, ec);
+    return JSValue::encode(jsUndefined());
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, Internals* impl)
+{
+    return wrap<JSInternals>(exec, globalObject, impl);
+}
+
+Internals* toInternals(JSC::JSValue value)
+{
+    return value.inherits(&JSInternals::s_info) ? static_cast<JSInternals*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.h b/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.h
new file mode 100644
index 0000000..08e2751
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSInternals.h
@@ -0,0 +1,79 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSInternals_h
+#define JSInternals_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/JSObjectWithGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Internals;
+
+class JSInternals : public JSDOMWrapper {
+    typedef JSDOMWrapper Base;
+public:
+    JSInternals(JSC::Structure*, JSDOMGlobalObject*, PassRefPtr<Internals>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    static const JSC::ClassInfo s_info;
+
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+    }
+
+    Internals* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Internals> m_impl;
+protected:
+    static const unsigned StructureFlags = Base::StructureFlags;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, Internals*);
+Internals* toInternals(JSC::JSValue);
+
+class JSInternalsPrototype : public JSC::JSObjectWithGlobalObject {
+    typedef JSC::JSObjectWithGlobalObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
+    static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+    }
+    JSInternalsPrototype(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::Structure* structure) : JSC::JSObjectWithGlobalObject(globalData, globalObject, structure) { }
+protected:
+    static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+};
+
+// Functions
+
+JSC::EncodedJSValue JSC_HOST_CALL jsInternalsPrototypeFunctionSetPasswordEchoEnabled(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsInternalsPrototypeFunctionSetPasswordEchoDurationInSeconds(JSC::ExecState*);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/Source/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/Source/WebCore/html/HTMLLinkElement.cpp
index 633dd1e..d7ca918 100644
--- a/src/3rdparty/webkit/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/html/HTMLLinkElement.cpp
@@ -83,6 +83,9 @@ HTMLLinkElement::~HTMLLinkElement()
     if (m_cachedLinkResource)
         m_cachedLinkResource->removeClient(this);
 #endif
+
+    if (inDocument())
+        document()->removeStyleSheetCandidateNode(this);
 }
 
 void HTMLLinkElement::setDisabled(bool disabled)
diff --git a/src/3rdparty/webkit/Source/WebCore/html/HTMLStyleElement.cpp b/src/3rdparty/webkit/Source/WebCore/html/HTMLStyleElement.cpp
index 0f256e1..0213f40 100644
--- a/src/3rdparty/webkit/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/html/HTMLStyleElement.cpp
@@ -44,8 +44,7 @@ inline HTMLStyleElement::HTMLStyleElement(const QualifiedName& tagName, Document
 
 HTMLStyleElement::~HTMLStyleElement()
 {
-    if (m_sheet)
-        m_sheet->clearOwnerNode();
+    StyleElement::clearDocumentData(document(), this);
 }
 
 PassRefPtr<HTMLStyleElement> HTMLStyleElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/Source/WebCore/page/FocusController.cpp
index 5b91eeb..e7a44ca 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/page/FocusController.cpp
@@ -214,7 +214,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
 
     document->updateLayoutIgnorePendingStylesheets();
 
-    Node* node = (direction == FocusDirectionForward)
+    RefPtr<Node> node = (direction == FocusDirectionForward)
         ? document->nextFocusableNode(currentNode, event)
         : document->previousFocusableNode(currentNode, event);
             
@@ -237,7 +237,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
         frame = parentFrame;
     }
 
-    node = deepFocusableNode(direction, node, event);
+    node = deepFocusableNode(direction, node.get(), event);
 
     if (!node) {
         // We didn't find a node to focus, so we should try to pass focus to Chrome.
@@ -254,7 +254,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
             ? d->nextFocusableNode(0, event)
             : d->previousFocusableNode(0, event);
 
