Merge branch 'master' of git://scm.dev.nokia.troll.no/qt/qt-fire-team

* 'master' of git://scm.dev.nokia.troll.no/qt/qt-fire-team: (120 commits)
  Disable autotest broken by the change to QCache in 7ab0bed
  Generate glyphs in un-transformed coordinate system.
  Use QT_MAX_CACHED_GLYPH_SIZE in QFontEngineFT
  Reset trailingSpaces in relayout
  Prevent QPixmapCache potentially growing indefinitely.
  Allocate 16-byte aligned memory independent of platform for raster pool.
  Fix trailing spaces problem by not adding it to QScriptLine.length
  fix build for desktop
  Dragging in nested views no longer works as expected
  Fix the build with -qtnamespace configure options
  Updated WebKit to a2bd2bb (qtwebkit-2.2-week35)
  Fix implicit height not growing when pre-edit text wraps.
  Removed the unnecessary dependency of the QtHelp module on the QtXml one
  Modified \since command behavior slightly to handle project and version.
  Added an additional check to workaround an issue on Windows.
  Fix leak in State element.
  Fix leak in bindings created by PropertyChanges.
  Revert readonly BorderImage::sourceSize change
  URLs used with scheme handler use appropriate encoding for scheme
  Update license headers
  ...

28 files changed, 418 insertions, 72 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index a560e52..458898a 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-dda59e50379214c098f365a39c4d64b39ced427e
+a2bd2bb1b19949c6807da38e25bfa7d210bb4b17
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 5f97e57..bc11b4d 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,26 +1,3 @@
-2011-08-26  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
-
-        [Qt] libwebcore.a source is compiled without -fvisibility=hidden
-        -fvisibility-inlines-hidden
-        https://bugs.webkit.org/show_bug.cgi?id=65470
-
-        Patch by Holger Freyther <zecke@selfish.org>
-        Rubberstamped by Andreas Kling.
-
-        (qtwebkit-2.2 only by now)
-
-        WTF_USE_EXPORT_MACROS is still not enabled on trunk because there are
-        pending issues with WebKit2, but it appears to be safe to enable this
-        on QtWebKit, so this change is being added to the qtwebkit-2.2 branch.
-
-        The patch also adds CONFIG += hide_symbols and on Unix, +=
-        bsymbolic_functions, which should help reduce the library binary size.
-
-        Testing this is quite easy, so if there's any problem we'll soon
-        know. :-)
-
-        * Source/WebKit.pri:
-
 2011-08-06  Aron Rosenberg  <arosenberg@logitech.com>
 
         Reviewed by Benjamin Poulain.
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
index 010e66a..5aec2e3 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
@@ -1,23 +1,36 @@
-2011-08-26  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+2011-08-30  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
-        [Qt] libwebcore.a source is compiled without -fvisibility=hidden
-        -fvisibility-inlines-hidden
-        https://bugs.webkit.org/show_bug.cgi?id=65470
+        [Qt] Do not unconditionally use pkg-config in .pro files
+        https://bugs.webkit.org/show_bug.cgi?id=67055
 
-        Patch by Holger Freyther <zecke@selfish.org>
-        Rubberstamped by Andreas Kling.
+        Reviewed by Andreas Kling.
+
+        Original patch from Rohan McGovern <rohan.mcgovern@nokia.com>
+
+        Using the first pkg-config in PATH is prone to errors when cross
+        compiling inside the Qt repository (using Qt's build-system).
+
+        This patch protect calls for pkg-config with
+        !contains(QT_CONFIG, no-pkg-config). no-pkg-config is added to
+        QT_CONFIG by Qt's 'configure' when cross-compiling on systems
+        without pkg-config.
 
-        (qtwebkit-2.2 only by now)
+        The respective change in Qt's configure has been submited already.
 
-        WTF_USE_EXPORT_MACROS is still not enabled on trunk because there are
-        pending issues with WebKit2, but it appears to be safe to enable this
-        on QtWebKit, so this change is being added to the qtwebkit-2.2 branch.
+        No new tests as this is just a build change.
 
