Updated WebKit from /home/shausman/src/webkit/trunk to origin/qtwebkit-4.6-staging ( 6b0744eab3f993b9c2bd44e3e79d7664040fd003 )

Changes in WebKit since the last update:

++ b/JavaScriptCore/ChangeLog
2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for QDataStream operators to Vector.

        * wtf/Vector.h:
        (WTF::operator<<):
        (WTF::operator>>):

2009-06-26  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26750

        Allow custom memory allocation control for JavaScriptCore/runtime
        directory's classes which instantiated by new:

        class  IdentifierTable
        struct RegExpObjectData
        class  HashEntry
        struct DataInstance::Cache
        class  UString
        struct RegExpConstructorPrivate
        class  ScopeChain

        * runtime/DateInstance.cpp:
        * runtime/Identifier.cpp:
        * runtime/Lookup.h:
        * runtime/RegExpConstructor.cpp:
        * runtime/RegExpObject.h:
        * runtime/ScopeChain.h:
        * runtime/UString.h:

2009-06-24  Sam Weinig  <sam@webkit.org>

        Reviewed by Gavin Barraclough.

        Make the opcode sampler work once again.

        * jit/JIT.h:
        (JSC::JIT::compileGetByIdProto):
        (JSC::JIT::compileGetByIdSelfList):
        (JSC::JIT::compileGetByIdProtoList):
        (JSC::JIT::compileGetByIdChainList):
        (JSC::JIT::compileGetByIdChain):
        (JSC::JIT::compilePutByIdTransition):
        (JSC::JIT::compileCTIMachineTrampolines):
        (JSC::JIT::compilePatchGetArrayLength):
        * jit/JITStubCall.h:
        (JSC::JITStubCall::call):

2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Maciej Stachowiak.

        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
        unnecessary WTF:: usings.
        Remove existing unnecessary WTF:: usings.

        * interpreter/Interpreter.h:
        * profiler/CallIdentifier.h:
        * runtime/ScopeChain.h:
        * wtf/FastAllocBase.h:

2009-06-24  David Levin  <levin@chromium.org>

        Fix all builds.

        * bytecode/CodeBlock.h:
        * bytecompiler/BytecodeGenerator.h:
        * interpreter/Register.h:

2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Maciej Stachowiak.

        https://bugs.webkit.org/show_bug.cgi?id=26677

        Inherits CodeBlock class from FastAllocBase because it
        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.

        * bytecode/CodeBlock.h:

2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Maciej Stachowiak.

        https://bugs.webkit.org/show_bug.cgi?id=26676

        Inherits BytecodeGenerator class from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.

        * bytecompiler/BytecodeGenerator.h:

2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Maciej Stachowiak.

        https://bugs.webkit.org/show_bug.cgi?id=26675

        Inherits Register class from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.

        * interpreter/Register.h:

2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=26674

        Inherits HashMap class from FastAllocBase because it has been
        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.

        * wtf/HashMap.h:

2009-06-24  Oliver Hunt  <oliver@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'

        The problem was caused by the page returned with a function using a
        var declaration list containing around ~3000 variables.  The solution
        to this is to flatten the comma expression representation and make
        codegen comma expressions and initializer lists iterative rather than
        recursive.

        * parser/Grammar.y:
        * parser/NodeConstructors.h:
        (JSC::CommaNode::CommaNode):
        * parser/Nodes.cpp:
        (JSC::CommaNode::emitBytecode):
        * parser/Nodes.h:
        (JSC::ExpressionNode::isCommaNode):
        (JSC::CommaNode::isCommaNode):
        (JSC::CommaNode::append):

++ b/LayoutTests/ChangeLog
2009-06-26  Adele Peterson  <adele@apple.com>

        Reviewed by Darin Adler.

        Test for <rdar://problem/7000796>
        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages

        * editing/inserting/break-blockquote-after-delete.html: Added.
        * platform/mac/editing/inserting/break-blockquote-after-delete-expected.checksum: Added.
        * platform/mac/editing/inserting/break-blockquote-after-delete-expected.png: Added.
        * platform/mac/editing/inserting/break-blockquote-after-delete-expected.txt: Added.

2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Bug 20303: [Qt] Key events are not working in frames.

        Add a layout test to test the event is sent to the right sub-frame.

        * platform/qt/fast/events/event-sender-keydown-frame-expected.txt: Added.
        * platform/qt/fast/events/event-sender-keydown-frame.html: Added.

2009-06-26  Rob Buis  <rwlbuis@gmail.com>

        Reviewed by Eric Seidel.

        Test for:
        https://bugs.webkit.org/show_bug.cgi?id=26682
        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)

        * platform/mac/svg/custom/createImageElement-expected.checksum: Added
        * platform/mac/svg/custom/createImageElement-expected.png: Added
        * platform/mac/svg/custom/createImageElement-expected.txt: Added.
        * svg/custom/createImageElement.svg: Added.

2009-06-26  Takeshi Yoshino  <tyoshino@google.com>

        Reviewed by Timothy Hatcher.

        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
        https://bugs.webkit.org/show_bug.cgi?id=26156

        When in view-source mode, render the contents using HTMLViewSourceDocument
        regardless it's applicable for any plugin or not.

        Chromium tells WebCore to render the contents of specified URL when
        view-source: prefix is added to the URL. But currently, DOMImplementation
        ignores inViewSourceMode() when the MIME type is indicating that the contents
        are neither texts nor HTML family documents.

        For example, we can check the contents of asf file without launching media
        player. Rendering contents for view-source:-specified input is not what user
        expects.

        http://code.google.com/p/chromium/issues/detail?id=10545

        I want to fix this issue by this patch. IMHO, regardless of this Chromium
        specific issue, I think we should force use of HTMLViewSourceDocument when
        inViewSourceMode() is specified.

        * fast/frames/resources/viewsource-fake-image-file.png: Added.
        * fast/frames/viewsource-on-image-file.html: Added.
        * platform/mac/fast/frames/viewsource-on-image-file-expected.txt: Added.

2009-06-26  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Sam Weinig.

        <rdar://problem/6651201> Update lookalike character list.

        * fast/encoding/idn-security-expected.txt:
        * fast/encoding/idn-security.html:

2009-06-26  Jungshik Shin  <jshin@chromium.org>

        Reviewed by Eric Seidel.

        Add an additional test for bug 23786 (mistreatment of CR/LF
        as zero-width characters in Chromium port).  Tests using Bidi text were
        added when the fix was checked in. Without the patch, Chromium used
        to fail the same way with LTR complex scripts as well. (that is,
        CR and LF were treated as zero-width space). To prevent a potential
        regression in the future, a new test with Hindi (a LTR complex script)
        is added.

        The expected results for Mac and Windows are added while this test
        is added to Skipped file for gtk. I guess this test just needs
        a new test result generated on gtk.

        https://bugs.webkit.org/show_bug.cgi?id=25698

        * fast/text/international/hindi-whitespace.html: Added.
        * platform/gtk/Skipped:
        * platform/mac/fast/text/international/hindi-whitespace-expected.checksum: Added.
        * platform/mac/fast/text/international/hindi-whitespace-expected.png: Added.
        * platform/mac/fast/text/international/hindi-whitespace-expected.txt: Added.
        * platform/win/fast/text/international/hindi-whitespace-expected.checksum: Added.
        * platform/win/fast/text/international/hindi-whitespace-expected.png: Added.
        * platform/win/fast/text/international/hindi-whitespace-expected.txt: Added.

2009-06-25  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=26681
        <rdar://problem/7003461> Problem updating applicationCache when server returns 304

        * http/tests/appcache/resources/uncacheable-resource.php: Added.
        * http/tests/appcache/resources/versioned-manifest.php:
        Added the kind of resource that was causing trouble.

2009-06-25  Ryosuke Niwa  <rniwa@google.com>

        Reviewed by Eric Seidel.

        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.

        * editing/execCommand/remove-list-1-expected.txt: Added.
        * editing/execCommand/remove-list-1.html:
        * editing/execCommand/remove-list-items-expected.txt: Added.
        * editing/execCommand/remove-list-items.html:
        * platform/mac/editing/execCommand/remove-list-1-expected.checksum: Removed.
        * platform/mac/editing/execCommand/remove-list-1-expected.png: Removed.
        * platform/mac/editing/execCommand/remove-list-1-expected.txt: Removed.
        * platform/mac/editing/execCommand/remove-list-items-expected.checksum: Removed.
        * platform/mac/editing/execCommand/remove-list-items-expected.png: Removed.
        * platform/mac/editing/execCommand/remove-list-items-expected.txt: Removed.
        * platform/qt/editing/execCommand/remove-list-1-expected.txt: Removed.
        * platform/qt/editing/execCommand/remove-list-items-expected.txt: Removed.

2009-06-25  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Oliver Hunt.

        <rdar://problem/6990481>

        Handle perspective computation on non-layer objects.

        * transforms/3d/general/perspective-non-layer.html: Added.

2009-06-25  Simon Fraser  <simon.fraser@apple.com>

        Rubber-stamped by Eric Seidel

        Update this test after the video controller changes.

        * platform/mac/fast/layers/video-layer-expected.txt:

2009-06-25  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Not reviewed. Skip another failing test due to lack of eventSender impl.

        * platform/gtk/Skipped:

2009-06-25  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Not reviewed. Skip failing gtk tests due to missing DRT features.

        * platform/gtk/Skipped:

2009-06-25  Simon Fraser  <simon.fraser@apple.com>

        Rubber-stamped by Dan Bernstein.

        Add Windows-specific test results, since Windows does not have
        3d transforms enabled.

        * platform/win/fast/media/mq-transform-02-expected.txt: Copied from LayoutTests/platform/mac-leopard/fast/media/mq-transform-02-expected.txt.
        * platform/win/fast/media/mq-transform-03-expected.txt: Copied from LayoutTests/platform/mac-leopard/fast/media/mq-transform-03-expected.txt.

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26653

        After the change to -webkit-box usage for controller bar, we need to
        update the media layout tests.

        * platform/mac/media/audio-controls-rendering-expected.txt:
        * platform/mac/media/video-controls-rendering-expected.txt:
        * platform/mac/media/video-display-toggle-expected.txt:
        * platform/mac/media/video-empty-source-expected.txt:
        * platform/mac/media/video-zoom-controls-expected.txt:

2009-06-25  Ryosuke Niwa  <rniwa@google.com>

        Reviewed by Eric Seidel.

        The following pixel tests have been converted into dumpastext tests. This
        fixes the bug 26336 partially.

        * editing/execCommand/5432254-2-expected.txt: Added.
        * editing/execCommand/5432254-2.html:
        * editing/execCommand/5700414-1-expected.txt: Added.
        * editing/execCommand/5700414-1.html:
        * editing/execCommand/5700414-2-expected.txt: Added.
        * editing/execCommand/5700414-2.html:
        * platform/mac/editing/execCommand/5432254-2-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5432254-2-expected.png: Removed.
        * platform/mac/editing/execCommand/5432254-2-expected.txt: Removed.
        * platform/mac/editing/execCommand/5700414-1-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5700414-1-expected.png: Removed.
        * platform/mac/editing/execCommand/5700414-1-expected.txt: Removed.
        * platform/mac/editing/execCommand/5700414-2-expected.checksum: Removed.
        * platform/mac/editing/execCommand/5700414-2-expected.png: Removed.
        * platform/mac/editing/execCommand/5700414-2-expected.txt: Removed.
        * platform/qt/editing/execCommand/5432254-2-expected.txt: Removed.

2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>

        Reviewed by Dimitri Glazkov.

        https://bugs.webkit.org/show_bug.cgi?id=26436

        Windows Chromium bug fix: save context of destination canvas in
        TransparencyWin::compositeTextComposite() before the function
        modifies the context.

        * fast/canvas/resources/translate-text.js: Added.
        (description.pixelValueAt):
        (pixelToString):
        (pixelShouldBe):
        * fast/canvas/translate-text-expected.txt: Added.
        * fast/canvas/translate-text.html: Added.

2009-06-25  Takeshi Yoshino  <tyoshino@google.com>

        Reviewed by David Levin.

        Bug 26207: Rebaseline the expected image for fast/forms/select-style.html for Mac.
        https://bugs.webkit.org/show_bug.cgi?id=26207

        Replace the expected image for fast/forms/select-style-expected.html for
        Mac which need to be rebaselined due to r43903
        (http://trac.webkit.org/changeset/43903).

        * platform/mac/fast/forms/select-style-expected.png:

2009-06-25  John Gregg  <johnnyg@google.com>

        Reviewed by Sam Weinig.

        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
        https://bugs.webkit.org/show_bug.cgi?id=23721

        Check for unnecessary calls to onchange in response to script
        actions.

        * fast/forms/select-script-onchange-expected.txt: Added.
        * fast/forms/select-script-onchange.html: Added.

2009-06-25  Dan Bernstein  <mitz@apple.com>

        Reviewed by Darin Adler.

        - test for https://bugs.webkit.org/show_bug.cgi?id=26671
          <rdar://problem/7001880> Safari 4.0 crashes in
          WebCore::DOMTimer::fired()

        * fast/dom/style-sheet-candidate-remove-unrendered-document-expected.txt: Added.
        * fast/dom/style-sheet-candidate-remove-unrendered-document.html: Added.

2009-06-25  Eric Seidel  <eric@webkit.org>

        No review, just skipping a new test.

        Skip new test on platforms missing eventSender.beginDragWithFiles
        Test: http/tests/security/clipboard/clipboard-file-access.html
        https://bugs.webkit.org/show_bug.cgi?id=25916

        * platform/gtk/Skipped:
        * platform/qt/Skipped:
        * platform/win/Skipped:

2009-06-24  Dan Bernstein  <mitz@apple.com>

        Reviewed by Simon Fraser.

        - test for <rdar://problem/7001817> REGRESSION (r41902): Base position
          track at UCSC Genome Browser doesn't work because image map prevents
          img from hit-testing

        * fast/replaced/image-map-2-expected.txt: Added.
        * fast/replaced/image-map-2.html: Added.

2009-06-24  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Tests for Bug 26668: AX: need a way to retrieve the language for an element.

        * accessibility/language-attribute-expected.txt: Added.
        * accessibility/language-attribute.html: Added.

2009-06-24  Oliver Hunt  <oliver@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'

        Add test cases for excessively large comma expressions.

        * fast/js/excessive-comma-usage-expected.txt: Added.
        * fast/js/excessive-comma-usage.html: Added.
        * fast/js/resources/excessive-comma-usage.js: Added.

2009-06-24  Rob Buis  <rwlbuis@gmail.com>

        Reviewed by Eric Seidel.

        Tests for:
        https://bugs.webkit.org/show_bug.cgi?id=26392
        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
        https://bugs.webkit.org/show_bug.cgi?id=26328
        Bug 26328: changing href attribute of svg images dows not work when changing display attribute as well

        * platform/mac/svg/custom/js-update-image-and-display-expected.checksum: Added
        * platform/mac/svg/custom/js-update-image-and-display-expected.png: Added
        * platform/mac/svg/custom/js-update-image-and-display-expected.txt: Added
        * svg/custom/js-update-image-and-display.svg: Added.
        * platform/mac/svg/custom/js-update-image-and-display2-expected.checksum: Added
        * platform/mac/svg/custom/js-update-image-and-display2-expected.png: Added
        * platform/mac/svg/custom/js-update-image-and-display2-expected.txt: Added
        * svg/custom/js-update-image-and-display2.svg: Added.
        * platform/mac/svg/custom/js-update-image-and-display3-expected.checksum: Added
        * platform/mac/svg/custom/js-update-image-and-display3-expected.png: Added
        * platform/mac/svg/custom/js-update-image-and-display3-expected.txt: Added
        * svg/custom/js-update-image-and-display3.svg: Added.