-        node = deepFocusableNode(direction, node, event);
+        node = deepFocusableNode(direction, node.get(), event);
 
         if (!node)
             return false;
@@ -273,7 +273,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
     if (node->isFrameOwnerElement()) {
         // We focus frames rather than frame owners.
         // FIXME: We should not focus frames that have no scrollbars, as focusing them isn't useful to the user.
-        HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(node);
+        HTMLFrameOwnerElement* owner = static_cast<HTMLFrameOwnerElement*>(node.get());
         if (!owner->contentFrame())
             return false;
 
@@ -296,13 +296,13 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
         setFocusedFrame(newDocument->frame());
 
     if (caretBrowsing) {
-        Position position = firstPositionInOrBeforeNode(node);
+        Position position = firstPositionInOrBeforeNode(node.get());
         VisibleSelection newSelection(position, position, DOWNSTREAM);
         if (frame->selection()->shouldChangeSelection(newSelection))
             frame->selection()->setSelection(newSelection);
     }
 
-    static_cast<Element*>(node)->focus(false);
+    static_cast<Element*>(node.get())->focus(false);
     return true;
 }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/page/Settings.cpp b/src/3rdparty/webkit/Source/WebCore/page/Settings.cpp
index 2b9e8b7..2025bd0 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/page/Settings.cpp
@@ -89,6 +89,7 @@ Settings::Settings(Page* page)
     : m_page(page)
     , m_editableLinkBehavior(EditableLinkDefaultBehavior)
     , m_textDirectionSubmenuInclusionBehavior(TextDirectionSubmenuAutomaticallyIncluded)
+    , m_passwordEchoDurationInSeconds(1)
     , m_minimumFontSize(0)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
@@ -182,6 +183,7 @@ Settings::Settings(Page* page)
     , m_shouldInjectUserScriptsInInitialEmptyDocument(false)
     , m_allowDisplayOfInsecureContent(true)
     , m_allowRunningOfInsecureContent(true)
+    , m_passwordEchoEnabled(false)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
diff --git a/src/3rdparty/webkit/Source/WebCore/page/Settings.h b/src/3rdparty/webkit/Source/WebCore/page/Settings.h
index ffe1037..1d2a138 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/Source/WebCore/page/Settings.h
@@ -407,6 +407,12 @@ namespace WebCore {
         void setAllowRunningOfInsecureContent(bool flag) { m_allowRunningOfInsecureContent = flag; }
         bool allowRunningOfInsecureContent() const { return m_allowRunningOfInsecureContent; }
 
+        void setPasswordEchoEnabled(bool flag) { m_passwordEchoEnabled = flag; }
+        bool passwordEchoEnabled() const { return m_passwordEchoEnabled; }
+
+        void setPasswordEchoDurationInSeconds(double durationInSeconds) { m_passwordEchoDurationInSeconds = durationInSeconds; }
+        double passwordEchoDurationInSeconds() const { return m_passwordEchoDurationInSeconds; }
+
     private:
         Page* m_page;
 
@@ -422,6 +428,7 @@ namespace WebCore {
         AtomicString m_fantasyFontFamily;
         EditableLinkBehavior m_editableLinkBehavior;
         TextDirectionSubmenuInclusionBehavior m_textDirectionSubmenuInclusionBehavior;
+        double m_passwordEchoDurationInSeconds;
         int m_minimumFontSize;
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
@@ -513,6 +520,7 @@ namespace WebCore {
         bool m_shouldInjectUserScriptsInInitialEmptyDocument : 1;
         bool m_allowDisplayOfInsecureContent : 1;
         bool m_allowRunningOfInsecureContent : 1;
+        bool m_passwordEchoEnabled : 1;
 
 #if USE(AVFOUNDATION)
         static bool gAVFoundationEnabled;
diff --git a/src/3rdparty/webkit/Source/WebCore/platform/mac/WebVideoFullscreenHUDWindowController.mm b/src/3rdparty/webkit/Source/WebCore/platform/mac/WebVideoFullscreenHUDWindowController.mm
index 63f15a2..1637c1c 100644
--- a/src/3rdparty/webkit/Source/WebCore/platform/mac/WebVideoFullscreenHUDWindowController.mm
+++ b/src/3rdparty/webkit/Source/WebCore/platform/mac/WebVideoFullscreenHUDWindowController.mm
@@ -29,7 +29,7 @@
 #import "WebVideoFullscreenHUDWindowController.h"
 