-        The patch also adds CONFIG += hide_symbols and on Unix, +=
-        bsymbolic_functions, which should help reduce the library binary size.
+        * wtf/wtf.pri: protect pkg-config calls
+
+2011-08-28  Jonathan Liu  <net147@gmail.com>
+
+        Fix build error when compiling with MinGW-w64 by disabling JIT
+        on Windows 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=61235
+
+        Reviewed by Gavin Barraclough.
 
-        Testing this is quite easy, so if there's any problem we'll soon
-        know. :-)
+        The fixed mmap executable allocator for JIT on x86_64 requires
+        sys/mman.h which is not available on Windows.
 
         * wtf/Platform.h:
 
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
index 8309acc..a8298c4 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/Platform.h
@@ -1014,8 +1014,8 @@
 #define ENABLE_JIT 0
 #endif
 
-/* JIT is not implemented for 64 bit on MSVC */
-#if !defined(ENABLE_JIT) && COMPILER(MSVC) && CPU(X86_64)
+/* JIT is not implemented for Windows 64-bit */
+#if !defined(ENABLE_JIT) && OS(WINDOWS) && CPU(X86_64)
 #define ENABLE_JIT 0
 #endif
 
@@ -1221,11 +1221,7 @@
    since most ports try to support sub-project independence, adding new headers
    to WTF causes many ports to break, and so this way we can address the build
    breakages one port at a time. */
-#if PLATFORM(QT)
-#define WTF_USE_EXPORT_MACROS 1
-#else
 #define WTF_USE_EXPORT_MACROS 0
-#endif
 
 #if PLATFORM(QT) || PLATFORM(GTK)
 #define WTF_USE_UNIX_DOMAIN_SOCKETS 1
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/wtf.pri b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/wtf.pri
index 5af613e..ccc2f60 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/wtf.pri
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/wtf.pri
@@ -42,7 +42,7 @@ SOURCES += \
     wtf/unicode/UTF8.cpp
 