2009-06-24  Dan Bernstein  <mitz@apple.com>

        - add Windows results for one new test and one test
          whose Mac results changed recently

        * platform/win/fast/forms/search-vertical-alignment-expected.checksum: Added.
        * platform/win/fast/forms/search-vertical-alignment-expected.png: Added.
        * platform/win/fast/forms/search-vertical-alignment-expected.txt: Added.
        * platform/win/fast/replaced/width100percent-searchfield-expected.checksum: Added.
        * platform/win/fast/replaced/width100percent-searchfield-expected.png: Added.
        * platform/win/fast/replaced/width100percent-searchfield-expected.txt:

2009-06-24  David Hyatt  <hyatt@apple.com>

        Reviewed by Sam Weinig.

        Add test for https://bugs.webkit.org/show_bug.cgi?id=26687.

        * fast/dom/HTMLDataGridElement/DataGridColumns-basic-expected.txt: Added.
        * fast/dom/HTMLDataGridElement/DataGridColumns-basic.html: Added.

2009-05-21  Eric Seidel  <eric@webkit.org>

        Reviewed by Maciej Stachowiak.

        Expose files in the clipboard in ondrop events.
        https://bugs.webkit.org/show_bug.cgi?id=25916

        File.fileSize subtests fail due to limitations of DRT during http tests:
        https://bugs.webkit.org/show_bug.cgi?id=25909

        Directory subtests fail until correct of directory File tests is decided by:
        https://bugs.webkit.org/show_bug.cgi?id=25879

        * http/tests/security/clipboard/clipboard-file-access-expected.txt: Added.
        * http/tests/security/clipboard/clipboard-file-access.html: Added.
        * http/tests/security/clipboard/resources/TEMPLATE.html: Added.
        * http/tests/security/clipboard/resources/apple.gif: Copied from LayoutTests/editing/pasteboard/resources/apple.gif.
        * http/tests/security/clipboard/resources/clipboard-file-access.js: Added.
        (var):
        (moveMouseToCenterOfElement):
        (dragFilesOntoDragTarget):
        (fileListShouldBe):
        (draggingPathsShouldResultInFiles):
        (runTest):
        * http/tests/security/clipboard/resources/mozilla.gif: Copied from LayoutTests/editing/pasteboard/resources/mozilla.gif.

++ b/WebCore/ChangeLog
2009-06-26  Adele Peterson  <adele@apple.com>

        Reviewed by Darin Adler.

        Fix for <rdar://problem/7000796>
        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages

        Test: editing/inserting/break-blockquote-after-delete.html

        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
        typing command, keep that flag up to date.

        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style,
        was following an open Delete command, which does preserve the typing style.  So we were applying the original
        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.

        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::TypingCommand):
        (WebCore::TypingCommand::typingAddedToOpenCommand):
        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
        (WebCore::TypingCommand::insertLineBreak):
        (WebCore::TypingCommand::insertParagraphSeparator):
        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
        (WebCore::TypingCommand::deleteKeyPressed):
        (WebCore::TypingCommand::forwardDeleteKeyPressed):
        (WebCore::TypingCommand::deleteSelection):
        (WebCore::TypingCommand::updatePreservesTypingStyle):
        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for saving and loading of QWebHistory to and from a QByteArray.

        This includes streaming operators for QWebHistory. for convenience.

        New autotests that test QWebHistory and QWebHistoryItem serialization.

        * WebCore.pro:
        * history/HistoryItem.h:
        (WebCore::HistoryItem::dailyVisitCounts):
        (WebCore::HistoryItem::weeklyVisitCounts):
        * history/qt/HistoryItemQt.cpp: Added.
        (WebCore::HistoryItem::restoreState):
        (WebCore::HistoryItem::saveState):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for QDataStream operators to String and IntPoint.

        * platform/graphics/IntPoint.h:
        (WebCore::operator<<):
        (WebCore::operator>>):
        * platform/text/PlatformString.h:
        * platform/text/qt/StringQt.cpp:
        (WebCore::operator<<):
        (WebCore::operator>>):

2009-06-26  Ben Murdoch  <benm@google.com>

        Reviewed by Darin Fisher.

        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
        https://bugs.webkit.org/show_bug.cgi?id=26757

        * bindings/v8/custom/V8StorageCustom.cpp

2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Test: platform/qt/fast/events/event-sender-keydown-frame.html

        Bug 20303: [Qt] Key events are not working in frames.

        Merge scrolling handling code in qt and win port, move it to
        EventHandler.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::scrollRecursively):
        * page/EventHandler.h:

2009-06-26  Rob Buis  <rwlbuis@gmail.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26682
        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)

        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.

        Test: svg/custom/createImageElement.svg

        * svg/SVGAnimatedProperty.h:
        (WebCore::synchronizeProperty):

2009-06-26  Takeshi Yoshino  <tyoshino@google.com>

        Reviewed by Timothy Hatcher.

        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
        https://bugs.webkit.org/show_bug.cgi?id=26156

        When in view-source mode, render the contents using HTMLViewSourceDocument
        regardless it's applicable for any plugin or not.

        Chromium tells WebCore to render the contents of specified URL when
        view-source: prefix is added to the URL. But currently, DOMImplementation
        ignores inViewSourceMode() when the MIME type is indicating that the contents
        are neither texts nor HTML family documents.

        For example, we can check the contents of asf file without launching media
        player. Rendering contents for view-source:-specified input is not what user
        expects.

        http://code.google.com/p/chromium/issues/detail?id=10545

        I want to fix this issue by this patch. IMHO, regardless of this Chromium
        specific issue, I think we should force use of HTMLViewSourceDocument when
        inViewSourceMode() is specified.

        Test: fast/frames/viewsource-on-image-file.html

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        * html/HTMLViewSourceDocument.cpp:
        (WebCore::HTMLViewSourceDocument::createTokenizer):
        * html/HTMLViewSourceDocument.h:

2009-06-26  Xan Lopez  <xlopez@igalia.com>

        Reviewed by Jan Alonzo.

        https://bugs.webkit.org/show_bug.cgi?id=25529
        [Gtk] Expected states not exposed to assistive technologies

        Add support for VISIBLE, EDITABLE and SENSITIVE states.

        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
        (setAtkStateSetFromCoreObject):

2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Darin Adler.

        "Pointer to incomplete class type is not allowed" error with RVCT
        https://bugs.webkit.org/show_bug.cgi?id=26721

        Based on Norbert Leser's work.

        * dom/Document.cpp:
        (WebCore::Document::setFocusedNode):
        * dom/Node.cpp:
        (WebCore::Node::dispatchMouseEvent):
        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
        to eliminate dependency on the Event class definition

2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Maciej Stachowiak.

        [Qt] Build fix after r45183
        https://bugs.webkit.org/show_bug.cgi?id=26748

        * WebCore.pro:

2009-06-25  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Darin Adler.

        https://bugs.webkit.org/show_bug.cgi?id=26681
        <rdar://problem/7003461> Problem updating applicationCache when server returns 304

        Test: http/tests/appcache/update-cache.html

        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
        We're already done with the resource, don't try to load it again.

2009-06-25  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Oliver Hunt.

        <rdar://problem/6990481>

        Handle perspective computation on non-layer objects.

        Test: transforms/3d/general/perspective-non-layer.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::getTransformFromContainer):

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26653

        Use flex box in the mediaControls.css style, to nicely scale if a button gets
        dynamically added or removed.

        Media tests results are affected by this changes.

        * css/mediaControls.css:
        * css/mediaControlsQT.css:

2009-06-25  Albert J. Wong  <ajwong@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26724

        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
        up into RenderThemeChromiumSkia.

        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
        * rendering/RenderThemeChromiumSkia.h:
        * rendering/RenderThemeChromiumWin.cpp:
        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
        * rendering/RenderThemeChromiumWin.h:

2009-06-25  Matt Perry  <mpcomplete@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26733

        Add V8-only methods to FrameLoaderClient that V8 can use to send
        out notifications when it creates/destroys a script context.

        * loader/EmptyClients.h:
        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
        * loader/FrameLoaderClient.h:
        (WebCore::FrameLoaderClient::didCreateScriptContext):
        (WebCore::FrameLoaderClient::didDestroyScriptContext):

2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by David Levin.

        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
        to match WebKit style.

        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.

2009-06-25  Adam Langley  <agl@google.com>

        TBRed: fix for Chromium tree.

        Add missing include for r45199.

        https://bugs.webkit.org/show_bug.cgi?id=26736

        r45199 added a reference to throwError without including V8Proxy.h

        * bindings/v8/WorkerScriptController.cpp:

2009-06-25  Adam Langley  <agl@google.com>

        TBRed: fix for Chromium tree.

        https://bugs.webkit.org/show_bug.cgi?id=26735

        Fix V8IsolatedWorld to point to the correct include file.

        The deprecated v8_index.h was removed from the Chromium tree in r19291
        and upstreamed into WebKit with r45193. However V8IsolatedWorld
        slipped in between the cracks and broke the build.

        * bindings/v8/V8IsolatedWorld.h: update with new header location.

2009-06-25  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Simon Fraser  <simon.fraser@apple.com>.

        https://bugs.webkit.org/show_bug.cgi?id=26651

        Preference is named "WebKitAcceleratedCompositingEnabled"
        and is a boolean value. When false, prevents compositing layers from
        being created, which prevents hardware animation from running.
        Also forces video to do software rendering. Added a cache for
        the flag in RenderLayerCompositing and made it all work
        on-the-fly when the flag is changed while a page is loaded.

        * WebCore.base.exp:
        * page/FrameView.cpp:
        (WebCore::FrameView::updateCompositingLayers):
        * page/Settings.cpp:
        (WebCore::setNeedsReapplyStylesInAllFrames):
        (WebCore::Settings::Settings):
        (WebCore::Settings::setAcceleratedCompositingEnabled):
        * page/Settings.h:
        (WebCore::Settings::acceleratedCompositingEnabled):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hasAcceleratedCompositing):
        (WebCore::RenderLayer::updateTransform):
        (WebCore::RenderLayer::currentTransform):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateLayerTransform):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
        (WebCore::RenderLayerCompositor::enableCompositingMode):
        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
        (WebCore::RenderLayerCompositor::updateCompositingLayers):
        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
        (WebCore::RenderLayerCompositor::needsToBeComposited):
        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
        * rendering/RenderLayerCompositor.h:
        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
        * rendering/RenderObject.h:
        (WebCore::makeMatrixRenderable):

2009-06-25  Jian Li  <jianli@chromium.org>

        Reviewed by Dimitri Glazkov.

        Bug 26701: Implement the missing code for "FIXME: Need to return an
        exception" in WorkerScriptController::evaluate for v8 bindings.
        https://bugs.webkit.org/show_bug.cgi?id=26701

        * bindings/v8/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::evaluate):

2009-06-25  Nate Chapin  <japhet@chromium.org>

        Reviewed by Dimitri Glazkov.

        Upstream V8Index.

        https://bugs.webkit.org/show_bug.cgi?id=26495

        * bindings/v8/V8Index.cpp: Added.
        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
        * bindings/v8/V8Index.h:
        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.

2009-06-25  Adam Langley  <agl@google.com>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26529

        This is hopefully the last step before our renderers can run
        cleanly in a chroot.

        WebKit needs to be able to ask for the correct font to use in
        the case that the current font doesn't include glyphs for
        certain code points. Currently we make a fontconfig call in our
        WebKit port to handle this.

        This patch changes this so that the call is sent our via
        ChromiumBridge.

        http://codereview.chromium.org/132007

        This should not affect any layout tests.

        * platform/chromium/ChromiumBridge.h:
        * platform/graphics/chromium/FontCacheLinux.cpp:
        (WebCore::FontCache::getFontDataForCharacters):

2009-06-25  Albert J. Wong  <ajwong@chromium.org>

        Reviewed by David Levin.

        https://bugs.webkit.org/show_bug.cgi?id=26566
        Upstream these files from the chromium v8 code.  No tests were
        affected because this is essentially a code move.

        * bindings/v8/NPV8Object.cpp: Added.
        (allocV8NPObject):
        (freeV8NPObject):
        (listFromVariantArgs):
        (npIdentifierToV8Identifier):
        (npCreateV8ScriptObject):
        (NPN_Invoke):
        (NPN_InvokeDefault):
        (NPN_Evaluate):
        (NPN_EvaluateHelper):
        (NPN_GetProperty):
        (NPN_SetProperty):
        (NPN_RemoveProperty):
        (NPN_HasProperty):
        (NPN_HasMethod):
        (NPN_SetException):
        (NPN_Enumerate):
        (NPN_Construct):
        * bindings/v8/NPV8Object.h: Added.
        (PrivateIdentifier::):
        * bindings/v8/V8NPUtils.cpp: Added.
        (convertV8ObjectToNPVariant):
        (convertNPVariantToV8Object):
        (getStringIdentifier):
        * bindings/v8/V8NPUtils.h: Added.

2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>

        Reviewed by Dimitri Glazkov.

        https://bugs.webkit.org/show_bug.cgi?id=26436

        Windows Chromium bug fix: save context of destination canvas in
        TransparencyWin::compositeTextComposite() before the function
        modifies the context.

        Test: fast/canvas/translate-text.html

        * platform/graphics/chromium/TransparencyWin.cpp:
        (WebCore::TransparencyWin::compositeTextComposite):

2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>

        Reviewed by Timothy Hatcher.

        Show the filename and first line for "(program)" in the Profiler/Debugger
        https://bugs.webkit.org/show_bug.cgi?id=25475

        Add support to associate a sourceURL with an eval()'d string
        via a @sourceURL comment.  Currently the sourceURL is only available
        in the script debugger, not in the console or profiler, but it's
        most needed in the script debugger.

        * English.lproj/localizedStrings.js: added new "(program): %s" string
        * inspector/front-end/Script.js:
        (WebInspector.Script): if no sourceURL is available for the Script,
        search for a comment of the form //@ sourceURL=(url) to use
        as the sourceURL instead.
        * manual-tests/inspector/named-evals.html: Added.

2009-06-25  John Gregg  <johnnyg@google.com>

        Reviewed by Sam Weinig.

        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
        https://bugs.webkit.org/show_bug.cgi?id=23721

        onchange events fire when a SELECT element has
        focus and the selectedIndex is updated by script in some way--either
        during another onchange, onkeypress, onfocus, or timer--and then
        focus is lost.

        Fixed by making a separate method for user-driven selectedIndex
        changes, leaving scripts to use one which doesn't cause onchange to
        be queued.

        Test: fast/forms/select-script-onchange.html

        * dom/SelectElement.cpp: check if the pending change is user driven
        before calling onchange
        (WebCore::SelectElement::menuListOnChange):
        (WebCore::SelectElement::setSelectedIndex):
        * dom/SelectElement.h: store whether the pending change is user driven
        (WebCore::SelectElementData::userDrivenChange):
        (WebCore::SelectElementData::setUserDrivenChange):
        * html/HTMLSelectElement.cpp: split into two methods -- script version
        [non-user-driven] corresponds to IDL defined property name
        (WebCore::HTMLSelectElement::setSelectedIndex):
        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
        * html/HTMLSelectElement.h:
        * rendering/RenderMenuList.cpp: use ByUser method when coming through
        the renderer
        (WebCore::RenderMenuList::valueChanged):

2009-06-25  Jeremy Orlow  <jorlow@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26698

        Combined LocalStorageArea and SessionStorageArea into StorageArea since
        (after my other refactorings) there are no longer substantial
        differences between the two.