 #import "FloatConversion.h"
-#import "WebCoreSystemInterface.h"
+#import <WebCoreSystemInterface.h>
 #import <WebCore/HTMLMediaElement.h>
 #import <wtf/RetainPtr.h>
 #import <wtf/UnusedParam.h>
diff --git a/src/3rdparty/webkit/Source/WebCore/platform/qt/WebCoreSystemInterface.h b/src/3rdparty/webkit/Source/WebCore/platform/qt/WebCoreSystemInterface.h
index 40cb449..e82a6fc 100644
--- a/src/3rdparty/webkit/Source/WebCore/platform/qt/WebCoreSystemInterface.h
+++ b/src/3rdparty/webkit/Source/WebCore/platform/qt/WebCoreSystemInterface.h
@@ -79,6 +79,17 @@ extern void (*wkQTClearMediaDownloadCache)();
 extern void (*wkWindowSetAlpha)(NSWindow *, float);
 extern void (*wkWindowSetScaledFrame)(NSWindow *, NSRect, NSRect);
 
+typedef enum {
+    wkMediaUIControlTimeline,
+    wkMediaUIControlSlider,
+    wkMediaUIControlPlayPauseButton,
+    wkMediaUIControlExitFullscreenButton,
+    wkMediaUIControlRewindButton,
+    wkMediaUIControlFastForwardButton,
+    wkMediaUIControlVolumeUpButton,
+    wkMediaUIControlVolumeDownButton
+} wkMediaUIControlType;
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/CounterNode.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/CounterNode.cpp
index 323f5db..8a88fc9 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/CounterNode.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/CounterNode.cpp
@@ -44,6 +44,49 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
 
 CounterNode::~CounterNode()
 {
+    // Ideally this would be an assert and this would never be reached. In reality this happens a lot
+    // so we need to handle these cases. The node is still connected to the tree so we need to detach it.
+    if (m_parent || m_previousSibling || m_nextSibling || m_firstChild || m_lastChild) {
+        CounterNode* oldParent = 0;
+        CounterNode* oldPreviousSibling = 0;
+        // Instead of calling removeChild() we do this safely as the tree is likely broken if we get here.
+        if (m_parent) {
+            if (m_parent->m_firstChild == this)
+                m_parent->m_firstChild = m_nextSibling;
+            if (m_parent->m_lastChild == this)
+                m_parent->m_lastChild = m_previousSibling;
+            oldParent = m_parent;
+            m_parent = 0;
+        }
+        if (m_previousSibling) {
+            if (m_previousSibling->m_nextSibling == this)
+                m_previousSibling->m_nextSibling = m_nextSibling;
+            oldPreviousSibling = m_previousSibling;
+            m_previousSibling = 0;
+        }
+        if (m_nextSibling) {
+            if (m_nextSibling->m_previousSibling == this)
+                m_nextSibling->m_previousSibling = oldPreviousSibling;
+            m_nextSibling = 0;
+        }
+        if (m_firstChild) {
+            // The node's children are reparented to the old parent.
+            for (CounterNode* child = m_firstChild; child; ) {
+                CounterNode* nextChild = child->m_nextSibling;
+                CounterNode* nextSibling = 0;
+                child->m_parent = oldParent;
+                if (oldPreviousSibling) {
+                    nextSibling = oldPreviousSibling->m_nextSibling;
+                    child->m_previousSibling = oldPreviousSibling;
+                    oldPreviousSibling->m_nextSibling = child;
+                    child->m_nextSibling = nextSibling;
+                    nextSibling->m_previousSibling = child;
+                    oldPreviousSibling = child;
+                }
+                child = nextChild;
+            }
+        }
+    }
     resetRenderers();
 }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.cpp
index 3d20df4..556379e 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.cpp
@@ -37,6 +37,7 @@
 #include "RenderCombineText.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
+#include "Settings.h"
 #include "Text.h"
 #include "TextBreakIterator.h"
 #include "TextResourceDecoder.h"
@@ -53,6 +54,37 @@ using namespace Unicode;
 