 linux-*:!contains(DEFINES, USE_QTMULTIMEDIA=1) {
-    !contains(QT_CONFIG, no-pkg-config):system(pkg-config --exists glib-2.0 gio-2.0 gstreamer-0.10) {
+    !contains(QT_CONFIG, no-pkg-config):system(pkg-config --exists glib-2.0 gio-2.0 gstreamer-0.10): {
         DEFINES += ENABLE_GLIB_SUPPORT=1
         PKGCONFIG += glib-2.0 gio-2.0
         CONFIG += link_pkgconfig
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index 41d2ba7..a781b1f 100644
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,170 @@
+2011-08-30  Abhishek Arya  <inferno@chromium.org>
+
+        Removed m_owner accessed in custom scrollbars.
+        https://bugs.webkit.org/show_bug.cgi?id=64737
+
+        Reviewed by David Hyatt.
+
+        Problem does not reproduce in DRT, even with Eventhandler tricks
+        and gc(). So, adding a manual test.
+
+        * manual-tests/custom-scrollbar-renderer-removed-crash.html: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::clearOwningRendererForCustomScrollbars):
+        * page/FrameView.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed): when this renderbox is getting
+        destroyed, clear the custom scrollbar in this frameview having this renderbox
+        as its owning renderer.
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle): fix the null check.
+
+2011-09-04  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in Range::processAncestorsAndTheirSiblings.
+        https://bugs.webkit.org/show_bug.cgi?id=67556
+
+        Reviewed by Ryosuke Niwa.
+
+        Create a temporary RefPtr Node vector to keep all the ancestor's
+        childs so that we don't access removed child nodes.
+
+        Test: fast/dom/Range/range-delete-contents-event-fire-crash.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents):
+        (WebCore::Range::processAncestorsAndTheirSiblings):
+
+2011-08-30  Adam Barth  <abarth@webkit.org>
+
+        Flaky crash with JavaScript URLs
+        https://bugs.webkit.org/show_bug.cgi?id=66360
+
+        Reviewed by Nate Chapin.
+
+        This patch teaches DocumentWriter::begin to make a copy of the URL
+        before beginning a new document to avoid a crash.
+
+        Test: fast/loader/javascript-url-iframe-crash.html
+
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::begin):
+
+2011-08-30  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Emit last progress notification before calling dispatchDidFinishLoad
+        https://bugs.webkit.org/show_bug.cgi?id=28851
+
+        Reviewed by Adam Barth.
+
+        Original patch by Xan Lopez. Change FrameLoader to dispatch the notifications in
+        a more natural sequence.
+
+        Test: http/tests/loading/progress-finished-callback.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2011-08-22  Nate Chapin  <japhet@chromium.org>
+
+        Unload events can crash us when they blank out
+        a parent frame.
+        https://bugs.webkit.org/show_bug.cgi?id=64741
+
+        Reviewed by Adam Barth.
+
+        Test: fast/loader/document-destruction-within-unload.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Prevent unload events
+            from going into infinite recursion.
+        (WebCore::FrameLoader::setDocumentLoader): Ensure we don't
+            let set m_documentLoader to a DocumentLoader with a null Frame*.
+        (WebCore::FrameLoader::detachChildren): Save off a vector of
+            children to detach, rather than doing it inline.
+
+2011-08-30  Abhishek Arya  <inferno@chromium.org>
+
+        Style not updated for table parts in :before, :after content.
+        https://bugs.webkit.org/show_bug.cgi?id=66141        
+
+        Reviewed by Dave Hyatt.
+
+        Tests: fast/table/table-before-child-style-update.html
+               fast/table/table-row-before-child-style-update.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2011-08-25  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect layout of :before and :after content, with display
+        table, table-row and table-cell.
+        https://bugs.webkit.org/show_bug.cgi?id=66699
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/table/table-after-child-in-table.html
+               fast/table/table-before-child-in-table.html
+               fast/table/table-cell-after-child-in-block.html
+               fast/table/table-cell-after-child-in-table.html
+               fast/table/table-cell-before-child-in-block.html
+               fast/table/table-cell-before-child-in-table.html
+               fast/table/table-row-after-child-in-block.html
+               fast/table/table-row-after-child-in-table.html
+               fast/table/table-row-before-child-in-block.html
+               fast/table/table-row-before-child-in-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        Fix the looping condition to detect :after child correctly.
+        isAnonymousBlock() does not apply to tables, instead
+        using isAnonymous().
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild): Don't add the new child
+        in the generatedContainer with :before, :after content.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): Don't add the new child
+        in the generatedContainer with :before, :after content.
+
+2011-08-29  Abhishek Arya  <inferno@chromium.org>
+
+        Crash in InlineBox::deleteLine due to accessing removed
+        renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=66015
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/block/line-layout/inline-box-wrapper-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionLineBox): Make sure that the
+        previous inline box wrapper is destroyed properly, before
+        setting a new one.
+
+2011-08-30  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        [Qt] Do not unconditionally use pkg-config in .pro files
+        https://bugs.webkit.org/show_bug.cgi?id=67055
+
+        Reviewed by Andreas Kling.
+
+        Original patch from Rohan McGovern <rohan.mcgovern@nokia.com>
+
+        Using the first pkg-config in PATH is prone to errors when cross
+        compiling inside the Qt repository (using Qt's build-system).
+
+        This patch protect calls for pkg-config with
+        !contains(QT_CONFIG, no-pkg-config). no-pkg-config is added to
+        QT_CONFIG by Qt's 'configure' when cross-compiling on systems
+        without pkg-config.
+
+        The respective change in Qt's configure has been submited already.
+
+        No new tests as this is just a build change.
+
+        * features.pri: protect pkg-config calls
+
 2011-08-25  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
         [Qt] Enable password echo on Symbian builds
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp b/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
index 0c247c2..4f8ad85 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/Range.cpp
@@ -51,6 +51,8 @@ using namespace std;
 static WTF::RefCountedLeakCounter rangeCounter("Range");
 #endif
 
+typedef Vector<RefPtr<Node> > NodeVector;
+
 inline Range::Range(PassRefPtr<Document> ownerDocument)
     : m_ownerDocument(ownerDocument)
     , m_start(m_ownerDocument)
@@ -665,8 +667,6 @@ static inline unsigned lengthOfContentsInNode(Node* node)
 