        * GNUmakefile.am:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * storage/LocalStorage.cpp:
        (WebCore::LocalStorage::storageArea):
        * storage/LocalStorage.h:
        * storage/LocalStorageArea.cpp: Removed.
        * storage/LocalStorageArea.h: Removed.
        * storage/SessionStorage.cpp:
        (WebCore::SessionStorage::copy):
        (WebCore::SessionStorage::storageArea):
        * storage/SessionStorage.h:
        * storage/SessionStorageArea.cpp: Removed.
        * storage/SessionStorageArea.h: Removed.
        * storage/StorageArea.cpp:
        (WebCore::StorageArea::createLocalStorage):
        (WebCore::StorageArea::StorageArea):
        (WebCore::StorageArea::createSessionStorage):
        (WebCore::StorageArea::copy):
        (WebCore::StorageArea::setItem):
        (WebCore::StorageArea::removeItem):
        (WebCore::StorageArea::clear):
        (WebCore::StorageArea::scheduleFinalSync):
        (WebCore::StorageArea::blockUntilImportComplete):
        (WebCore::StorageArea::dispatchStorageEvent):
        * storage/StorageArea.h:
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::StorageAreaSync):
        (WebCore::StorageAreaSync::scheduleFinalSync):
        (WebCore::StorageAreaSync::syncTimerFired):
        (WebCore::StorageAreaSync::performImport):
        * storage/StorageAreaSync.h:
        * storage/StorageSyncManager.h:

2009-06-25  Dan Bernstein  <mitz@apple.com>

        Reviewed by Darin Adler.

        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
          <rdar://problem/7001880> Safari 4.0 crashes in
          WebCore::DOMTimer::fired()

        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html

        When a "style sheet candidate" element is removed from a document,
        call Document::removeStyleSheetCandidateNode() regardless of whether
        the document is rendered. Otherwise, the document's style sheet
        candidate set can end up containing stale references.

        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::removedFromDocument):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::removedFromDocument):
        * html/HTMLStyleElement.cpp:
        (WebCore::HTMLStyleElement::removedFromDocument):

2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>

        Reviewed by Darin Fisher.

        Update CodeGeneratorV8.pm to sync up with the changes downstream.

        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.

2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>

        Unreviewed, build fix.

        Add FileList.h include to fix Chromium build.

        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.

2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>

        Reviewed by Jan Alonzo.

        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
        https://bugs.webkit.org/show_bug.cgi?id=26489

        Fixed a Typo in a Web Inspector error message.

        * English.lproj/localizedStrings.js:
        * inspector/front-end/DatabaseQueryView.js:
        (WebInspector.DatabaseQueryView.prototype._queryError):

2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>

        Fix the Qt build, add missing StorageAreaSync files to the build.

        * WebCore.pro:

2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by and done with Tor Arne Vestbø.

        Fix shortcut keyboard handling with plugins on the Qt/Mac build.

        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
        empty. If we're asked to disambiguate the event into a Char keyboard event,
        we try to detect this situation and still set the text, to ensure that the
        general event handling sends a key press event after this disambiguation.

        * platform/qt/PlatformKeyboardEventQt.cpp:
        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):

2009-06-25  Eric Seidel  <eric@webkit.org>

        Build fix only, no review.

        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.

        * platform/gtk/ClipboardGtk.cpp:
        * platform/qt/ClipboardQt.cpp:
        * platform/win/ClipboardWin.cpp:
        * platform/wx/ClipboardWx.cpp:

2009-05-21  Eric Seidel  <eric@webkit.org>

        Reviewed by Maciej Stachowiak.

        Expose files in the clipboard in ondrop events
        https://bugs.webkit.org/show_bug.cgi?id=25916

        Make it possible for applications like gmail to implement
        drag and drop of attachments onto email messages.

        This patch exposes an event.dataTransfer.files accessor
        on the drop event.  No information is exposed during dragover.
        This follows the HTML 5 drag and drop security model:
        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
        The test http/tests/security/clipboard/clipboard-file-access.html
        verifies this behavior.

        Internet Explorer shows historical documentation of supporting
        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
        has removed this reference (as far as I can tell IE never implemented it)
        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.

        I choose not to use IE's getData('File') and instead added .files
        so that the accessor could have a type, matching WebKit's existing
        .files accessor on HTMLInputElement.

        Mozilla has equivalent file access:
        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
        which also does not return a typed value.
        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files

        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
        have incomplete Clipboard implementations and will require experts from those platforms
        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();

        Test: http/tests/security/clipboard/clipboard-file-access.html

        * dom/Clipboard.h:
        * dom/Clipboard.idl:
        * platform/chromium/ClipboardChromium.cpp:
        (WebCore::ClipboardChromium::files):
        * platform/chromium/ClipboardChromium.h:
        * platform/gtk/ClipboardGtk.cpp:
        (WebCore::ClipboardGtk::files):
        * platform/gtk/ClipboardGtk.h:
        * platform/mac/ClipboardMac.h:
        * platform/mac/ClipboardMac.mm:
        (WebCore::absoluteURLsFromPasteboardFilenames):
        (WebCore::absoluteURLsFromPasteboard):
        (WebCore::ClipboardMac::files):
        * platform/qt/ClipboardQt.cpp:
        (WebCore::ClipboardQt::files):
        * platform/qt/ClipboardQt.h:
        * platform/win/ClipboardWin.cpp:
        (WebCore::ClipboardWin::files):
        * platform/win/ClipboardWin.h:
        * platform/wx/ClipboardWx.cpp:
        (WebCore::ClipboardWx::files):
        * platform/wx/ClipboardWx.h:

2009-06-25  Eric Seidel  <eric@webkit.org>

        No review, only completing revert of r45144.

        Add back files deleted by r45144.

        * storage/LocalStorageArea.cpp: Added.
        (WebCore::LocalStorageArea::create):
        (WebCore::LocalStorageArea::LocalStorageArea):
        (WebCore::LocalStorageArea::scheduleFinalSync):
        (WebCore::LocalStorageArea::itemChanged):
        (WebCore::LocalStorageArea::itemRemoved):
        (WebCore::LocalStorageArea::areaCleared):
        (WebCore::LocalStorageArea::blockUntilImportComplete):
        (WebCore::LocalStorageArea::dispatchStorageEvent):
        * storage/LocalStorageArea.h: Added.
        * storage/SessionStorageArea.cpp: Added.
        (WebCore::SessionStorageArea::copy):
        (WebCore::SessionStorageArea::SessionStorageArea):
        (WebCore::SessionStorageArea::itemChanged):
        (WebCore::SessionStorageArea::itemRemoved):
        (WebCore::SessionStorageArea::areaCleared):
        (WebCore::SessionStorageArea::blockUntilImportComplete):
        (WebCore::SessionStorageArea::dispatchStorageEvent):
        * storage/SessionStorageArea.h: Added.
        (WebCore::SessionStorageArea::create):

2009-06-25  Eric Seidel  <eric@webkit.org>

        No review, reverting r45144 only.

        Roll out r45144 after 18 test failures appeared on the bots.
        https://bugs.webkit.org/show_bug.cgi?id=26698

        * GNUmakefile.am:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * storage/LocalStorage.cpp:
        (WebCore::LocalStorage::storageArea):
        * storage/LocalStorage.h:
        * storage/SessionStorage.cpp:
        (WebCore::SessionStorage::copy):
        (WebCore::SessionStorage::storageArea):
        * storage/SessionStorage.h:
        * storage/StorageArea.cpp:
        (WebCore::StorageArea::StorageArea):
        (WebCore::StorageArea::~StorageArea):
        (WebCore::StorageArea::setItem):
        (WebCore::StorageArea::removeItem):
        (WebCore::StorageArea::clear):
        * storage/StorageArea.h:
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::StorageAreaSync):
        (WebCore::StorageAreaSync::scheduleFinalSync):
        (WebCore::StorageAreaSync::syncTimerFired):
        (WebCore::StorageAreaSync::performImport):
        * storage/StorageAreaSync.h:
        * storage/StorageSyncManager.h:

2009-06-24  Jeremy Orlow  <jorlow@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26698

        Combined LocalStorageArea and SessionStorageArea into StorageArea since
        (after my other refactorings) there are no longer substantial
        differences between the two.

        * GNUmakefile.am:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * storage/LocalStorage.cpp:
        (WebCore::LocalStorage::storageArea):
        * storage/LocalStorage.h:
        * storage/LocalStorageArea.cpp: Removed.
        * storage/LocalStorageArea.h: Removed.
        * storage/SessionStorage.cpp:
        (WebCore::SessionStorage::copy):
        (WebCore::SessionStorage::storageArea):
        * storage/SessionStorage.h:
        * storage/SessionStorageArea.cpp: Removed.
        * storage/SessionStorageArea.h: Removed.
        * storage/StorageArea.cpp:
        (WebCore::StorageArea::createLocalStorage):
        (WebCore::StorageArea::StorageArea):
        (WebCore::StorageArea::createSessionStorage):
        (WebCore::StorageArea::copy):
        (WebCore::StorageArea::setItem):
        (WebCore::StorageArea::removeItem):
        (WebCore::StorageArea::clear):
        (WebCore::StorageArea::scheduleFinalSync):
        (WebCore::StorageArea::blockUntilImportComplete):
        (WebCore::StorageArea::dispatchStorageEvent):
        * storage/StorageArea.h:
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::StorageAreaSync):
        (WebCore::StorageAreaSync::scheduleFinalSync):
        (WebCore::StorageAreaSync::syncTimerFired):
        (WebCore::StorageAreaSync::performImport):
        * storage/StorageAreaSync.h:
        * storage/StorageSyncManager.h:

2009-06-24  Dan Bernstein  <mitz@apple.com>

        Reviewed by Simon Fraser.

        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
          at UCSC Genome Browser doesn't work because image map prevents img
          from hit-testing

        Test: fast/replaced/image-map-2.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
        the image map failed the hit test.

2009-06-22  Adam Barth  <abarth@webkit.org>

        Reviewed by Dimitri Glazkov.

        https://bugs.webkit.org/show_bug.cgi?id=26366

        Refactor V8DOMMap to support isolated worlds.

        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::evaluateInNewWorld):
        * bindings/v8/ScriptController.h:
        * bindings/v8/V8DOMMap.cpp:
        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
        (WebCore::DOMDataStore::allStores):
        (WebCore::DOMDataStore::allStoresMutex):
        (WebCore::DOMDataStore::domData):
        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
        (WebCore::):
        (WebCore::MainThreadDOMData::MainThreadDOMData):
        (WebCore::MainThreadDOMData::getStore):
        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
        (WebCore::ChildThreadDOMData::getStore):
        (WebCore::DOMDataStore::DOMDataStore):
        (WebCore::DOMDataStore::~DOMDataStore):
        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
        (WebCore::::forget):
        (WebCore::getDOMNodeMap):
        (WebCore::getDOMObjectMap):
        (WebCore::getActiveDOMObjectMap):
        (WebCore::getDOMSVGElementInstanceMap):
        (WebCore::getDOMSVGObjectWithContextMap):
        (WebCore::DOMData::getCurrent):
        (WebCore::DOMData::handleWeakObject):
        (WebCore::DOMData::ensureDeref):
        (WebCore::weakDOMObjectCallback):
        (WebCore::weakActiveDOMObjectCallback):
        (WebCore::weakNodeCallback):
        (WebCore::weakSVGElementInstanceCallback):
        (WebCore::weakSVGObjectWithContextCallback):
        (WebCore::DOMData::derefObject):
        (WebCore::DOMData::derefDelayedObjects):
        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
        (WebCore::DOMData::removeObjectsFromWrapperMap):
        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
        (WebCore::visitDOMNodesInCurrentThread):
        (WebCore::visitDOMObjectsInCurrentThread):
        (WebCore::visitActiveDOMObjectsInCurrentThread):
        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
        (WebCore::visitSVGObjectsInCurrentThread):
        * bindings/v8/V8DOMMap.h:
        (WebCore::DOMDataStoreHandle::getStore):
        * bindings/v8/V8IsolatedWorld.cpp: Added.
        (WebCore::getIsolatedWorldKey):
        (WebCore::contextWeakReferenceCallback):
        (WebCore::V8IsolatedWorld::evaluate):
        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
        (WebCore::V8IsolatedWorld::getEntered):
        * bindings/v8/V8IsolatedWorld.h: Added.
        (WebCore::V8IsolatedWorld::getDOMDataStore):

2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>

        Reviewed by Timothy Hatcher.

        Bug 26604: Search doesn't work in Web Inspector Profiler
        https://bugs.webkit.org/show_bug.cgi?id=26604

        Seems like search was damaged in revision 42808.

        * inspector/front-end/ProfileView.js:
        (WebInspector.ProfileView.prototype.refresh):
        Here and in other functions: nodes we're searching in are profile data grid
        nodes, so there is no more need for '_dataGridNode' references.
        (WebInspector.ProfileView.prototype.searchCanceled):
        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
        Fixed accidental semicolon that caused 'matchesQuery' always return true.
        (WebInspector.ProfileView.prototype.performSearch):
        To perform search correctly in the case of bottom up tree, we need to populate
        the tree, because there's no 1-to-1 correspondence between profile nodes and
        data grid nodes in this case.
        (WebInspector.ProfileView.prototype._jumpToSearchResult):

2009-06-24  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Darin Adler.

        <rdar://problem/6450239&6574516>

        Fix flashing issues caused by compositing layers rendering content before
        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
        work for composited layers, we need to use scheduleViewUpdate() to queue
        up a layout via the run loop observer in WebKit, whenever we know we
        are going to be painting soon.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):

2009-06-24  David Levin  <levin@chromium.org>

        Fix all builds.

        * ForwardingHeaders/wtf/FastAllocBase.h: Added.

2009-06-24  Jeremy Orlow  <jorlow@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26658

        Split the syncing portions of LocalStorageArea into StorageAreaSync.
        This name will make more sense in the next patch (in this set) when
        LocalStorageArea and SessionStorageArea are merged to become simply
        StorageArea.  (Thus the synching portion of StorageArea is in
        StorageAreaSync.)

        This looks like a big patch, but really all it's doing is splitting
        code and patching split-related things up.

        * GNUmakefile.am:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * storage/LocalStorageArea.cpp:
        (WebCore::LocalStorageArea::create):
        (WebCore::LocalStorageArea::LocalStorageArea):
        (WebCore::LocalStorageArea::scheduleFinalSync):
        (WebCore::LocalStorageArea::itemChanged):
        (WebCore::LocalStorageArea::itemRemoved):
        (WebCore::LocalStorageArea::areaCleared):
        (WebCore::LocalStorageArea::blockUntilImportComplete):
        * storage/LocalStorageArea.h:
        * storage/LocalStorageTask.cpp:
        (WebCore::LocalStorageTask::LocalStorageTask):
        * storage/LocalStorageTask.h:
        (WebCore::LocalStorageTask::createImport):
        (WebCore::LocalStorageTask::createSync):
        * storage/LocalStorageThread.cpp:
        (WebCore::LocalStorageThread::scheduleImport):
        (WebCore::LocalStorageThread::scheduleSync):
        * storage/LocalStorageThread.h:
        * storage/SessionStorageArea.cpp:
        (WebCore::SessionStorageArea::blockUntilImportComplete):
        * storage/SessionStorageArea.h:
        * storage/StorageArea.h:
        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
        * storage/StorageSyncManager.cpp:
        (WebCore::StorageSyncManager::scheduleImport):
        (WebCore::StorageSyncManager::scheduleSync):
        * storage/StorageSyncManager.h:

2009-06-24  Adam Treat  <adam.treat@torchmobile.com>

        Fix Qt build.