 namespace WebCore {
 
+class SecureTextTimer;
+typedef HashMap<RenderText*, SecureTextTimer*> SecureTextTimerMap;
+static SecureTextTimerMap* gSecureTextTimers = 0;
+
+class SecureTextTimer : public TimerBase {
+public:
+    SecureTextTimer(RenderText* renderText)
+        : m_renderText(renderText)
+        , m_lastTypedCharacterOffset(-1)
+    {
+    }
+
+    void restartWithNewText(unsigned lastTypedCharacterOffset)
+    {
+        m_lastTypedCharacterOffset = lastTypedCharacterOffset;
+        startOneShot(m_renderText->document()->settings()->passwordEchoDurationInSeconds());
+    }
+    void invalidate() { m_lastTypedCharacterOffset = -1; }
+    unsigned lastTypedCharacterOffset() { return m_lastTypedCharacterOffset; }
+
+private:
+    virtual void fired()
+    {
+        ASSERT(gSecureTextTimers->contains(m_renderText));
+        m_renderText->setText(m_renderText->text(), true /* forcing setting text as it may be masked later */);
+    }
+
+    RenderText* m_renderText;
+    int m_lastTypedCharacterOffset;
+};
+
 static void makeCapitalized(String* string, UChar previous)
 {
     if (string->isNull())
@@ -196,6 +228,9 @@ void RenderText::removeAndDestroyTextBoxes()
 
 void RenderText::destroy()
 {
+    if (SecureTextTimer* secureTextTimer = gSecureTextTimers ? gSecureTextTimers->take(this) : 0)
+        delete secureTextTimer;
+
     removeAndDestroyTextBoxes();
     RenderObject::destroy();
 }
@@ -1158,13 +1193,13 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
         case TSNONE:
             break;
         case TSCIRCLE:
-            m_text.makeSecure(whiteBullet);
+            secureText(whiteBullet);
             break;
         case TSDISC:
-            m_text.makeSecure(bullet);
+            secureText(bullet);
             break;
         case TSSQUARE:
-            m_text.makeSecure(blackSquare);
+            secureText(blackSquare);
         }
     }
 
@@ -1174,6 +1209,28 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
     m_isAllASCII = m_text.containsOnlyASCII();
 }
 
+void RenderText::secureText(UChar mask)
+{
+    if (!m_text.length())
+        return;
+
+    int lastTypedCharacterOffsetToReveal = -1;
+    String revealedText;
+    SecureTextTimer* secureTextTimer = gSecureTextTimers ? gSecureTextTimers->get(this) : 0;
+    if (secureTextTimer && secureTextTimer->isActive()) {
+        lastTypedCharacterOffsetToReveal = secureTextTimer->lastTypedCharacterOffset();
+        if (lastTypedCharacterOffsetToReveal >= 0)
+            revealedText.append(m_text[lastTypedCharacterOffsetToReveal]);
+    }
+
+    m_text.fill(mask);
+    if (lastTypedCharacterOffsetToReveal >= 0) {
+        m_text.replace(lastTypedCharacterOffsetToReveal, 1, revealedText);
+        // m_text may be updated later before timer fires. We invalidate the lastTypedCharacterOffset to avoid inconsistency.
+        secureTextTimer->invalidate();
+    }
+}
+
 void RenderText::setText(PassRefPtr<StringImpl> text, bool force)
 {
     ASSERT(text);
@@ -1597,4 +1654,17 @@ void RenderText::checkConsistency() const
 