 PassRefPtr<DocumentFragment> Range::processContents(ActionType action, ExceptionCode& ec)
 {
-    typedef Vector<RefPtr<Node> > NodeVector;
-
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
         fragment = DocumentFragment::create(m_ownerDocument.get());
@@ -880,9 +880,14 @@ PassRefPtr<Node> Range::processAncestorsAndTheirSiblings(ActionType action, Node
         // FIXME: This assertion may fail if DOM is modified during mutation event
         // FIXME: Share code with Range::processNodes
         ASSERT(!firstChildInAncestorToProcess || firstChildInAncestorToProcess->parentNode() == ancestor);
-        RefPtr<Node> next;
-        for (Node* child = firstChildInAncestorToProcess.get(); child; child = next.get()) {
-            next = direction == ProcessContentsForward ? child->nextSibling() : child->previousSibling();
+        
+        NodeVector nodes;
+        for (Node* child = firstChildInAncestorToProcess.get(); child;
+            child = (direction == ProcessContentsForward) ? child->nextSibling() : child->previousSibling())
+            nodes.append(child);
+
+        for (NodeVector::const_iterator it = nodes.begin(); it != nodes.end(); it++) {
+            Node* child = it->get();
             switch (action) {
             case DELETE_CONTENTS:
                 ancestor->removeChild(child, ec);
diff --git a/src/3rdparty/webkit/Source/WebCore/features.pri b/src/3rdparty/webkit/Source/WebCore/features.pri
index 3e397a1..f04d0b4 100644
--- a/src/3rdparty/webkit/Source/WebCore/features.pri
+++ b/src/3rdparty/webkit/Source/WebCore/features.pri
@@ -168,7 +168,7 @@ symbian|maemo5|maemo6 {
         DEFINES += WTF_USE_QTKIT=1
         DEFINES -= WTF_USE_QTKIT=0
     } else: linux-*:!contains(DEFINES, USE_QTMULTIMEDIA=1) {
-        !contains(QT_CONFIG, no-pkg-config):system(pkg-config --exists glib-2.0 gio-2.0 gstreamer-0.10) {
+        !contains(QT_CONFIG, no-pkg-config):system(pkg-config --exists glib-2.0 gio-2.0 gstreamer-0.10): {
             DEFINES -= ENABLE_VIDEO=0
             DEFINES += ENABLE_VIDEO=1
             DEFINES += WTF_USE_GSTREAMER=1
diff --git a/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp b/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
index 2fc02d1..cbce0d3 100644
--- a/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/loader/DocumentWriter.cpp
@@ -106,12 +106,17 @@ PassRefPtr<Document> DocumentWriter::createDocument(const KURL& url)
     return DOMImplementation::createDocument(m_mimeType, m_frame, url, m_frame->inViewSourceMode());
 }
 
-void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
+void DocumentWriter::begin(const KURL& urlReference, bool dispatch, SecurityOrigin* origin)
 {
     // We need to take a reference to the security origin because |clear|
     // might destroy the document that owns it.
     RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
 
+    // We grab a local copy of the URL because it's easy for callers to supply
+    // a URL that will be deallocated during the execution of this function.
+    // For example, see <https://bugs.webkit.org/show_bug.cgi?id=66360>.
+    KURL url = urlReference;
+
     // Create a new document before clearing the frame, because it may need to
     // inherit an aliased security context.
     RefPtr<Document> document = createDocument(url);
diff --git a/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
index 1b046b3..4bef249 100644
--- a/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp
@@ -1880,6 +1880,20 @@ void FrameLoader::setDocumentLoader(DocumentLoader* loader)
         m_documentLoader->detachFromFrame();
 
     m_documentLoader = loader;
+
+    // The following abomination is brought to you by the unload event.
+    // The detachChildren() call above may trigger a child frame's unload event,
+    // which could do something obnoxious like call document.write("") on
+    // the main frame, which results in detaching children while detaching children.
+    // This can cause the new m_documentLoader to be detached from its Frame*, but still
+    // be alive. To make matters worse, DocumentLoaders with a null Frame* aren't supposed
+    // to happen when they're still alive (and many places below us on the stack think the
+    // DocumentLoader is still usable). Ergo, we reattach loader to its Frame, and pretend
+    // like nothing ever happened.
+    if (m_documentLoader && !m_documentLoader->frame()) {
+        ASSERT(!m_documentLoader->isLoading());
+        m_documentLoader->setFrame(m_frame);
+    }
 }
 
 void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
@@ -2506,14 +2520,15 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             if (m_stateMachine.creatingInitialEmptyDocument() || !m_stateMachine.committedFirstRealDocumentLoad())
                 return;
 