        * WebCore.pro:

2009-06-24  David Levin  <levin@chromium.org>

        Reviewed by David Hyatt.

        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
        https://bugs.webkit.org/show_bug.cgi?id=26696

        * html/DataGridColumnList.cpp:
        (WebCore::DataGridColumnList::itemWithName):
        (WebCore::DataGridColumnList::add):
        * html/DataGridColumnList.h:
        (WebCore::DataGridColumnList::item):
        (WebCore::DataGridColumnList::primaryColumn):
        (WebCore::DataGridColumnList::sortColumn):

2009-06-24  Sam Weinig  <sam@webkit.org>

        Reviewed by Dave "Messy" Hyatt.

        Little bit of style cleanup.

        * html/DataGridColumn.cpp:
        * html/DataGridColumn.h:
        * html/DataGridColumn.idl:
        * html/DataGridColumnList.cpp:
        * html/DataGridColumnList.h:
        * html/DataGridColumnList.idl:
        * html/HTMLDataGridCellElement.cpp:
        * html/HTMLDataGridCellElement.h:
        * html/HTMLDataGridCellElement.idl:
        * html/HTMLDataGridColElement.cpp:
        * html/HTMLDataGridColElement.h:
        * html/HTMLDataGridColElement.idl:
        * html/HTMLDataGridElement.h:
        * html/HTMLDataGridElement.idl:
        * html/HTMLDataGridRowElement.cpp:
        * html/HTMLDataGridRowElement.h:
        * html/HTMLDataGridRowElement.idl:

2009-06-24  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Bug 26668: AX: need a way to retrieve the language for an element

        Provides a way to retrieve the language associated with a specific accessibility element.

        Test: accessibility/language-attribute.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::language):
        * accessibility/AccessibilityObject.h:
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::language):
        * accessibility/AccessibilityRenderObject.h:
        * accessibility/mac/AccessibilityObjectWrapper.mm:
        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):

2009-06-24  Brady Eidson  <beidson@apple.com>

        Reviewed by Dan Bernstein.

        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.

        * platform/network/mac/WebCoreURLResponse.mm:
        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.

2009-06-24  Nicolas Weber  <thakis@chromium.org>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26685
        Accomodate for backwards-incompatible skia api changes.

        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::clearRect):
        (WebCore::GraphicsContext::setCompositeOperation):
        * platform/graphics/skia/ImageBufferSkia.cpp:
        (WebCore::ImageBuffer::ImageBuffer):
        * platform/graphics/skia/ImageSkia.cpp:
        (WebCore::paintSkBitmap):
        (WebCore::Image::drawPattern):
        * platform/graphics/skia/PlatformContextSkia.cpp:
        (PlatformContextSkia::State::State):
        (PlatformContextSkia::setupPaintCommon):
        (PlatformContextSkia::setXfermodeMode):
        (PlatformContextSkia::applyClipFromImage):
        * platform/graphics/skia/PlatformContextSkia.h:
        * platform/graphics/skia/SkiaUtils.cpp:
        (WebCore::):
        (WebCore::WebCoreCompositeToSkiaComposite):
        * platform/graphics/skia/SkiaUtils.h:

2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Gtk build fix. Add files that were added in r45093 and r45096

        * GNUmakefile.am:

2009-06-24  Brady Eidson  <beidson@apple.com>

        Fix 64-bit SnowLeopard build.

        * html/DataGridColumnList.cpp:
        (WebCore::DataGridColumnList::remove):
        (WebCore::DataGridColumnList::move):

2009-06-24  Rob Buis  <rwlbuis@gmail.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26392
        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
        https://bugs.webkit.org/show_bug.cgi?id=26328
        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well

        React to href updates even when there is no renderer, i.e. display=none.

        Tests: svg/custom/js-update-image-and-display.svg
               svg/custom/js-update-image-and-display2.svg
               svg/custom/js-update-image-and-display3.svg

        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::svgAttributeChanged):

2009-06-24  David Hyatt  <hyatt@apple.com>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=26687

        Add basic back-end column support to datagrid.

        Added fast/dom/HTMLDataGridElement/ column tests.

        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.pro:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * html/DataGridColumn.cpp: Added.
        (WebCore::DataGridColumn::setPrimary):
        * html/DataGridColumn.h: Added.
        (WebCore::DataGridColumn::create):
        (WebCore::DataGridColumn::id):
        (WebCore::DataGridColumn::setId):
        (WebCore::DataGridColumn::label):
        (WebCore::DataGridColumn::setLabel):
        (WebCore::DataGridColumn::type):
        (WebCore::DataGridColumn::setType):
        (WebCore::DataGridColumn::sortable):
        (WebCore::DataGridColumn::setSortable):
        (WebCore::DataGridColumn::sortDirection):
        (WebCore::DataGridColumn::setSortDirection):
        (WebCore::DataGridColumn::primary):
        (WebCore::DataGridColumn::detachFromColumnList):
        (WebCore::DataGridColumn::DataGridColumn):
        * html/DataGridColumn.idl: Added.
        * html/DataGridColumnList.cpp: Added.
        (WebCore::DataGridColumnList::~DataGridColumnList):
        (WebCore::DataGridColumnList::itemWithName):
        (WebCore::DataGridColumnList::add):
        (WebCore::DataGridColumnList::remove):
        (WebCore::DataGridColumnList::move):
        (WebCore::DataGridColumnList::clear):
        (WebCore::DataGridColumnList::primaryColumnChanged):
        * html/DataGridColumnList.h: Added.
        (WebCore::DataGridColumnList::create):
        (WebCore::DataGridColumnList::length):
        (WebCore::DataGridColumnList::item):
        (WebCore::DataGridColumnList::primaryColumn):
        (WebCore::DataGridColumnList::sortColumn):
        * html/DataGridColumnList.idl: Added.
        * html/HTMLDataGridColElement.cpp:
        (WebCore::HTMLDataGridColElement::sortable):
        (WebCore::HTMLDataGridColElement::setSortable):
        (WebCore::HTMLDataGridColElement::sortDirection):
        (WebCore::HTMLDataGridColElement::setSortDirection):
        * html/HTMLDataGridColElement.h:
        * html/HTMLDataGridColElement.idl:
        * html/HTMLDataGridElement.cpp:
        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
        * html/HTMLDataGridElement.h:
        (WebCore::HTMLDataGridElement::columns):
        * html/HTMLDataGridElement.idl:
        * rendering/RenderDataGrid.cpp:
        (WebCore::RenderDataGrid::paintObject):
        (WebCore::RenderDataGrid::paintColumnHeaders):
        (WebCore::RenderDataGrid::rebuildColumns):
        * rendering/RenderDataGrid.h:
        (WebCore::RenderDataGrid::gridElement):

2009-06-24  Jessie _Berlin  <jberlin@apple.com>

        Reviewed by Adam Roben.

        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
        (<rdar://problem/5015942>)
        Where on windows it was not possible to set an element as the drag
        image using setDragImage on the dataTransfer object.

        Does not "fix" the case of dragging a link where the default link image
        is still used, even when the -webkit-user-drag is set to "element". This
        is the same behavior as is found on OS X.

        Added a manual test because it is not possible to check that what is
        contained in the image snapshot is indeed the requested element.

        * dom/Clipboard.h:
        (WebCore::Clipboard::dragImageElement):
        Made getting the raw pointer from the RefPtr a const operation.
        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
        * platform/win/ClipboardWin.cpp:
        (WebCore::ClipboardWin::createDragImage):
        Get an image of the rendered element and its subtree.

2009-06-24  Darin Fisher  <darin@chromium.org>

        Reviewed by David Levin.

        https://bugs.webkit.org/show_bug.cgi?id=26683
        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource

        This change just adds a stub implementation for now to help fix the build.

        * bindings/v8/custom/V8CustomBinding.h:
        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.

2009-06-24  David Kilzer  <ddkilzer@apple.com>

        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)

        Reviewed by Adam Roben.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::deliverNotification): Removed
        ExceptionCode parameter from togglePlayState().
        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
        object to a String when assigning to a KURL variable.

2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>

        Reviewed by Adam Treat.

        Save memory by not storing attribute values in member variables, if not absolutely needed.
        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).

        * wml/WMLDoElement.cpp:
        (WebCore::WMLDoElement::parseMappedAttribute):
        (WebCore::WMLDoElement::label):
        * wml/WMLDoElement.h:
        * wml/WMLFieldSetElement.cpp:
        (WebCore::WMLFieldSetElement::insertedIntoDocument):
        * wml/WMLFieldSetElement.h:
        * wml/WMLOptGroupElement.cpp:
        (WebCore::WMLOptGroupElement::title):
        (WebCore::WMLOptGroupElement::parseMappedAttribute):
        (WebCore::WMLOptGroupElement::groupLabelText):
        * wml/WMLOptGroupElement.h:
        * wml/WMLPostfieldElement.cpp:
        (WebCore::WMLPostfieldElement::name):
        (WebCore::WMLPostfieldElement::value):
        (WebCore::WMLPostfieldElement::encodeData):
        * wml/WMLPostfieldElement.h:
        * wml/WMLSetvarElement.cpp:
        (WebCore::WMLSetvarElement::parseMappedAttribute):
        (WebCore::WMLSetvarElement::name):
        (WebCore::WMLSetvarElement::value):
        * wml/WMLSetvarElement.h:
        * wml/WMLTimerElement.cpp:
        (WebCore::WMLTimerElement::parseMappedAttribute):
        (WebCore::WMLTimerElement::insertedIntoDocument):
        (WebCore::WMLTimerElement::timerFired):
        (WebCore::WMLTimerElement::start):
        (WebCore::WMLTimerElement::value):
        * wml/WMLTimerElement.h:

2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>

        Reviewed by Adam Roben.

        Forgot to initialize m_task member variable. Results in crashes sometimes.

        * wml/WMLAnchorElement.cpp:
        (WebCore::WMLAnchorElement::WMLAnchorElement):

2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>

        Not reviewed. Forgot to include within last patch.

        * manual-tests/wml/card-title-attr.wml: Added.

2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>

        Reviewed by Nikolas Zimmermann.

        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
        Adding WML <card> title attribute handling.

        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
        * wml/WMLElement.cpp:
        * wml/WMLCardElement.h:
        (WebCore::WMLCardElement::title):
        * wml/WMLCardElement.cpp:
        * wml/manual-test/card-title-attr.wml: Manual test

++ b/WebKit/gtk/ChangeLog
2009-06-24  Jiahua Huang  <jhuangjiahua@gmail.com>

        Reviewed by Holger Freyther.

        [Gtk] Add Undo/Redo support to WebKitGtk
        https://bugs.webkit.org/show_bug.cgi?id=26573

        Implement EditorClient::undo and other interested funcs.

        * WebCoreSupport/EditorClientGtk.cpp:
        (WebKit::EditorClient::registerCommandForUndo):
        (WebKit::EditorClient::registerCommandForRedo):
        (WebKit::EditorClient::clearUndoRedoOperations):
        (WebKit::EditorClient::canUndo):
        (WebKit::EditorClient::canRedo):
        (WebKit::EditorClient::undo):
        (WebKit::EditorClient::redo):
        (WebKit::EditorClient::EditorClient):
        * WebCoreSupport/EditorClientGtk.h:

++ b/WebKit/gtk/po/ChangeLog
2009-06-25  Duy Nguyen  <pclouds@gmail.com>

        Rubber-stamped by Jan Alonzo.

        Gtk port Vietnamese translation
        https://bugs.webkit.org/show_bug.cgi?id=26739

        * vi.po: Added.

++ b/WebKit/mac/ChangeLog
2009-06-26  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Sam Weinig.

        <rdar://problem/6651201> Update lookalike character list.

        * Misc/WebNSURLExtras.mm: (isLookalikeCharacter): Added more characters to the list.

2009-06-25  Anders Carlsson  <andersca@apple.com>

        Reviewed by Oliver Hunt.

        <rdar://problem/6989017>
        REGRESSION (SnowLeopard): RealPlayer content replays when opening a new tab or switching back to the RealPlayer tab

        If a plug-in fails in NPP_New, we would try to recreate it whenever the preferences for a web view would change.

        Fix this by setting a flag when we fail to instantiate the plug-in, so we only try once.

        * Plugins/WebBaseNetscapePluginView.h:
        * Plugins/WebBaseNetscapePluginView.mm:
        (-[WebBaseNetscapePluginView start]):

2009-06-25  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Simon Fraser  <simon.fraser@apple.com>.

        https://bugs.webkit.org/show_bug.cgi?id=26651

        Preference is named "WebKitAcceleratedCompositingEnabled"
        and is a boolean value. When false, prevents compositing layers from
        being created, which prevents hardware animation from running.
        Also forces video to do software rendering. Added a cache for
        the flag in RenderLayerCompositing and made it all work
        on-the-fly when the flag is changed while a page is loaded.

        * WebView/WebPreferenceKeysPrivate.h:
        * WebView/WebPreferences.h:
        * WebView/WebPreferences.mm:
        (+[WebPreferences initialize]):
        (-[WebPreferences acceleratedCompositingEnabled]):
        (-[WebPreferences setAcceleratedCompositingEnabled:]):
        * WebView/WebView.mm:
        (-[WebView _preferencesChangedNotification:]):

2009-06-24  Dan Bernstein  <mitz@apple.com>

        Reviewed by Anders Carlsson.

        Fix the most recently seen kind of crash in <rdar://problem/5983224>

        * WebView/WebHTMLView.mm:
        (-[WebHTMLView adjustPageHeightNew:top:bottom:limit:]): Null-check the
        Frame.

++ b/WebKit/qt/ChangeLog
2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for saving and loading of QWebHistory to and from a QByteArray.

        This includes streaming operators for QWebHistory. for convenience.

        New autotests that test QWebHistory and QWebHistoryItem serialization.

        * Api/qwebhistory.cpp:
        (QWebHistory::restoreState):
        (QWebHistory::saveState):
        (operator<<):
        (operator>>):
        * Api/qwebhistory.h:
        * Api/qwebhistory_p.h:
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::):
        (tst_QWebHistory::init):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::itemAt):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        (tst_QWebHistory::serialize_1):
        (tst_QWebHistory::serialize_2):
        (tst_QWebHistory::serialize_3):
        (tst_QWebHistory::saveAndRestore_1):
        (tst_QWebHistory::saveAndRestore_2):
        (tst_QWebHistory::saveAndRestore_3):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix the behaviour of QWebHistory::itemAt to interpret the specified index as absolute index.

        Returns an invalid QWebHistoryItem if the index is out of range.

        * Api/qwebhistory.cpp:
        (QWebHistory::itemAt):
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::itemAt):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Added a few autotest to QWebHistory.

        * tests/qwebhistory/data/page1.html: Added.
        * tests/qwebhistory/data/page2.html: Added.
        * tests/qwebhistory/data/page3.html: Added.
        * tests/qwebhistory/data/page4.html: Added.
        * tests/qwebhistory/data/page5.html: Added.
        * tests/qwebhistory/data/page6.html: Added.
        * tests/qwebhistory/qwebhistory.pro: Added.
        * tests/qwebhistory/tst_qwebhistory.cpp: Added.
        (tst_QWebHistory::):
        (tst_QWebHistory::tst_QWebHistory):
        (tst_QWebHistory::~tst_QWebHistory):
        (tst_QWebHistory::init):
        (tst_QWebHistory::cleanup):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        * tests/qwebhistory/tst_qwebhistory.qrc: Added.
        * tests/tests.pro:

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix support for documenting functions prefixed with QWEBKIT_EXPORT

        Add QWEBKIT_EXPORT to the list of macros to ignore by qdoc.