 #endif
 
+void RenderText::momentarilyRevealLastTypedCharacter(unsigned lastTypedCharacterOffset)
+{
+    if (!gSecureTextTimers)
+        gSecureTextTimers = new SecureTextTimerMap;
+
+    SecureTextTimer* secureTextTimer = gSecureTextTimers->get(this);
+    if (!secureTextTimer) {
+        secureTextTimer = new SecureTextTimer(this);
+        gSecureTextTimers->add(this, secureTextTimer);
+    }
+    secureTextTimer->restartWithNewText(lastTypedCharacterOffset);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.h b/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.h
index 2008dad..f89a762 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.h
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderText.h
@@ -117,6 +117,9 @@ public:
 
     bool containsReversedText() const { return m_containsReversedText; }
 
+    bool isSecure() const { return style()->textSecurity() != TSNONE; }
+    void momentarilyRevealLastTypedCharacter(unsigned lastTypedCharacterOffset);
+
     InlineTextBox* findNextInlineTextBox(int offset, int& pos) const;
 
     bool allowTabs() const { return !style()->collapseWhiteSpace(); }
@@ -158,6 +161,7 @@ private:
     void updateNeedsTranscoding();
 
     inline void transformText(String&) const;
+    void secureText(UChar mask);
 
     float m_minWidth; // here to minimize padding in 64-bit.
 
diff --git a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyleElement.cpp b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyleElement.cpp
index 042af1c..01adb35 100644
--- a/src/3rdparty/webkit/Source/WebCore/svg/SVGStyleElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/svg/SVGStyleElement.cpp
@@ -42,8 +42,7 @@ inline SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document*
 
 SVGStyleElement::~SVGStyleElement()
 {
-    if (m_sheet)
-        m_sheet->clearOwnerNode();
+    StyleElement::clearDocumentData(document(), this);
 }
 