+            if (Page* page = m_frame->page())
+                page->progress()->progressCompleted(m_frame);
+
             const ResourceError& error = dl->mainDocumentError();
             if (!error.isNull())
                 m_client->dispatchDidFailLoad(error);
             else
                 m_client->dispatchDidFinishLoad();
 
-            if (Page* page = m_frame->page())
-                page->progress()->progressCompleted(m_frame);
             return;
         }
         
@@ -2589,12 +2604,14 @@ void FrameLoader::frameLoadCompleted()
 
 void FrameLoader::detachChildren()
 {
-    // FIXME: Is it really necessary to do this in reverse order?
-    Frame* previous;
-    for (Frame* child = m_frame->tree()->lastChild(); child; child = previous) {
-        previous = child->tree()->previousSibling();
-        child->loader()->detachFromParent();
-    }
+    typedef Vector<RefPtr<Frame> > FrameVector;
+    FrameVector childrenToDetach;
+    childrenToDetach.reserveCapacity(m_frame->tree()->childCount());
+    for (Frame* child = m_frame->tree()->lastChild(); child; child = child->tree()->previousSibling())
+        childrenToDetach.append(child);
+    FrameVector::iterator end = childrenToDetach.end();
+    for (FrameVector::iterator it = childrenToDetach.begin(); it != end; it++)
+        (*it)->loader()->detachFromParent();
 }
 
 void FrameLoader::closeAndRemoveChild(Frame* child)
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
index 3dadbf3..ef72fb7 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
@@ -2277,6 +2277,23 @@ bool FrameView::hasCustomScrollbars() const
     return false;
 }
 
+void FrameView::clearOwningRendererForCustomScrollbars(RenderBox* box)
+{
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = current->get();
+        if (widget->isScrollbar()) {
+            Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
+            if (scrollbar->isCustomScrollbar()) {
+                RenderScrollbar* customScrollbar = toRenderScrollbar(scrollbar);
+                if (customScrollbar->owningRenderer() == box)
+                    customScrollbar->clearOwningRenderer();
+            }
+        }
+    }
+}
+
 FrameView* FrameView::parentFrameView() const
 {
     if (Widget* parentView = parent()) {
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FrameView.h b/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
index fafebfe..b151cfc 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/Source/WebCore/page/FrameView.h
@@ -267,6 +267,8 @@ public:
 
     virtual bool shouldSuspendScrollAnimations() const;
 
+    void clearOwningRendererForCustomScrollbars(RenderBox*);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
index 39c0469..df30adb 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
@@ -665,10 +665,10 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
     // Make sure we don't append things after :after-generated content if we have it.
     if (!beforeChild) {
         RenderObject* lastRenderer = lastChild();
-        if (isAfterContent(lastRenderer))
+        while (lastRenderer && lastRenderer->isAnonymous() && !isAfterContent(lastRenderer))
+            lastRenderer = lastRenderer->lastChild();
+        if (lastRenderer && isAfterContent(lastRenderer))
             beforeChild = lastRenderer;
-        else if (lastRenderer && lastRenderer->isAnonymousBlock() && isAfterContent(lastRenderer->lastChild()))
-            beforeChild = lastRenderer->lastChild();
     }
 
     // If the requested beforeChild is not one of our children, then this is because
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
index 9c2aa48..f052ee7 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBox.cpp
@@ -204,6 +204,11 @@ void RenderBox::destroy()
     if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    // If this renderer is owning renderer for the frameview's custom scrollbars,
+    // we need to clear it from the scrollbar. See webkit bug 64737.
+    if (style() && style()->hasPseudoStyle(SCROLLBAR) && frame() && frame()->view())
+        frame()->view()->clearOwningRendererForCustomScrollbars(this);
+
     RenderBoxModelObject::destroy();
 }
 