        * docs/qtwebkit.qdocconf:

2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Bug 20303: [Qt] Key events are not working in frames.

        Send scrolling events to current focused frame, bubble the event
        up to parent frame if it is not handled.  Use EventHandler's new
        shared scrolling code.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):
        (QWebPagePrivate::handleScrolling):
        * Api/qwebpage_p.h:

2009-06-25  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Adam Treat.

        Add highlight functionality to the QWebPage::findText() method. Introduced is
        new HighlightAllOccurrences flag which passed to the function will make it mark
        all existing occurrences of specified string in the page.

        * Api/qwebpage.cpp:
        (QWebPage::findText):
        * Api/qwebpage.h:
        * Api/qwebview.cpp:

++ b/WebKit/win/ChangeLog
2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Bug 20303: [Qt] Key events are not working in frames.

        Move the scroll handling code to EventHandler so that other
        ports can share the functionality.

        * WebView.cpp:
        (WebView::keyDown):
        (EnumTextMatches::QueryInterface):

++ b/WebKitLibraries/ChangeLog
2009-06-25  Simon Fraser  <simon.fraser@apple.com>

        Rubber-stamped by Mark Rowe.

        <rdar://problem/6999737>

        Update the media controller images.

        * libWebKitSystemInterfaceLeopard.a:
        * libWebKitSystemInterfaceSnowLeopard.a:
        * libWebKitSystemInterfaceTiger.a:

++ b/WebKitSite/ChangeLog
2009-06-24  Brady Eidson  <beidson@apple.com>

        Reviewed by Mark Rowe

        * demos/index.html: Fix more typos etc.

++ b/WebKitTools/ChangeLog
2009-06-26  Eric Seidel  <eric@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Remove non-sense --update option to land-patches
        and make land-patches update before every patch application.
        This makes it slightly less likely that multi-patch landings will fail.

        Also updated git diff command to include staged modifications.

        * Scripts/bugzilla-tool:
        * Scripts/modules/scm.py:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Jan Alonzo.

        Fix obsolete_attachment to work when passed a comment.
        https://bugs.webkit.org/show_bug.cgi?id=26745

        * Scripts/modules/bugzilla.py:

2009-06-25  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Reviewed by Mark Rowe.

        bugzilla-tool apply-patch throws exception in Linux
        https://bugs.webkit.org/show_bug.cgi?id=26738

        HEAD is case-sensitive in Linux. Convert uses of head to HEAD in
        the scm module.

        * Scripts/modules/scm.py:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Jan Alonzo.

        bugzilla-tool post-diff needs to obsolete old patches before posting
        https://bugs.webkit.org/show_bug.cgi?id=26740

        I've also added a --no-obsolete to disable this behavior.

        I also finally updated the bug page parsing to use XML. So much less code!

        * Scripts/bugzilla-tool:
        * Scripts/modules/bugzilla.py:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Mark Rowe.

        Call WebKitTools/Scripts scripts by their absolute paths
        https://bugs.webkit.org/show_bug.cgi?id=26704

        bugzilla-tool used to use whatever build-webkit was in your path.
        That could end up building the wrong copy of WebKit.

        * Scripts/bugzilla-tool:
        * Scripts/modules/scm.py:

2009-06-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Dave Levin.

        Use unicode() instead of str when reading from bugzilla.
        Also add Simon Fraser as a reviewer.
        https://bugs.webkit.org/show_bug.cgi?id=26719

        * Scripts/modules/bugzilla.py:

2009-06-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Simon Hausmann.

        Use Q_ASSERT in Qt's DumpRenderTree instead of JSC's ASSERT

        The WTFReportAssertionFailure function in JSC is not exported when
        building QtWebKit in both debug and release on Mac, so DRT fails to
        link.

        We can revert this patch once the Qt port builds JSC as a separate
        library, and we add the proper export macros to Assertions.cpp

        * DumpRenderTree/qt/WorkQueue.cpp:
        (WorkQueue::queue):
        (WorkQueue::dequeue):

2009-06-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>

        Reviewed by Jan Alonzo.

        bugzilla-tool: Add Simon Hausmann as reviewer

        * Scripts/modules/bugzilla.py:

2009-06-24  Eric Seidel  <eric@webkit.org>

        Reviewed by Dave Levin.

        Support local commits during apply-patches
        and let land-patches take multiple bug ids.
        https://bugs.webkit.org/show_bug.cgi?id=26703

        I also restructured parts of land-patches into
        class methods and static methods in preparation
        for future code sharing with other commands.

        * Scripts/bugzilla-tool:
        * Scripts/modules/bugzilla.py:
        * Scripts/modules/scm.py:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Make svn-apply work with Git too
        https://bugs.webkit.org/show_bug.cgi?id=26299

        Add an --force option to svn-apply and otherwise make svn-apply
        exit non-zero when patch application fails.
        https://bugs.webkit.org/show_bug.cgi?id=26300

        I did not update svn-unapply, because it makes no sense in a Git world.
        You don't roll in and out patch files.  You make commits and deal with those.
        Git users can just git reset --hard to get the same functionality.

        * Scripts/svn-apply:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Remove use of os.system to fix reviewers with unicode chars in their names
        https://bugs.webkit.org/show_bug.cgi?id=26713

        Also change to latin1 encoding of ø to make python happy.

        * Scripts/modules/bugzilla.py:
        * Scripts/modules/scm.py:

2009-06-25  Eric Seidel  <eric@webkit.org>

        Reviewed by Tor Arne Vestbø.

        Add Adam Roben and Tor Arne Vestbø to the reviewers list.

        * Scripts/modules/bugzilla.py:

2009-06-24  Chris Fleizach  <cfleizach@apple.com>

        Windows build fix.

        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
        (AccessibilityUIElement::language):

2009-06-24  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Bug 26668: AX: need a way to retrieve the language for an element
        Support ability to retrieve AXLanguage for testing

        * DumpRenderTree/AccessibilityUIElement.cpp:
        (getLanguageCallback):
        (AccessibilityUIElement::getJSClass):
        * DumpRenderTree/AccessibilityUIElement.h:
        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
        (AccessibilityUIElement::language):

174 files changed, 4473 insertions, 884 deletions

diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 55518f5..ce36bdf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,143 @@
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to Vector.
+
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
+
+2009-06-26  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26750        
+
+        Allow custom memory allocation control for JavaScriptCore/runtime
+        directory's classes which instantiated by new:
+
+        class  IdentifierTable
+        struct RegExpObjectData
+        class  HashEntry
+        struct DataInstance::Cache 
+        class  UString
+        struct RegExpConstructorPrivate
+        class  ScopeChain
+
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Make the opcode sampler work once again.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
+
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
+
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
+
+        * bytecode/CodeBlock.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26676
+
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
+
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26675
+
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
+
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
+
+        * wtf/HashMap.h:
+
+2009-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
+
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        * parser/Nodes.cpp:
+        (JSC::CommaNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
+
 2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Maciej Stachowiak.
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 94901f9..afd32f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -38,6 +38,7 @@
 #include "Nodes.h"
 #include "RegExp.h"
 #include "UString.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -214,7 +215,7 @@ namespace JSC {
     }
 #endif
 
-    class CodeBlock {
+    class CodeBlock : public WTF::FastAllocBase {
         friend class JIT;
     public:
         CodeBlock(ScopeNode* ownerNode);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 21de281..d29a24d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -40,6 +40,7 @@
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
@@ -60,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator {
+    class BytecodeGenerator : public WTF::FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 0f7625a..8e80eca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -3811,17 +3811,17 @@ yyreduce:
 
   case 196:
 #line 781 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
@@ -3888,7 +3888,7 @@ yyreduce:
 #line 855 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3936,7 +3936,7 @@ yyreduce:
 #line 892 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -5092,10 +5092,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 7cab254..702c89c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -66,7 +66,7 @@ namespace JSC {
 
     enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter : public WTF::FastAllocBase {
+    class Interpreter : public FastAllocBase {
         friend class JIT;
         friend class CachedCall;
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index cceac74..31f0c8b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -31,6 +31,7 @@
 
 #include "JSValue.h"
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -47,7 +48,7 @@ namespace JSC {
 
     typedef ExecState CallFrame;
 
-    class Register {
+    class Register : public WTF::FastAllocBase {
     public:
         Register();
         Register(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index bc006fc..db3f38a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -342,61 +342,40 @@ namespace JSC {
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
         }
         static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
         }
         static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
 
         static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
         static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
@@ -407,9 +386,6 @@ namespace JSC {
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index 2dc69c1..bc07178 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -108,8 +108,8 @@ namespace JSC {
         JIT::Call call()
         {
 #if ENABLE(OPCODE_SAMPLING)
-            ASSERT(m_jit->m_bytecodeIndex != (unsigned)-1);
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
 #endif
 
             m_jit->restoreArgumentReference();
@@ -117,7 +117,8 @@ namespace JSC {
             m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
 
 #if ENABLE(OPCODE_SAMPLING)
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
 #endif
 
             m_jit->killLastResultRegister();
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 52dddde..c5ca425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -80,7 +80,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -778,17 +778,17 @@ AssignmentOperator:
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -854,7 +854,7 @@ VariableDeclarationList:
   | VariableDeclarationList ',' IDENT Initializer
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -891,7 +891,7 @@ VariableDeclarationListNoIn:
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -2071,10 +2071,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
index ea1579b..d17da69 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -659,9 +659,9 @@ namespace JSC {
 
     inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
         : ExpressionNode(globalData)
-        , m_expr1(expr1)
-        , m_expr2(expr2)
     {
+        m_expressions.append(expr1);
+        m_expressions.append(expr2);
     }
 
     inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 3cfd125..ba6e1e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1186,8 +1186,10 @@ RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, Re
 
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1);
-    return generator.emitNode(dst, m_expr2);
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 7cdc19d..a9f88b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -169,7 +169,8 @@ namespace JSC {
         virtual bool isResolveNode() const { return false; }
         virtual bool isBracketAccessorNode() const { return false; }
         virtual bool isDotAccessorNode() const { return false; }
-        virtual bool isFuncExprNode() const { return false; } 
+        virtual bool isFuncExprNode() const { return false; }
+        virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
 
@@ -1087,16 +1088,20 @@ namespace JSC {
         Operator m_operator;
         ExpressionNode* m_right;
     };
+    
+    typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
     class CommaNode : public ExpressionNode {
     public:
         CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
+        void append(ExpressionNode* expr) { m_expressions.append(expr); }
+
     private:
+        virtual bool isCommaNode() const { return true; }
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        ExpressionNode* m_expr1;
-        ExpressionNode* m_expr2;
+        ExpressionVector m_expressions;
     };
     
     class ConstDeclNode : public ExpressionNode {
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
index fdd7bbc..ba48c55 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-    struct CallIdentifier : public WTF::FastAllocBase {
+    struct CallIdentifier : public FastAllocBase {
         UString m_name;
         UString m_url;
         unsigned m_lineNumber;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index 62791ae..a11967e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -30,7 +30,7 @@ using namespace WTF;
 
 namespace JSC {
 
-struct DateInstance::Cache {
+struct DateInstance::Cache : public FastAllocBase {
     double m_gregorianDateTimeCachedForMS;
     GregorianDateTime m_cachedGregorianDateTime;
     double m_gregorianDateTimeUTCCachedForMS;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 040c123..7db723b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -32,7 +32,7 @@ namespace JSC {
 
 typedef HashMap<const char*, RefPtr<UString::Rep>, PtrHash<const char*> > LiteralIdentifierTable;
 
-class IdentifierTable {
+class IdentifierTable : public FastAllocBase {
 public:
     ~IdentifierTable()
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 3b7353d..fe94b16 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -44,7 +44,7 @@ namespace JSC {
     typedef PropertySlot::GetValueFunc GetFunction;
     typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
-    class HashEntry {
+    class HashEntry : public FastAllocBase {
     public:
         void initialize(UString::Rep* key, unsigned char attributes, intptr_t v1, intptr_t v2)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index bcd0d07..82481a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -88,7 +88,7 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate {
+struct RegExpConstructorPrivate : public FastAllocBase {
     // Global search cache / settings
     RegExpConstructorPrivate()
         : lastNumSubPatterns(0)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index fac9978..f62b7e1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -56,7 +56,7 @@ namespace JSC {
 
         virtual CallType getCallData(CallData&);
 
-        struct RegExpObjectData {
+        struct RegExpObjectData : public FastAllocBase {
             RegExpObjectData(PassRefPtr<RegExp> regExp, double lastIndex)
                 : regExp(regExp)
                 , lastIndex(lastIndex)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 3b10d32..d7cd257 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -30,7 +30,7 @@ namespace JSC {
     class JSObject;
     class ScopeChainIterator;
     
-    class ScopeChainNode : public WTF::FastAllocBase {
+    class ScopeChainNode : public FastAllocBase {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
             : next(next)
@@ -154,7 +154,7 @@ namespace JSC {
 
     class NoScopeChain {};
 
-    class ScopeChain {
+    class ScopeChain : public FastAllocBase {
         friend class JIT;
     public:
         ScopeChain(NoScopeChain)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index d01b75d..288d271 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -73,7 +73,7 @@ namespace JSC {
 
     typedef Vector<char, 32> CStringBuffer;
 
-    class UString {
+    class UString : public FastAllocBase {
         friend class JIT;
 
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
index 71e6bfa..1c81856 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -397,4 +397,7 @@ namespace WTF {
 
 } // namespace WTF
 
+// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
+using WTF::FastAllocBase;
+
 #endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index c5b75ff..3de5ee6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -29,7 +29,7 @@ namespace WTF {
 
     template<typename KeyArg, typename MappedArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
         typename KeyTraitsArg = HashTraits<KeyArg>, typename MappedTraitsArg = HashTraits<MappedArg> >
-    class HashMap {
+    class HashMap : public FastAllocBase {
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 050feb1..c378fd0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -28,6 +28,10 @@
 #include <limits>
 #include <utility>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 namespace WTF {
 
     using std::min;
@@ -563,6 +567,32 @@ namespace WTF {
         Buffer m_buffer;
     };
 