 PassRefPtr<SVGStyleElement> SVGStyleElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/Internals.cpp b/src/3rdparty/webkit/Source/WebCore/testing/Internals.cpp
new file mode 100644
index 0000000..caa1274
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/Internals.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Internals.h"
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+const char* Internals::internalsId = "internals";
+
+PassRefPtr<Internals> Internals::create()
+{
+    return adoptRef(new Internals);
+}
+
+Internals::~Internals()
+{
+}
+
+Internals::Internals()
+    : passwordEchoDurationInSecondsBackedUp(false)
+    , passwordEchoEnabledBackedUp(false)
+{
+}
+
+void Internals::setPasswordEchoEnabled(Document* document, bool enabled, ExceptionCode& ec)
+{
+    if (!document || !document->settings()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    if (!passwordEchoEnabledBackedUp) {
+        passwordEchoEnabledBackup = document->settings()->passwordEchoEnabled();
+        passwordEchoEnabledBackedUp = true;
+    }
+    document->settings()->setPasswordEchoEnabled(enabled);
+}
+
+void Internals::setPasswordEchoDurationInSeconds(Document* document, double durationInSeconds, ExceptionCode& ec)
+{
+    if (!document || !document->settings()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    if (!passwordEchoDurationInSecondsBackedUp) {
+        passwordEchoDurationInSecondsBackup = document->settings()->passwordEchoDurationInSeconds();
+        passwordEchoDurationInSecondsBackedUp = true;
+    }
+    document->settings()->setPasswordEchoDurationInSeconds(durationInSeconds);
+}
+
+void Internals::reset(Document* document)
+{
+    if (!document || !document->settings())
+        return;
+
+    if (passwordEchoDurationInSecondsBackedUp) {
+        document->settings()->setPasswordEchoDurationInSeconds(passwordEchoDurationInSecondsBackup);
+        passwordEchoDurationInSecondsBackedUp = false;
+    }
+
+    if (passwordEchoEnabledBackedUp) {
+        document->settings()->setPasswordEchoEnabled(passwordEchoEnabledBackup);
+        passwordEchoEnabledBackedUp = false;
+    }
+}
+
+}
+
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/Internals.h b/src/3rdparty/webkit/Source/WebCore/testing/Internals.h
new file mode 100644
index 0000000..a56240a
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/Internals.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Internals_h
+#define Internals_h
+
+#include "ExceptionCode.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Document;
+
+class Internals : public RefCounted<Internals> {
+public:
+    static PassRefPtr<Internals> create();
+    virtual ~Internals();
+
+    void reset(Document*);
+
+    void setPasswordEchoEnabled(Document*, bool enabled, ExceptionCode&);
+    void setPasswordEchoDurationInSeconds(Document*, double durationInSeconds, ExceptionCode&);
+
+    static const char* internalsId;
+
+private:
+    Internals();
+
+    double passwordEchoDurationInSecondsBackup;
+    bool passwordEchoEnabledBackup : 1;
+    bool passwordEchoDurationInSecondsBackedUp : 1;
+    bool passwordEchoEnabledBackedUp : 1;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/Internals.idl b/src/3rdparty/webkit/Source/WebCore/testing/Internals.idl
new file mode 100644
index 0000000..e647c9c
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/Internals.idl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [OmitConstructor] Internals {
+        void setPasswordEchoEnabled(in Document document, in boolean enabled) raises(DOMException);
+        void setPasswordEchoDurationInSeconds(in Document document, in double durationInSeconds) raises(DOMException);
+    };
+}
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.cpp b/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.cpp
new file mode 100644
index 0000000..8a795bf
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCoreTestSupport.h"
+
+#include "Internals.h"
+#include "JSDOMGlobalObject.h"
+#include "JSDocument.h"
+#include "JSInternals.h"
+#include <JavaScriptCore/APICast.h>
+#include <interpreter/CallFrame.h>
+
+using namespace JSC;
+using namespace WebCore;
+
+namespace WebCoreTestSupport {
+
+void injectInternalsObject(JSContextRef context)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(context);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
+    globalObject->putDirect(exec->globalData(), Identifier(exec, Internals::internalsId), toJS(exec, globalObject, Internals::create()));
+}
+
+void resetInternalsObject(JSContextRef context)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = toJS(context);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
+    Internals * internals = toInternals(globalObject->getDirect(exec->globalData(), Identifier(exec, Internals::internalsId)));
+    if (internals) {
+        ScriptExecutionContext* scriptContext = globalObject->scriptExecutionContext();
+        if (scriptContext->isDocument())
+            internals->reset(static_cast<Document*>(scriptContext));
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.h b/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.h
new file mode 100644
index 0000000..bfd8a8b
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/js/WebCoreTestSupport.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCoreTestSupport_h
+#define WebCoreTestSupport_h
+
+typedef const struct OpaqueJSContext* JSContextRef;
+
+namespace WebCoreTestSupport {
+
+void injectInternalsObject(JSContextRef);
+void resetInternalsObject(JSContextRef);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.cpp b/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
new file mode 100644
index 0000000..1f2c2e5
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebCoreTestSupport.h"
+
+#include "Document.h"
+#include "Internals.h"
+#include "ScriptExecutionContext.h"
+#include "V8Internals.h"
+
+#include <v8.h>
+
+using namespace WebCore;
+
+namespace WebCoreTestSupport {
+
+void injectInternalsObject(v8::Local<v8::Context> context)
+{
+    v8::Context::Scope contextScope(context);
+    v8::HandleScope scope;
+
+    context->Global()->Set(v8::String::New(Internals::internalsId), toV8(Internals::create()));
+}
+
+void resetInternalsObject(v8::Local<v8::Context> context)
+{
+    v8::Context::Scope contextScope(context);
+    v8::HandleScope scope;
+
+    v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(context->Global()->Get(v8::String::New(Internals::internalsId)));
+    Internals * internals = V8Internals::toNative(object);
+    if (internals) {
+        ScriptExecutionContext* scriptContext = getScriptExecutionContext();
+        if (scriptContext->isDocument())
+            internals->reset(static_cast<Document*>(scriptContext));
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.h b/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.h
new file mode 100644
index 0000000..fa49c60
--- /dev/null
+++ b/src/3rdparty/webkit/Source/WebCore/testing/v8/WebCoreTestSupport.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCoreTestSupport_h
+#define WebCoreTestSupport_h
+
+namespace v8 {
+class Context;
+template <class T> class Local;
+}
+
+namespace WebCoreTestSupport {
+
+void injectInternalsObject(v8::Local<v8::Context>);
+void resetInternalsObject(v8::Local<v8::Context>);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebsettings.cpp
index 3606764..9123ede 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -273,6 +273,11 @@ void QWebSettingsPrivate::apply()
         settings->setNeedsSiteSpecificQuirks(value);
 