@@ -1372,6 +1377,8 @@ void RenderBox::positionLineBox(InlineBox* box)
         box->destroy(renderArena());
     } else if (isReplaced()) {
         setLocation(lroundf(box->x()), lroundf(box->y()));
+        if (m_inlineBoxWrapper)
+            deleteLineBoxWrapper();
         m_inlineBoxWrapper = box;
     }
 }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
index ff9ff15..a6c2da9 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -388,6 +388,21 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
             if (!beforeAfterParent)
                 return;
 
+            // When beforeAfterParent is not equal to child (e.g. in tables),
+            // we need to create new styles inheriting from pseudoElementStyle 
+            // on all the intermediate parents (leaving their display same).
+            if (beforeAfterParent != child) {
+                RenderObject* curr = beforeAfterParent;
+                while (curr && curr != child) {
+                    ASSERT(curr->isAnonymous());
+                    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+                    newStyle->inheritFrom(pseudoElementStyle);
+                    newStyle->setDisplay(curr->style()->display());
+                    curr->setStyle(newStyle);
+                    curr = curr->parent();
+                }
+            }
+
             // Note that if we ever support additional types of generated content (which should be way off
             // in the future), this code will need to be patched.
             for (RenderObject* genChild = beforeAfterParent->firstChild(); genChild; genChild = genChild->nextSibling()) {
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
index 962024c..7a75b2e 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -149,7 +149,7 @@ ScrollbarPart RenderScrollbar::partForStyleResolve()
 
 PassRefPtr<RenderStyle> RenderScrollbar::getScrollbarPseudoStyle(ScrollbarPart partType, PseudoId pseudoId)
 {
-    if (!m_owner)
+    if (!owningRenderer())
         return 0;
 
     s_styleResolvePart = partType;
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
index 2edcfc4..dd44577 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableRow.cpp
@@ -90,7 +90,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous() && last->isTableCell()) {
+        if (last && last->isAnonymous() && last->isTableCell() && !isAfterContent(last) && !isBeforeContent(last)) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -98,7 +98,7 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
         }
 
         // If beforeChild is inside an anonymous cell, insert into the cell.
-        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous()) {
+        if (last && !last->isTableCell() && last->parent() && last->parent()->isAnonymous() && !isAfterContent(last->parent()) && !isBeforeContent(last->parent())) {
             last->parent()->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
index 6b080b8..3f84404 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderTableSection.cpp
@@ -96,7 +96,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* last = beforeChild;
         if (!last)
             last = lastChild();
-        if (last && last->isAnonymous()) {
+        if (last && last->isAnonymous() && !isAfterContent(last) && !isBeforeContent(last)) {
             if (beforeChild == last)
                 beforeChild = last->firstChild();
             last->addChild(child, beforeChild);
@@ -108,7 +108,7 @@ void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild
         RenderObject* lastBox = last;
         while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableRow())
             lastBox = lastBox->parent();
-        if (lastBox && lastBox->isAnonymous()) {
+        if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox) && !isBeforeContent(lastBox)) {
             lastBox->addChild(child, beforeChild);
             return;
         }
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
index 97444cd..5a00374 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderWidget.cpp
@@ -143,6 +143,11 @@ void RenderWidget::destroy()
     if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
+    // If this renderer is owning renderer for the frameview's custom scrollbars,
+    // we need to clear it from the scrollbar. See webkit bug 64737.
+    if (style() && style()->hasPseudoStyle(SCROLLBAR) && frame() && frame()->view())
+        frame()->view()->clearOwningRendererForCustomScrollbars(this);
+
     if (hasLayer()) {
         layer()->clearClipRects();
         setHasLayer(false);
diff --git a/src/3rdparty/webkit/Source/WebKit.pri b/src/3rdparty/webkit/Source/WebKit.pri
index be1c7b7..5bd9577 100644
--- a/src/3rdparty/webkit/Source/WebKit.pri
+++ b/src/3rdparty/webkit/Source/WebKit.pri
@@ -2,9 +2,6 @@
 