+#if PLATFORM(QT)
+    template<typename T>
+    QDataStream& operator<<(QDataStream& stream, const Vector<T>& data)
+    {
+        stream << qint64(data.size());
+        foreach (const T& i, data)
+            stream << i;
+        return stream;
+    }
+
+    template<typename T>
+    QDataStream& operator>>(QDataStream& stream, Vector<T>& data)
+    {
+        data.clear();
+        qint64 count;
+        T item;
+        stream >> count;
+        data.reserveCapacity(count);
+        for (qint64 i = 0; i < count; ++i) {
+            stream >> item;
+            data.append(item);
+        }
+        return stream;
+    }
+#endif
+
     template<typename T, size_t inlineCapacity>
     Vector<T, inlineCapacity>::Vector(const Vector& other)
         : m_size(other.size())
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index ec2aa17..ae6b09d 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        6d5a2a0472a6af0b7f781da018e76bb8522d57a5
+        6b0744eab3f993b9c2bd44e3e79d7664040fd003
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 25427bc..051af27 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,1253 @@
+2009-06-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+
+        Test: editing/inserting/break-blockquote-after-delete.html
+
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
+
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * WebCore.pro:
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to String and IntPoint.
+
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+
+2009-06-26  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
+
+        * bindings/v8/custom/V8StorageCustom.cpp
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
+
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
+
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
+
+        Test: svg/custom/createImageElement.svg
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
+
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
+
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
+
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
+
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
+
+        http://code.google.com/p/chromium/issues/detail?id=10545
+
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
+
+        Test: fast/frames/viewsource-on-image-file.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
+
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
+
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
+
+        Based on Norbert Leser's work.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
+
+        * WebCore.pro:
+
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
+
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/6990481>
+        
+        Handle perspective computation on non-layer objects.
+
+        Test: transforms/3d/general/perspective-non-layer.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26653
+
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
+
+        Media tests results are affected by this changes.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26724
+
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26733
+
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        Add missing include for r45199.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26736
+
+        r45199 added a reference to throwError without including V8Proxy.h
+
+        * bindings/v8/WorkerScriptController.cpp:
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26735
+
+        Fix V8IsolatedWorld to point to the correct include file.
+
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
+
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26651
+        
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-06-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
+
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+
+2009-06-25  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8Index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26495
+
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26529
+
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
+
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
+
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
+
+        http://codereview.chromium.org/132007
+
+        This should not affect any layout tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
+
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
+
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
+
+2009-06-25  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add FileList.h include to fix Chromium build.
+
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
+
+        Fixed a Typo in a Web Inspector error message.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing StorageAreaSync files to the build.
+
+        * WebCore.pro:
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
+
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
+
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
+
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
+
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+
+        Test: http/tests/security/clipboard/clipboard-file-access.html
+
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, reverting r45144 only.
+
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
+
+        Test: fast/replaced/image-map-2.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
+
+2009-06-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26366
+
+        Refactor V8DOMMap to support isolated worlds.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
+
+        Seems like search was damaged in revision 42808.
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
+
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26658
+
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
+
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26668: AX: need a way to retrieve the language for an element
+        
+        Provides a way to retrieve the language associated with a specific accessibility element.
+
+        Test: accessibility/language-attribute.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
+
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Add files that were added in r45093 and r45096
+
+        * GNUmakefile.am:
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Fix 64-bit SnowLeopard build.
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+
+        React to href updates even when there is no renderer, i.e. display=none.
+
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2009-06-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26687
+
+        Add basic back-end column support to datagrid.
+
+        Added fast/dom/HTMLDataGridElement/ column tests.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
+        
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
+        
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
+
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
+
+2009-06-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
+
+        This change just adds a stub implementation for now to help fix the build.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
+        Reviewed by Adam Roben.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include within last patch.
+
+        * manual-tests/wml/card-title-attr.wml: Added.
+
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
+
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
+        * wml/WMLCardElement.cpp:
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
 2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index a26a4de..3075a4b 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -54,6 +54,8 @@
 #include "JSCSSVariablesDeclaration.cpp"
 #include "JSCSSVariablesRule.cpp"
 #include "JSDatabase.cpp"
+#include "JSDataGridColumn.cpp"
+#include "JSDataGridColumnList.cpp"
 #include "JSDocument.cpp"
 #include "JSDocumentFragment.cpp"
 #include "JSDocumentType.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
new file mode 100644
index 0000000..6e50bd8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_FastAllocBase_h
+#define WebCore_FWD_FastAllocBase_h
+#include <JavaScriptCore/FastAllocBase.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 3ccfb32..ce65958 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -329,6 +329,8 @@ IDL_BINDINGS += \
     html/CanvasGradient.idl \
     html/CanvasPattern.idl \
     html/CanvasRenderingContext2D.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
     html/File.idl \
     html/FileList.idl \
     html/HTMLAudioElement.idl \
@@ -459,6 +461,7 @@ SOURCES += \
     bindings/js/JSCustomPositionErrorCallback.cpp \
     bindings/js/JSCustomVoidCallback.cpp \
     bindings/js/JSCustomXPathNSResolver.cpp \
+    bindings/js/JSDataGridColumnListCustom.cpp \
     bindings/js/JSDataGridDataSource.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
@@ -735,6 +738,7 @@ SOURCES += \
     history/CachedFrame.cpp \
     history/CachedPage.cpp \
     history/HistoryItem.cpp \
+    history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
     html/CanvasGradient.cpp \
     html/CanvasPattern.cpp \
@@ -742,6 +746,8 @@ SOURCES += \
     html/CanvasRenderingContext2D.cpp \
     html/CanvasStyle.cpp \
     html/CollectionCache.cpp \
+    html/DataGridColumn.cpp \
+    html/DataGridColumnList.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -1361,19 +1367,19 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/Storage.h \
         storage/StorageEvent.h \
         storage/SessionStorage.h \
-        storage/SessionStorageArea.h
+        storage/StorageSyncManager.h \
+        storage/StorageAreaSync.h
 
     SOURCES += \
         storage/LocalStorage.cpp \
-        storage/LocalStorageArea.cpp \
         storage/LocalStorageTask.cpp \
         storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
         storage/StorageArea.cpp \
+        storage/StorageAreaSync.cpp \
         storage/StorageMap.cpp \
         storage/StorageEvent.cpp \
         storage/SessionStorage.cpp \
-        storage/SessionStorageArea.cpp \
         storage/StorageSyncManager.cpp \
         bindings/js/JSStorageCustom.cpp
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index dccff82..a6cd62d 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -298,7 +298,22 @@ bool AccessibilityObject::press() const
     actionElem->accessKeyAction(true);
     return true;
 }
-
+    
+String AccessibilityObject::language() const
+{
+    AccessibilityObject* parent = parentObject();
+    
+    // as a last resort, fall back to the content language specified in the meta tag
+    if (!parent) {
+        Document* doc = document();
+        if (doc)
+            return doc->contentLanguage();
+        return String();
+    }
+    
+    return parent->language();
+}
+    
 AXObjectCache* AccessibilityObject::axObjectCache() const
 {
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index f71be99..8939092 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -311,7 +311,8 @@ public:
     virtual Document* document() const { return 0; }
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
-
+    virtual String language() const;
+    
     void setAXObjectID(unsigned);
     virtual void setFocused(bool);
     virtual void setSelectedText(const String&);
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 6f309a8..663d643 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -656,6 +656,25 @@ String AccessibilityRenderObject::helpText() const
     
     return String();
 }
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    // Defer to parent if this element doesn't have a language set
+    Node* node = m_renderer->node();
+    if (!node)
+        return AccessibilityObject::language();
+    
+    if (!node->isElementNode())
+        return AccessibilityObject::language();
+    
+    String language = static_cast<Element*>(node)->getAttribute(langAttr);
+    if (language.isEmpty())
+        return AccessibilityObject::language();
+    return language;
+}
 
 String AccessibilityRenderObject::textUnderElement() const
 {
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index 3fa88a2..dd1d583 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -177,6 +177,7 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
+    virtual String language() const;
     
     virtual const AccessibilityChildrenVector& children();
     
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index 95f425e..af49df4 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,39 +23,27 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SessionStorageArea_h
-#define SessionStorageArea_h
+#include "config.h"
+#include "JSDataGridColumnList.h"
 
-#if ENABLE(DOM_STORAGE)
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "JSDataGridColumn.h"
 
-#include "StorageArea.h"
+using namespace JSC;
 
 namespace WebCore {
 
-    class Page;
-    
-    class SessionStorageArea : public StorageArea {
-    public:
-        static PassRefPtr<SessionStorageArea> create(SecurityOrigin* origin, Page* page) { return adoptRef(new SessionStorageArea(origin, page)); }
-        PassRefPtr<SessionStorageArea> copy(SecurityOrigin*, Page*);
-                
-        Page* page() { return m_page; }
+bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* impl, const Identifier& propertyName)
+{
+    return impl->itemWithName(propertyName);
+}
 
-    private:
-        SessionStorageArea(SecurityOrigin*, Page*);
-        SessionStorageArea(SecurityOrigin*, Page*, SessionStorageArea*);
-
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame);
-        virtual void areaCleared(Frame* sourceFrame);
-
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        
-        Page* m_page;
-    };
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->itemWithName(propertyName));
+}
 
 } // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
-#endif // SessionStorageArea_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 04bc929..2a7a81a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -624,9 +624,9 @@ END
 
     if ($attrIsPodType) {
         my $classIndex = uc($attrType);
-        push(@implContentDecls, "    return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);n");
+        push(@implContentDecls, "    return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);\n");
     } else {
-        push(@implContentDecls, "    return ".NativeToJSValue($attribute - >signature, $result).";n");
+        push(@implContentDecls, "    return ".NativeToJSValue($attribute->signature, $result).";\n");
     }
 
     push(@implContentDecls, "  }\n\n");  # end of getter
@@ -945,7 +945,7 @@ sub GenerateBatchedAttributeData
         if ($interfaceName eq "DOMWindow") {
             $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
             $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-        } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "SVGElementInstance") {
+        } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
             $getter = "V8Custom::v8ElementEventHandlerAccessorGetter";
             $setter = "V8Custom::v8ElementEventHandlerAccessorSetter";
         } else {
@@ -1135,7 +1135,7 @@ sub GenerateImplementation
     foreach my $function (@{$dataNode->functions}) {
         # hack for addEventListener/RemoveEventListener
         # FIXME: avoid naming conflict
-        if ($function->signature->extendedAttributes->{"Custom"} || function->signature->extendedAttributes->{"V8Custom"}) {
+        if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"}) {
                 $implIncludes{"V8CustomBinding.h"} = 1;
         } else {
             GenerateFunctionCallback($function, $dataNode, $classIndex, $implClassName);
@@ -1603,6 +1603,7 @@ sub IsRefPtrType
     return 1 if $type eq "Element";
     return 1 if $type eq "EntityReference";
     return 1 if $type eq "Event";
+    return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
     return 1 if $type eq "HTMLDocument";
     return 1 if $type eq "HTMLElement";
@@ -1706,6 +1707,7 @@ my %typeCanFailConversion = (
     "AtomicString" => 0,
     "Attr" => 1,
     "CompareHow" => 0,
+    "DataGridColumn" => 0,
     "DOMString" => 0,
     "DOMWindow" => 0,
     "DocumentType" => 0,
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index b94abbf..668458c 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -30,12 +30,16 @@ audio {
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-user-select: none;
     position: absolute;
     bottom: 0;
     width: 100%;
-    height: 100%;
-    -webkit-user-select: none;
     z-index: 0;
+    overflow: hidden;
+    height: 16px;
+    text-align: right;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
@@ -44,32 +48,26 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
     -webkit-appearance: media-play-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: end;
+    -webkit-box-flex: 1;
     -webkit-user-select: none;
-    position: absolute;
-    padding: 0px 16px 0px 0px;
-    top: auto;
-    bottom: 0;
-    left: 32px;
-    right: 32px;
     height: 16px;
 }
 
@@ -83,35 +81,27 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0px;
-    right: 0px;
+    display: -webkit-box;
+    -webkit-box-flex: 1;
     height: 16px;
     padding: 0px 2px;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     -webkit-appearance: media-seek-forward-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
     display: none;
 }
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
index 3a49816..900dcf2 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
@@ -22,7 +22,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-/* alternate media controls */
+/* alternate media controls - Extend mediaControls.css */
 
 audio {
     width: 200px;
@@ -30,47 +30,26 @@ audio {
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
-    -webkit-user-select: none;
-    position: absolute;
-    bottom: 0;
-    width: 100%;
-    height: 100%;
-    z-index: 0;
+    /* In mediaControls.css */
+    height: 25px;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -16px;
+    bottom: -25px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
-    -webkit-appearance: media-mute-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 0;
-    left: auto;
+    -webkit-box-ordinal-group: 2; /* At the end of the controller bar */
     width: 30px;
     height: 25px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
-    -webkit-appearance: media-play-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0px;
     width: 30px;
     height: 25px;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
-    -webkit-appearance: media-timeline-container;
-    -webkit-user-select: none;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 30px;
-    right: 30px;
     height: 25px;
 }
 
@@ -78,16 +57,12 @@ audio::-webkit-media-controls-current-time-display, video::-webkit-media-control
     -webkit-appearance: media-current-time-display;
     -webkit-user-select: none;
     display: inline-block;
-    position: absolute;
     cursor: default;
     font: -webkit-small-control;
     font-size: .09em;
     text-align: center;
     overflow: hidden;
     line-height: 13px;
-    top: auto;
-    bottom: 6px;
-    left: 0px;
     height: 14px;
     width: 45px;
 }
@@ -96,36 +71,28 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
     -webkit-appearance: media-time-remaining-display;
     -webkit-user-select: none;
     display: inline-block;
-    position: absolute;
     cursor: default;
     font: -webkit-small-control;
     font-size: .09em;
     text-align: center;
     overflow: hidden;
     line-height: 13px;
-    top: auto;
-    bottom: 6px;
-    right: 0px;
     height: 14px;
     width: 45px;
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
-    -webkit-appearance: media-slider;
-    position: absolute;
-    top: auto;
-    bottom: 6px;
-    left: 45px;
-    right: 45px;
     height: 13px;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     display: none;
+    width: 0px;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     display: none;
+    width: 0px;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index 59ae026..0fea604 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -33,6 +33,8 @@
 
 namespace WebCore {
 
+    class FileList;
+
     // State available during IE's events for drag and drop and copy/paste
     class Clipboard : public RefCounted<Clipboard> {
     public:
@@ -53,11 +55,12 @@ namespace WebCore {
     
         // extensions beyond IE's API
         virtual HashSet<String> types() const = 0;
-    
+        virtual PassRefPtr<FileList> files() const = 0;
+
         IntPoint dragLocation() const { return m_dragLoc; }
         CachedImage* dragImage() const { return m_dragImage.get(); }
         virtual void setDragImage(CachedImage*, const IntPoint&) = 0;
-        Node* dragImageElement() { return m_dragImageElement.get(); }
+        Node* dragImageElement() const { return m_dragImageElement.get(); }
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
index 6fe83f7..dc8677e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
@@ -34,6 +34,7 @@ module core {
                  attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
                  attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
         readonly attribute [CustomGetter] Array types;
+        readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 783c629..065f708 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -314,14 +314,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 
 PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame* frame, bool inViewSourceMode)
 {
-    if (inViewSourceMode) {
-        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type)
-#if ENABLE(XHTMLMP)
-            || type == "application/vnd.wap.xhtml+xml"
-#endif
-           )
-            return HTMLViewSourceDocument::create(frame, type);
-    }
+    if (inViewSourceMode)
+        return HTMLViewSourceDocument::create(frame, type);
 
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index abf7a35..3d01c80 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -2540,7 +2540,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent);
+        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0);
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2570,7 +2570,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent);
+        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0);
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index b68785f..3ddf4c0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2633,7 +2633,7 @@ bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicStrin
     return dispatchMouseEvent(eventType, button, detail,
         contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget);
+        false, relatedTarget, 0);
 }
 
 void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 501df67..ab743f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -531,7 +531,7 @@ public:
     void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
 
     void dispatchSubtreeModifiedEvent();
-    void dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
+    void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
@@ -539,8 +539,8 @@ public:
     bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
         int pageX, int pageY, int screenX, int screenY,
         bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
+        bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
+    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
     void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
     void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 906902a..879bf62 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -258,8 +258,7 @@ void ProcessingInstruction::removedFromDocument()
 {
     ContainerNode::removedFromDocument();
 
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
 
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
     if (m_cachedSheet)
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index ff8f1c3..1831f3a 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -198,8 +198,9 @@ void SelectElement::menuListOnChange(SelectElementData& data, Element* element)
     ASSERT(data.usesMenuList());
 
     int selected = selectedIndex(data, element);
-    if (data.lastOnChangeIndex() != selected) {
+    if (data.lastOnChangeIndex() != selected && data.userDrivenChange()) {
         data.setLastOnChangeIndex(selected);
+        data.setUserDrivenChange(false);
         element->dispatchFormControlChangeEvent();
     }
 }
@@ -309,7 +310,7 @@ int SelectElement::selectedIndex(const SelectElementData& data, const Element* e
     return -1;
 }
 