         settings->setUsesPageCache(WebCore::pageCache()->capacity());
+
+#if ENABLE(PASSWORD_ECHO)
+        settings->setPasswordEchoEnabled(true);
+        settings->setPasswordEchoDurationInSeconds(1);
+#endif
     } else {
         QList<QWebSettingsPrivate*> settings = *::allSettings();
         for (int i = 0; i < settings.count(); ++i)
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
index a9d5e7a..33ee4c2 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,73 @@
+2011-08-25  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        Unreviewed QtWebKit.pro fix for when building inside Qt
+
+        Patch by Simo Fält <simo.falt@nokia.com>
+
+        The QtWebKit version was being overwritten by a global Qt version when
+        QtWebKit was built inside Qt. Fixed by moving the version
+        definition after the inclusion of qbase.pri.
+
+        * QtWebKit.pro:
+
+2011-08-18  Chang Shu  <cshu@webkit.org>
+
+        Add support of setPasswordEchoEnabled and setPasswordEchoDuration for password echo feature
+        https://bugs.webkit.org/show_bug.cgi?id=66052
+
+        Reviewed by Alexey Proskuryakov.
+
+        Enable password echo under the build flag.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+
+2011-08-16  Chang Shu  <cshu@webkit.org>
+
+        Support reset in WebCore::Internals
+        https://bugs.webkit.org/show_bug.cgi?id=66307
+
+        Reviewed by Dimitri Glazkov.
+
+        Added framework code in WebKit.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::resetInternalsObject):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2011-06-09  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Teach Qt about window.internals
+        https://bugs.webkit.org/show_bug.cgi?id=61074
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::injectInternalsObject):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2011-08-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix build on Lion
+
+        https://bugs.webkit.org/show_bug.cgi?id=66770
+
+        Reviewed by Andreas Kling.
+
+        We were mistakenly picking up mac/WebCoreSystemInterface.h instead of
+        the Qt one, and building on Lion revealed this when a typedef for
+        IOSurfaceRef was wrapped in PLATFORM(MAC).
+
+        For now we fix this by including WebCoreSystemInterface using
+        brackets, so that we'll pick up the right file based on the
+        include paths. This also means exposing a few missing enums
+        in our own version of the file, so those were added.
+
+        Lasty, we need to link against the right system interface library
+        on Lion.
+
+        * QtWebKit.pro:
+
 2011-08-05  Dawit Alemayehu  <adawit@kde.org>
 
         Reviewed by Andreas Kling.
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/QtWebKit.pro b/src/3rdparty/webkit/Source/WebKit/qt/QtWebKit.pro
index 0c5ca2f..41b0d39 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/QtWebKit.pro
+++ b/src/3rdparty/webkit/Source/WebKit/qt/QtWebKit.pro
@@ -42,10 +42,6 @@ win32*:!win32-msvc* {
     contains(DEFINES, ENABLE_WEBGL=1)|contains(CONFIG, texmap): LIBS += $$QMAKE_LIBS_OPENGL
 }
 
-moduleFile=$$PWD/qt_webkit_version.pri
-isEmpty(QT_BUILD_TREE):include($$moduleFile)
-VERSION = $${QT_WEBKIT_MAJOR_VERSION}.$${QT_WEBKIT_MINOR_VERSION}.$${QT_WEBKIT_PATCH_VERSION}
-
 include_webinspector: RESOURCES += $$SOURCE_DIR/WebCore/inspector/front-end/WebKit.qrc $$WC_GENERATED_SOURCES_DIR/InspectorBackendStub.qrc
 
 # Extract sources to build from the generator definitions
@@ -87,6 +83,9 @@ CONFIG(QTDIR_build) {
     symbian: TARGET =$$TARGET$${QT_LIBINFIX}
 }
 