 contains(QT_CONFIG, qpa)|contains(QT_CONFIG, embedded): CONFIG += embedded
 
-contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
-unix:contains(QT_CONFIG, reduce_relocations):CONFIG += bsymbolic_functions
-
 # Detect that we are building as a standalone package by the presence of
 # either the generated files directory or as part of the Qt package through
 # QTDIR_build
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
index 0bca4b2..4758de0 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,58 @@
+2011-08-31  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Unskip API test for load signals order
+        https://bugs.webkit.org/show_bug.cgi?id=67285
+
+        Reviewed by Andreas Kling.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::loadSignalsOrder):
+
+2011-08-30  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Emit last progress notification before calling dispatchDidFinishLoad
+        https://bugs.webkit.org/show_bug.cgi?id=28851
+
+        Reviewed by Adam Barth.
+
+        Add infrastructure to dump progressFinishedNotification callback in DRT.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::dumpProgressFinishedCallback):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressFinishedNotification):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2011-09-02  Jade Han  <jade.han@nokia.com>
+
+        [Qt][Symbian] REGRESSION(93235) Missing .def update
+        https://bugs.webkit.org/show_bug.cgi?id=67307
+
+        Reviewed by Laszlo Gombos.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2011-08-12  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        [Qt] Add test for correct order of load signals in QWebPage
+        https://bugs.webkit.org/show_bug.cgi?id=66016
+
+        Reviewed by Benjamin Poulain.
+
+        Add API test to ensure the order of load signals: loadStarted() needs to be emitted
+        first, then loadProgress(100), followed by loadFinished().
+
+        The test is skipped since this right now is broken, the bug
+        https://bugs.webkit.org/show_bug.cgi?id=28851 tracks one possible way to fix.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (SpyForLoadSignalsOrder::SpyForLoadSignalsOrder):
+        (SpyForLoadSignalsOrder::isFinished):
+        (SpyForLoadSignalsOrder::onLoadProgress):
+        (tst_QWebPage::loadSignalsOrder_data):
+        (tst_QWebPage::loadSignalsOrder):
+
 2011-08-25  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
 
         Unreviewed QtWebKit.pro fix for when building inside Qt
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 2fc8e84..5d4bf6d 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -677,6 +677,11 @@ void DumpRenderTreeSupportQt::dumpFrameLoader(bool b)
     FrameLoaderClientQt::dumpFrameLoaderCallbacks = b;
 }
 
+void DumpRenderTreeSupportQt::dumpProgressFinishedCallback(bool b)
+{
+    FrameLoaderClientQt::dumpProgressFinishedCallback = b;
+}
+
 void DumpRenderTreeSupportQt::dumpUserGestureInFrameLoader(bool b)
 {
     FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = b;
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 7040ea1..f485cb5 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -163,6 +163,7 @@ public:
     static QString plainText(const QVariant& rng);
 
     static void dumpFrameLoader(bool b);
+    static void dumpProgressFinishedCallback(bool);
     static void dumpUserGestureInFrameLoader(bool b);
     static void dumpResourceLoadCallbacks(bool b);
     static void dumpResourceResponseMIMETypes(bool b);
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 8971fc4..5e0a2e6 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -170,6 +170,7 @@ static QString drtDescriptionSuitableForTestResult(const RefPtr<WebCore::Node> n
 namespace WebCore {
 
 bool FrameLoaderClientQt::dumpFrameLoaderCallbacks = false;
+bool FrameLoaderClientQt::dumpProgressFinishedCallback = false;
 bool FrameLoaderClientQt::dumpUserGestureInFrameLoaderCallbacks = false;
 bool FrameLoaderClientQt::dumpResourceLoadCallbacks = false;
 bool FrameLoaderClientQt::sendRequestReturnsNullOnRedirect = false;
@@ -586,6 +587,9 @@ void FrameLoaderClientQt::postProgressEstimateChangedNotification()
 
 void FrameLoaderClientQt::postProgressFinishedNotification()
 {
+    if (dumpProgressFinishedCallback)
+        printf("postProgressFinishedNotification\n");
+
     // Send a mousemove event to:
     // (1) update the cursor to change according to whatever is underneath the mouse cursor right now;
     // (2) display the tool tip if the mouse hovers a node which has a tool tip.
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 1be365d..1b9d3b8 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/src/3rdparty/webkit/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -247,6 +247,7 @@ public:
     const KURL& lastRequestedUrl() const { return m_lastRequestedUrl; }
 