-void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChange)
+void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChangeNow, bool userDrivenChange)
 {
     const Vector<Element*>& items = data.listItems(element);
     int listIndex = optionToListIndex(data, element, optionIndex);
@@ -335,9 +336,12 @@ void SelectElement::setSelectedIndex(SelectElementData& data, Element* element,
 
     scrollToSelection(data, element);
 
-    // This only gets called with fireOnChange for menu lists. 
-    if (fireOnChange && data.usesMenuList())
-        menuListOnChange(data, element);
+    // This only gets called with fireOnChangeNow for menu lists. 
+    if (data.usesMenuList()) {
+        data.setUserDrivenChange(userDrivenChange);
+        if (fireOnChangeNow)
+            menuListOnChange(data, element);
+    }
 
     if (Frame* frame = element->document()->frame())
         frame->page()->chrome()->client()->formStateDidChange(element);
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
index bad9b79..29187ae 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -57,7 +57,8 @@ public:
     virtual int optionToListIndex(int optionIndex) const = 0;
 
     virtual int selectedIndex() const = 0;
-    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false) = 0;
+    virtual void setSelectedIndex(int index, bool deselect = true) = 0;
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false) = 0;
 
 protected:
     virtual ~SelectElement() { }
@@ -78,7 +79,7 @@ protected:
     static void setRecalcListItems(SelectElementData&, Element*);
     static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
     static int selectedIndex(const SelectElementData&, const Element*);
-    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChange = false);
+    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChangeNow = false, bool userDrivenChange = true);
     static int optionToListIndex(const SelectElementData&, const Element*, int optionIndex);
     static int listToOptionIndex(const SelectElementData&, const Element*, int listIndex);
     static void dispatchFocusEvent(SelectElementData&, Element*);
@@ -117,6 +118,9 @@ public:
     int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
     void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
 
+    bool userDrivenChange() const { return m_userDrivenChange; }
+    void setUserDrivenChange(bool value) { m_userDrivenChange = value; }
+
     Vector<bool>& lastOnChangeSelection() { return m_lastOnChangeSelection; }
 
     bool activeSelectionState() const { return m_activeSelectionState; }
@@ -154,6 +158,7 @@ private:
 
     int m_lastOnChangeIndex;
     Vector<bool> m_lastOnChangeSelection;
+    bool m_userDrivenChange;
 
     bool m_activeSelectionState;
     int m_activeSelectionAnchorIndex;
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index 5ce4e56..f5901d7 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -58,6 +58,7 @@ TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, con
       m_killRing(killRing),
       m_openedByBackwardDelete(false)
 {
+    updatePreservesTypingStyle(m_commandType);
 }
 
 void TypingCommand::deleteSelection(Document* document, bool smartDelete)
@@ -309,8 +310,10 @@ void TypingCommand::markMisspellingsAfterTyping()
     }
 }
 
-void TypingCommand::typingAddedToOpenCommand()
+void TypingCommand::typingAddedToOpenCommand(ETypingCommand commandTypeForAddedTyping)
 {
+    updatePreservesTypingStyle(commandTypeForAddedTyping);
+    
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     document()->frame()->editor()->appliedEditing(this);
     // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
@@ -360,19 +363,19 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
         applyCommandToComposite(command);
     }
     command->input(text, selectInsertedText);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertText);
 }
 
 void TypingCommand::insertLineBreak()
 {
     applyCommandToComposite(InsertLineBreakCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertLineBreak);
 }
 
 void TypingCommand::insertParagraphSeparator()
 {
     applyCommandToComposite(InsertParagraphSeparatorCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparator);
 }
 
 void TypingCommand::insertParagraphSeparatorInQuotedContent()
@@ -385,7 +388,7 @@ void TypingCommand::insertParagraphSeparatorInQuotedContent()
     }
         
     applyCommandToComposite(BreakBlockquoteCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparatorInQuotedContent);
 }
 
 bool TypingCommand::makeEditableRootEmpty()
@@ -423,7 +426,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             // After breaking out of an empty mail blockquote, we still want continue with the deletion
             // so actual content will get deleted, and not just the quote style.
             if (breakOutOfEmptyMailBlockquotedParagraph())
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(DeleteKey);
         
             m_smartDelete = false;
 
@@ -436,12 +439,12 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             if (endingSelection().visibleStart().previous(true).isNull()) {
                 // When the caret is at the start of the editable area in an empty list item, break out of the list item.
                 if (breakOutOfEmptyListItem()) {
-                    typingAddedToOpenCommand();
+                    typingAddedToOpenCommand(DeleteKey);
                     return;
                 }
                 // When there are no visible positions in the editing root, delete its entire contents.
                 if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
-                    typingAddedToOpenCommand();
+                    typingAddedToOpenCommand(DeleteKey);
                     return;
                 }
             }
@@ -457,7 +460,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             // If the caret is just after a table, select the table and don't delete anything.
             } else if (Node* table = isFirstPositionAfterTable(visibleStart)) {
                 setEndingSelection(VisibleSelection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(DeleteKey);
                 return;
             }
 
@@ -498,7 +501,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
         setStartingSelection(selectionAfterUndo);
     CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
     setSmartDelete(false);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(DeleteKey);
 }
 
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool killRing)
@@ -530,7 +533,7 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
             // When deleting tables: Select the table first, then perform the deletion
             if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.deprecatedEditingOffset() == 0) {
                 setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.node()), DOWNSTREAM));
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(ForwardDeleteKey);
                 return;
             }
 
@@ -578,30 +581,32 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
     setStartingSelection(selectionAfterUndo);
     CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
     setSmartDelete(false);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(ForwardDeleteKey);
 }
 
 void TypingCommand::deleteSelection(bool smartDelete)
 {
     CompositeEditCommand::deleteSelection(smartDelete);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(DeleteSelection);
 }
 
-bool TypingCommand::preservesTypingStyle() const
+void TypingCommand::updatePreservesTypingStyle(ETypingCommand commandType)
 {
-    switch (m_commandType) {
+    switch (commandType) {
         case DeleteSelection:
         case DeleteKey:
         case ForwardDeleteKey:
         case InsertParagraphSeparator:
         case InsertLineBreak:
-            return true;
+            m_preservesTypingStyle = true;
+            return;
         case InsertParagraphSeparatorInQuotedContent:
         case InsertText:
-            return false;
+            m_preservesTypingStyle = false;
+            return;
     }
     ASSERT_NOT_REACHED();
-    return false;
+    m_preservesTypingStyle = false;
 }
 
 bool TypingCommand::isTypingCommand() const
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
index 2c52447..7c89a7c 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
@@ -79,10 +79,11 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const;
     virtual bool isTypingCommand() const;
-    virtual bool preservesTypingStyle() const;
+    virtual bool preservesTypingStyle() const { return m_preservesTypingStyle; }
 
+    void updatePreservesTypingStyle(ETypingCommand);
     void markMisspellingsAfterTyping();
-    void typingAddedToOpenCommand();
+    void typingAddedToOpenCommand(ETypingCommand);
     bool makeEditableRootEmpty();
     
     ETypingCommand m_commandType;
@@ -92,6 +93,7 @@ private:
     bool m_smartDelete;
     TextGranularity m_granularity;
     bool m_killRing;
+    bool m_preservesTypingStyle;
     
     // Undoing a series of backward deletes will restore a selection around all of the
     // characters that were deleted, but only if the typing command being undone
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 9df81d8..4ad3078 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -3811,17 +3811,17 @@ yyreduce:
 
   case 196:
 #line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
@@ -3888,7 +3888,7 @@ yyreduce:
 #line 855 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3936,7 +3936,7 @@ yyreduce:
 #line 892 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -5092,10 +5092,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 4aedc14..19c40b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -22,6 +22,8 @@
 #include "JSClipboard.h"
 
 #include "Clipboard.h"
+#include "FileList.h"
+#include "JSFileList.h"
 #include "KURL.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
@@ -34,20 +36,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 /* Hash table */
 
-static const HashTableValue JSClipboardTableValues[5] =
+static const HashTableValue JSClipboardTableValues[6] =
 {
     { "dropEffect", DontDelete, (intptr_t)jsClipboardDropEffect, (intptr_t)setJSClipboardDropEffect },
     { "effectAllowed", DontDelete, (intptr_t)jsClipboardEffectAllowed, (intptr_t)setJSClipboardEffectAllowed },
     { "types", DontDelete|ReadOnly, (intptr_t)jsClipboardTypes, (intptr_t)0 },
+    { "files", DontDelete|ReadOnly, (intptr_t)jsClipboardFiles, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsClipboardConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSClipboardTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSClipboardTableValues, 0 };
+    { 63, JSClipboardTableValues, 0 };
 #else
-    { 10, 7, JSClipboardTableValues, 0 };
+    { 17, 15, JSClipboardTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -160,6 +163,13 @@ JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot&
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->types(exec);
 }
 
+JSValue jsClipboardFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->files()));
+}
+
 JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->getConstructor(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index a9d51ab..a6fbe3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -91,6 +91,7 @@ void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
new file mode 100644
index 0000000..105b916
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -0,0 +1,289 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumn.h"
+
+#include "DataGridColumn.h"
+#include "KURL.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumn);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnTableValues[8] =
+{
+    { "id", DontDelete, (intptr_t)jsDataGridColumnId, (intptr_t)setJSDataGridColumnId },
+    { "label", DontDelete, (intptr_t)jsDataGridColumnLabel, (intptr_t)setJSDataGridColumnLabel },
+    { "type", DontDelete, (intptr_t)jsDataGridColumnType, (intptr_t)setJSDataGridColumnType },
+    { "sortable", DontDelete, (intptr_t)jsDataGridColumnSortable, (intptr_t)setJSDataGridColumnSortable },
+    { "sortDirection", DontDelete, (intptr_t)jsDataGridColumnSortDirection, (intptr_t)setJSDataGridColumnSortDirection },
+    { "primary", DontDelete, (intptr_t)jsDataGridColumnPrimary, (intptr_t)setJSDataGridColumnPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSDataGridColumnTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnConstructorTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnConstructorTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnConstructor : public DOMObject {
+public:
+    JSDataGridColumnConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnConstructor::s_info = { "DataGridColumnConstructor", 0, &JSDataGridColumnConstructorTable, 0 };
+
+bool JSDataGridColumnConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnConstructor, DOMObject>(exec, &JSDataGridColumnConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnPrototype::s_info = { "DataGridColumnPrototype", 0, &JSDataGridColumnPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumn>(exec, globalObject);
+}
+
+bool JSDataGridColumnPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnPrototype, JSObject>(exec, &JSDataGridColumnPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumn::s_info = { "DataGridColumn", 0, &JSDataGridColumnTable, 0 };
+
+JSDataGridColumn::JSDataGridColumn(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumn> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumn::~JSDataGridColumn()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumn::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnPrototype(JSDataGridColumnPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumn::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, slot);
+}
+
+JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->id());
+}
+
+JSValue jsDataGridColumnLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->label());
+}
+
+JSValue jsDataGridColumnType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->type());
+}
+
+JSValue jsDataGridColumnSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortable());
+}
+
+JSValue jsDataGridColumnSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortDirection());
+}
+
+JSValue jsDataGridColumnPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->primary());
+}
+
+JSValue jsDataGridColumnConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSDataGridColumn, Base>(exec, propertyName, value, &JSDataGridColumnTable, this, slot);
+}
+
+void setJSDataGridColumnId(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setId(value.toString(exec));
+}
+
+void setJSDataGridColumnLabel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setLabel(value.toString(exec));
+}
+
+void setJSDataGridColumnType(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setType(value.toString(exec));
+}
+
+void setJSDataGridColumnSortable(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortable(value.toInt32(exec));
+}
+
+void setJSDataGridColumnSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortDirection(value.toInt32(exec));
+}
+
+void setJSDataGridColumnPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setPrimary(value.toBoolean(exec));
+}
+
+JSValue JSDataGridColumn::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnConstructor>(exec);
+}
+
+// Constant getters
+
+JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumn* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumn>(exec, object);
+}
+DataGridColumn* toDataGridColumn(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumn::s_info) ? static_cast<JSDataGridColumn*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
new file mode 100644
index 0000000..331ad9d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -0,0 +1,98 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumn_h
+#define JSDataGridColumn_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumn;
+
+class JSDataGridColumn : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumn(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumn>);
+    virtual ~JSDataGridColumn();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumn* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumn> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumn*);
+DataGridColumn* toDataGridColumn(JSC::JSValue);
+
+class JSDataGridColumnPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsDataGridColumnId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
new file mode 100644
index 0000000..276878e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -0,0 +1,301 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "ExceptionCode.h"
+#include "JSDataGridColumn.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumnList);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnListTableValues[5] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListLength, (intptr_t)0 },
+    { "sortColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListSortColumn, (intptr_t)0 },
+    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListPrimaryColumn, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnListConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSDataGridColumnListTableValues, 0 };
+#else
+    { 10, 7, JSDataGridColumnListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDataGridColumnListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSDataGridColumnListConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnListConstructor : public DOMObject {
+public:
+    JSDataGridColumnListConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnListPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnListConstructor::s_info = { "DataGridColumnListConstructor", 0, &JSDataGridColumnListConstructorTable, 0 };
+
+bool JSDataGridColumnListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnListConstructor, DOMObject>(exec, &JSDataGridColumnListConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionItem, (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionAdd, (intptr_t)5 },
+    { "remove", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionRemove, (intptr_t)1 },
+    { "move", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionMove, (intptr_t)2 },
+    { "clear", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionClear, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnListPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnListPrototype::s_info = { "DataGridColumnListPrototype", 0, &JSDataGridColumnListPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumnList>(exec, globalObject);
+}
+
+bool JSDataGridColumnListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSDataGridColumnListPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumnList::s_info = { "DataGridColumnList", 0, &JSDataGridColumnListTable, 0 };
+
+JSDataGridColumnList::JSDataGridColumnList(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumnList> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumnList::~JSDataGridColumnList()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumnList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnListPrototype(JSDataGridColumnListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSDataGridColumnListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<DataGridColumnList*>(impl()), propertyName)) {
+        slot.setCustom(this, nameGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSDataGridColumnList, Base>(exec, &JSDataGridColumnListTable, this, propertyName, slot);
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsDataGridColumnListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsDataGridColumnListSortColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->sortColumn()));
+}
+
+JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->primaryColumn()));
+}
+
+JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumnList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getPropertyNames(exec, propertyNames);
+}
+
+JSValue JSDataGridColumnList::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnListConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    int index = args.at(0).toInt32(exec);
+    if (index < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    const UString& id = args.at(0).toString(exec);
+    const UString& label = args.at(1).toString(exec);
+    const UString& type = args.at(2).toString(exec);
+    bool primary = args.at(3).toBoolean(exec);
+    unsigned short sortable = args.at(4).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->add(id, label, type, primary, sortable)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+
+    imp->remove(column);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+    imp->move(column, index);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+
+    imp->clear();
+    return jsUndefined();
+}
+
+
+JSValue JSDataGridColumnList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, static_cast<DataGridColumnList*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumnList* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumnList>(exec, object);
+}
+DataGridColumnList* toDataGridColumnList(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumnList::s_info) ? static_cast<JSDataGridColumnList*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
new file mode 100644
index 0000000..879daf9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -0,0 +1,93 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumnList_h
+#define JSDataGridColumnList_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class JSDataGridColumnList : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumnList(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumnList>);
+    virtual ~JSDataGridColumnList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumnList* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumnList> m_impl;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+private:
+    static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumnList*);
+DataGridColumnList* toDataGridColumnList(JSC::JSValue);
+
+class JSDataGridColumnListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index fe6f6dd..a608a1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -23,6 +23,7 @@
 