+moduleFile=$$PWD/qt_webkit_version.pri
+isEmpty(QT_BUILD_TREE):include($$moduleFile)
+VERSION = $${QT_WEBKIT_MAJOR_VERSION}.$${QT_WEBKIT_MINOR_VERSION}.$${QT_WEBKIT_PATCH_VERSION}
 
 symbian {
     TARGET.EPOCALLOWDLLDATA=1
@@ -245,12 +244,12 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         # We can know the Mac OS version by using the Darwin major version
         DARWIN_VERSION = $$split(QMAKE_HOST.version, ".")
         DARWIN_MAJOR_VERSION = $$first(DARWIN_VERSION)
-        equals(DARWIN_MAJOR_VERSION, "10") {
-            LIBS+= $$SOURCE_DIR/../WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
-        } else {
-            equals(DARWIN_MAJOR_VERSION, "9") {
-                LIBS+= $$SOURCE_DIR/../WebKitLibraries/libWebKitSystemInterfaceLeopard.a
-            }
+        equals(DARWIN_MAJOR_VERSION, "11") {
+            LIBS += $$SOURCE_DIR/../WebKitLibraries/libWebKitSystemInterfaceLion.a
+        } else:equals(DARWIN_MAJOR_VERSION, "10") {
+            LIBS += $$SOURCE_DIR/../WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+        } else:equals(DARWIN_MAJOR_VERSION, "9") {
+            LIBS += $$SOURCE_DIR/../WebKitLibraries/libWebKitSystemInterfaceLeopard.a
         }
     }
 }
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 9d0b4f9..2fc8e84 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -23,6 +23,9 @@
 #include "config.h"
 #include "DumpRenderTreeSupportQt.h"
 
+#if USE(JSC)
+#include "APICast.h"
+#endif
 #include "ApplicationCacheStorage.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "ChromeClientQt.h"
@@ -74,6 +77,7 @@
 #include "SVGSMILElement.h"
 #endif
 #include "TextIterator.h"
+#include "WebCoreTestSupport.h"
 #include "WorkerThread.h"
 #include <wtf/CurrentTime.h>
 
@@ -1109,6 +1113,44 @@ void DumpRenderTreeSupportQt::removeShadowRoot(const QWebElement& element)
     webElement->removeShadowRoot();
 }
 
+void DumpRenderTreeSupportQt::injectInternalsObject(QWebFrame* frame)
+{
+    WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
+#if USE(JSC)
+    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+
+    JSDOMWindow* window = toJSDOMWindow(coreFrame, mainThreadNormalWorld());
+    Q_ASSERT(window);
+
+    JSC::ExecState* exec = window->globalExec();
+    Q_ASSERT(exec);
+
+    JSContextRef context = toRef(exec);
+    WebCoreTestSupport::injectInternalsObject(context);
+#elif USE(V8)
+    WebCoreTestSupport::injectInternalsObject(V8Proxy::mainWorldContext(coreFrame));
+#endif
+}
+
+void DumpRenderTreeSupportQt::resetInternalsObject(QWebFrame* frame)
+{
+    WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
+#if USE(JSC)
+    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+
+    JSDOMWindow* window = toJSDOMWindow(coreFrame, mainThreadNormalWorld());
+    Q_ASSERT(window);
+
+    JSC::ExecState* exec = window->globalExec();
+    Q_ASSERT(exec);
+
+    JSContextRef context = toRef(exec);
+    WebCoreTestSupport::resetInternalsObject(context);
+#elif USE(V8)
+    WebCoreTestSupport::resetInternalsObject(V8Proxy::mainWorldContext(coreFrame));
+#endif
+}
+
 // Provide a backward compatibility with previously exported private symbols as of QtWebKit 4.6 release
 
 void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* frame)
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index c93942c..7040ea1 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -218,6 +218,7 @@ public:
     static QString layerTreeAsText(QWebFrame*);
 
     static void injectInternalsObject(QWebFrame*);
+    static void resetInternalsObject(QWebFrame*);
 };
 
 #endif
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index a90dc4e..97448a7 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        4277f8277b1daf3ec33c996f5a760ccd1113af4b
+        836fa24be73978fb292e954abb151fb46b1d97e0