     static bool dumpFrameLoaderCallbacks;
+    static bool dumpProgressFinishedCallback;
     static bool dumpUserGestureInFrameLoaderCallbacks;
     static bool dumpResourceLoadCallbacks;
     static bool dumpResourceResponseMIMETypes;
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
index d948de4..0a1c6cb 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/Source/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -878,3 +878,5 @@ EXPORTS
 	_ZN8QDRTNodeD1Ev @ 877 NONAME

 	_ZN8QDRTNodeD2Ev @ 878 NONAME

 	_ZN8QDRTNodeaSERKS_ @ 879 NONAME

+	_ZN23DumpRenderTreeSupportQt21injectInternalsObjectEP9QWebFrame @ 880 NONAME

+	_ZN23DumpRenderTreeSupportQt20resetInternalsObjectEP9QWebFrame @ 881 NONAME

diff --git a/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 893c284..6102102 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -28,6 +28,7 @@
 #include <QMainWindow>
 #include <QMenu>
 #include <QPushButton>
+#include <QStateMachine>
 #include <QStyle>
 #include <QtTest/QtTest>
 #include <QTextCharFormat>
@@ -155,6 +156,8 @@ private slots:
     void navigatorCookieEnabled();
     void deleteQWebViewTwice();
     void renderOnRepaintRequestedShouldNotRecurse();
+    void loadSignalsOrder_data();
+    void loadSignalsOrder();
 
 #ifdef Q_OS_MAC
     void macCopyUnicodeToClipboard();
@@ -3065,5 +3068,57 @@ void tst_QWebPage::renderOnRepaintRequestedShouldNotRecurse()
     QVERIFY(::waitForSignal(&r, SIGNAL(finished())));
 }
 
+class SpyForLoadSignalsOrder : public QStateMachine {
+    Q_OBJECT
+public:
+    SpyForLoadSignalsOrder(QWebPage* page, QObject* parent = 0)
+        : QStateMachine(parent)
+    {
+        connect(page, SIGNAL(loadProgress(int)), SLOT(onLoadProgress(int)));
+
+        QState* waitingForLoadStarted = new QState(this);
+        QState* waitingForLastLoadProgress = new QState(this);
+        QState* waitingForLoadFinished = new QState(this);
+        QFinalState* final = new QFinalState(this);
+
+        waitingForLoadStarted->addTransition(page, SIGNAL(loadStarted()), waitingForLastLoadProgress);
+        waitingForLastLoadProgress->addTransition(this, SIGNAL(lastLoadProgress()), waitingForLoadFinished);
+        waitingForLoadFinished->addTransition(page, SIGNAL(loadFinished(bool)), final);
+
+        setInitialState(waitingForLoadStarted);
+        start();
+    }
+    bool isFinished() const
+    {
+        return !isRunning();
+    }
+public Q_SLOTS:
+    void onLoadProgress(int progress)
+    {
+        if (progress == 100)
+            emit lastLoadProgress();
+    }
+signals:
+    void lastLoadProgress();
+};
+
+void tst_QWebPage::loadSignalsOrder_data()
+{
+    QTest::addColumn<QUrl>("url");
+    QTest::newRow("inline data") << QUrl("data:text/html,This is first page");
+    QTest::newRow("simple page") << QUrl("qrc:///resources/content.html");
+    QTest::newRow("frameset page") << QUrl("qrc:///resources/index.html");
+}
+
+void tst_QWebPage::loadSignalsOrder()
+{
+    QFETCH(QUrl, url);
+    QWebPage page;
+    SpyForLoadSignalsOrder loadSpy(&page);
+    waitForSignal(&loadSpy, SIGNAL(started()));
+    page.mainFrame()->load(url);
+    QTRY_VERIFY(loadSpy.isFinished());
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 413f504..aeaa22c 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        dda59e50379214c098f365a39c4d64b39ced427e
+        a2bd2bb1b19949c6807da38e25bfa7d210bb4b17