 #include "HTMLDataGridColElement.h"
 #include "KURL.h"
+#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
@@ -146,14 +147,14 @@ JSValue jsHTMLDataGridColElementSortable(ExecState* exec, const Identifier&, con
 {
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->sortable());
+    return jsNumber(exec, imp->sortable());
 }
 
 JSValue jsHTMLDataGridColElementSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->sortDirection());
+    return jsNumber(exec, imp->sortDirection());
 }
 
 JSValue jsHTMLDataGridColElementPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -187,13 +188,13 @@ void setJSHTMLDataGridColElementType(ExecState* exec, JSObject* thisObject, JSVa
 void setJSHTMLDataGridColElementSortable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
-    imp->setSortable(value.toBoolean(exec));
+    imp->setSortable(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
-    imp->setSortDirection(value.toString(exec));
+    imp->setSortDirection(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index c827a4b..ea4237c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -21,7 +21,9 @@
 #include "config.h"
 #include "JSHTMLDataGridElement.h"
 
+#include "DataGridColumnList.h"
 #include "HTMLDataGridElement.h"
+#include "JSDataGridColumnList.h"
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -32,9 +34,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLDataGridElementTableValues[6] =
+static const HashTableValue JSHTMLDataGridElementTableValues[7] =
 {
     { "dataSource", DontDelete, (intptr_t)jsHTMLDataGridElementDataSource, (intptr_t)setJSHTMLDataGridElementDataSource },
+    { "columns", DontDelete|ReadOnly, (intptr_t)jsHTMLDataGridElementColumns, (intptr_t)0 },
     { "autofocus", DontDelete, (intptr_t)jsHTMLDataGridElementAutofocus, (intptr_t)setJSHTMLDataGridElementAutofocus },
     { "disabled", DontDelete, (intptr_t)jsHTMLDataGridElementDisabled, (intptr_t)setJSHTMLDataGridElementDisabled },
     { "multiple", DontDelete, (intptr_t)jsHTMLDataGridElementMultiple, (intptr_t)setJSHTMLDataGridElementMultiple },
@@ -44,9 +47,9 @@ static const HashTableValue JSHTMLDataGridElementTableValues[6] =
 
 static const HashTable JSHTMLDataGridElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 31, JSHTMLDataGridElementTableValues, 0 };
+    { 63, JSHTMLDataGridElementTableValues, 0 };
 #else
-    { 17, 15, JSHTMLDataGridElementTableValues, 0 };
+    { 18, 15, JSHTMLDataGridElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -130,6 +133,13 @@ JSValue jsHTMLDataGridElementDataSource(ExecState* exec, const Identifier&, cons
     return static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->dataSource(exec);
 }
 
+JSValue jsHTMLDataGridElementColumns(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->columns()));
+}
+
 JSValue jsHTMLDataGridElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index 302e4dd..ee6c8d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -63,6 +63,7 @@ public:
 
 JSC::JSValue jsHTMLDataGridElementDataSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLDataGridElementDataSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementColumns(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLDataGridElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLDataGridElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLDataGridElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index 8bde6be..6c53189 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -4,5 +4,5 @@ extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2004];
 extern const char wmlUserAgentStyleSheet[2956];
-extern const char mediaControlsUserAgentStyleSheet[1977];
+extern const char mediaControlsUserAgentStyleSheet[1999];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 2beb068..efc6b9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -903,7 +903,7 @@ extern const char wmlUserAgentStyleSheet[2956] = {
     32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
     97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[1977] = {
+extern const char mediaControlsUserAgentStyleSheet[1999] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -911,122 +911,123 @@ extern const char mediaControlsUserAgentStyleSheet[1977] = {
     111, 108, 115, 45, 112, 97, 110, 101, 108, 44, 32, 118, 105, 100, 101, 111,
     58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
     99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123,
-    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
-    117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32,
-    119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 104, 101, 105,
-    103, 104, 116, 58, 32, 49, 48, 48, 37, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
-    110, 111, 110, 101, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 48,
-    59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105,
-    97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32,
-    123, 32, 98, 111, 116, 116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59,
-    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
-    45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
-    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
-    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
-    100, 105, 97, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59,
-    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
-    117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32,
-    98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58,
-    32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59,
-    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125,
-    32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112,
-    108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
-    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98,
-    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105,
-    97, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112,
-    111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116,
-    101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111,
-    116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 49,
-    54, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120,
-    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32,
-    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
-    101, 114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
-    115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97,
-    105, 110, 101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114, 105, 122,
+    111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
     115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101,
     59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111,
-    108, 117, 116, 101, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48,
-    112, 120, 32, 49, 54, 112, 120, 32, 48, 112, 120, 32, 48, 112, 120, 59,
-    32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116,
-    111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 51, 50, 112,
-    120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 50, 112, 120, 59, 32,
-    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
-    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117,
-    114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108,
-    97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
-    115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100,
-    105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
-    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
-    111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109,
-    97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115,
-    112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 108, 105, 110, 101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100,
-    105, 97, 45, 115, 108, 105, 100, 101, 114, 59, 32, 112, 111, 115, 105, 116,
-    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
-    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
-    58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32,
-    114, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
-    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110,
-    103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59, 32, 125, 32, 97, 117,
+    108, 117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59,
+    32, 119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 122, 45,
+    105, 110, 100, 101, 120, 58, 32, 48, 59, 32, 111, 118, 101, 114, 102, 108,
+    111, 119, 58, 32, 104, 105, 100, 100, 101, 110, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 116, 101, 120, 116, 45, 97,
+    108, 105, 103, 110, 58, 32, 114, 105, 103, 104, 116, 59, 32, 125, 32, 118,
+    105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 117, 108,
+    108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105, 97, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123, 32, 98, 111, 116,
+    116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117,
     100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
-    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
-    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
-    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
-    101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 98, 97,
-    99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112, 111, 115, 105, 116,
-    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
-    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
-    58, 32, 48, 59, 32, 114, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120,
-    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59, 32, 104,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 109,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104,
     101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97,
     117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
-    107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97,
+    121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116,
     116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
     112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
-    116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 114,
-    105, 103, 104, 116, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32,
-    49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32,
+    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
+    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
+    109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 116,
+    105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101,
+    114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114,
+    105, 122, 111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
+    101, 114, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
+    112, 97, 99, 107, 58, 32, 101, 110, 100, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108,
+    101, 99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 104, 101, 105, 103, 104,
+    116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114, 114, 101, 110, 116,
+    45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114,
+    114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97,
+    121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110,
+    103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
+    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110,
+    101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 108,
+    105, 100, 101, 114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101,
+    101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112,
+    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101,
     98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125
+    111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
+    100, 105, 97, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119,
+    105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99,
+    114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115,
+    99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.h b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
index 48d7e9d..ac7d124 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.h
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
@@ -38,6 +38,8 @@ typedef struct objc_object* id;
 
 #if PLATFORM(QT)
 #include <QVariant>
+#include <QByteArray>
+#include <QDataStream>
 #endif
 
 namespace WebCore {
@@ -163,6 +165,9 @@ public:
 #if PLATFORM(QT)
     QVariant userData() const { return m_userData; }
     void setUserData(const QVariant& userData) { m_userData = userData; }
+
+    bool restoreState(QDataStream& buffer, int version);
+    QDataStream& saveState(QDataStream& out, int version) const;
 #endif
 
 #ifndef NDEBUG
@@ -171,8 +176,8 @@ public:
 #endif
 
     void adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts);
-    const Vector<int>& dailyVisitCounts() { return m_dailyVisitCounts; }
-    const Vector<int>& weeklyVisitCounts() { return m_weeklyVisitCounts; }
+    const Vector<int>& dailyVisitCounts() const { return m_dailyVisitCounts; }
+    const Vector<int>& weeklyVisitCounts() const { return m_weeklyVisitCounts; }
 
 private:
     HistoryItem();
@@ -188,6 +193,10 @@ private:
 
     HistoryItem* findTargetItem();
 
+    /* When adding new member variables to this class, please notify the Qt team.
+     * qt/HistoryItemQt.cpp contains code to serialize history items.
+     */
+
     String m_urlString;
     String m_originalURLString;
     String m_referrer;
diff --git a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
new file mode 100644
index 0000000..68fee87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
@@ -0,0 +1,114 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "HistoryItem.h"
+
+#include "CString.h"
+#include "FormData.h"
+
+bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
+{
+    // there is no different version right now
+    // switch  (version) {
+    WebCore::String url;
+    WebCore::String title;
+    WebCore::String altTitle;
+    WebCore::String orginalUrl;
+    WebCore::String referrer;
+    WebCore::String target;
+    WebCore::String parrent;
+    double lastVisitedTime;
+    bool validUserData;
+    WebCore::String parent;
+    bool lastVisitWasHTTPNonGet;
+    bool lastVisitWasFailure;
+    bool isTargetItem;
+    int visitCount;
+    WTF::Vector<WebCore::String> documentState;
+    WebCore::IntPoint scrollPoint;
+    WTF::Vector<int> weeklyVisitCounts;
+    WTF::Vector<int> dailyVisitCounts;
+    bool loadFormdata;
+    // WebCore::String formContentType;
+    // WTF::Vector<char> formData;
+
+    in >> url >> title >> altTitle >> lastVisitedTime >> orginalUrl >> referrer >> target >> parent;
+    in >> lastVisitWasHTTPNonGet >> lastVisitWasFailure >> isTargetItem >> visitCount >> documentState;
+    in >> scrollPoint >> dailyVisitCounts >> weeklyVisitCounts;
+    /*in >> loadFormdata;
+    if (loadFormdata) {
+        in >> formContentType >> formData;
+        // direct assigned (!)
+        m_formContentType = formContentType;
+        m_formData = FormData::create(CString(formData));
+    }*/
+    // use setters
+    adoptVisitCounts(dailyVisitCounts, weeklyVisitCounts);
+    setScrollPoint(scrollPoint);
+    setDocumentState(documentState);
+    setVisitCount(visitCount);
+    setIsTargetItem(isTargetItem);
+    setLastVisitWasFailure(lastVisitWasFailure);
+    setLastVisitWasHTTPNonGet(lastVisitWasHTTPNonGet);
+    setParent(parent);
+    setTarget(target);
+    setReferrer(referrer);
+    setOriginalURLString(orginalUrl);
+    setURLString(url);
+    setLastVisitedTime(lastVisitedTime);
+    setTitle(title);
+    setAlternateTitle(altTitle);
+
+    // at the end load userData
+    in >> validUserData;
+    if (validUserData) {
+        QVariant tmp;
+        in >> tmp;
+        setUserData(tmp);
+    }
+
+    return in.status() == QDataStream::Ok;
+}
+
+QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int /*version*/) const
+{
+    // there is no different version right now
+    // switch  (version) {
+    out << urlString() << title() << alternateTitle() << lastVisitedTime();
+    out << originalURLString() << referrer() << target() << parent();
+    out << lastVisitWasHTTPNonGet() << lastVisitWasFailure() << isTargetItem();
+    out << visitCount() << documentState() << scrollPoint();
+    out << dailyVisitCounts() << weeklyVisitCounts();
+    /*if (m_formData) {
+        out << true;
+        out << formContentType();
+        out << m_formData->flatten();
+    } else {
+        out << false;
+    }*/
+    // save user data
+    if (userData().isValid())
+        out << true << userData();
+    else
+        out << false;
+
+    return out;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
new file mode 100644
index 0000000..136c08e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataGridColumn.h"
+
+#include "DataGridColumnList.h"
+
+namespace WebCore {
+
+void DataGridColumn::setPrimary(bool primary)
+{
+    if (m_primary != primary) {
+        m_primary = primary;
+        if (m_columns)
+            m_columns->primaryColumnChanged(this);
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.h b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
new file mode 100644
index 0000000..8e63cd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DataGridColumn_h
+#define DataGridColumn_h
+
+#include "AtomicString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class DataGridColumn : public RefCounted<DataGridColumn> {
+public:
+    static PassRefPtr<DataGridColumn> create(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+    {
+        return new DataGridColumn(columns, columnID, label, type, primary, sortable);
+    }
+
+    const AtomicString& id() const { return m_id; }
+    void setId(const AtomicString& id) { m_id = id; }
+
+    const AtomicString& label() const { return m_label; }
+    void setLabel(const AtomicString& label) { m_label = label; }
+    
+    const AtomicString& type() const { return m_type; }
+    void setType(const AtomicString& type) { m_type = type; }
+    
+    unsigned short sortable() const { return m_sortable; }
+    void setSortable(unsigned short sortable) { m_sortable = sortable; }
+    
+    unsigned short sortDirection() const { return m_sortDirection; }
+    void setSortDirection(unsigned short sortDirection) { m_sortDirection = sortDirection; }
+    
+    bool primary() const { return m_primary; }
+    void setPrimary(bool);
+
+    void detachFromColumnList() { m_columns = 0; }
+
+private:
+    DataGridColumn(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+        : m_columns(columns)
+        , m_id(columnID)
+        , m_label(label)
+        , m_type(type)
+        , m_primary(primary)
+        , m_sortable(sortable)
+        , m_sortDirection(0)
+    {
+    }
+
+    DataGridColumnList* m_columns; // Not refcounted.  The columns list will null out our reference when it goes away.
+
+    AtomicString m_id;
+    AtomicString m_label;
+    AtomicString m_type;
+
+    bool m_primary;
+
+    unsigned short m_sortable;
+    unsigned short m_sortDirection;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumn_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
new file mode 100644
index 0000000..04418a1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] DataGridColumn {
+        attribute DOMString id; // The identifier for the column.
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
+
+        const unsigned short NEVER_SORTED = 0;
+        const unsigned short ALWAYS_SORTED = 1;
+        const unsigned short SOMETIMES_SORTED = 2;
+        attribute unsigned short sortable; // Whether or not the column can be sorted.
+
+        const unsigned short NATURAL_SORT = 0;
+        const unsigned short SORT_ASCENDING = 1;
+        const unsigned short SORC_DESCENDING = 2;
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+    
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
new file mode 100644
index 0000000..48f7d60
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+DataGridColumnList::~DataGridColumnList()
+{
+    clear();
+}
+
+DataGridColumn* DataGridColumnList::itemWithName(const AtomicString& name) const
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_columns[i]->id() == name)
+            return m_columns[i].get();
+    }
+    return 0;
+}
+
+DataGridColumn* DataGridColumnList::add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable)
+{
+    RefPtr<DataGridColumn> column = DataGridColumn::create(this, id, label, type, primary, sortable);
+    if (primary)
+        m_primaryColumn = column;
+    m_columns.append(column);
+    return column.get();
+}
+
+void DataGridColumnList::remove(DataGridColumn* col)
+{
+    size_t index = m_columns.find(col);
+    if (index == notFound)
+        return;
+    m_columns.remove(index);
+    if (col == m_primaryColumn)
+        m_primaryColumn = 0;
+    if (col == m_sortColumn)
+        m_sortColumn = 0;
+}
+
+void DataGridColumnList::move(DataGridColumn* col, unsigned long index)
+{
+    size_t colIndex = m_columns.find(col);
+    if (colIndex == notFound)
+        return;
+    m_columns.insert(index, col);
+}
+
+void DataGridColumnList::clear()
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i)
+        m_columns[i]->detachFromColumnList();
+    m_columns.clear();
+    m_primaryColumn = 0;
+    m_sortColumn = 0;
+}
+
+void DataGridColumnList::primaryColumnChanged(DataGridColumn* col)
+{
+    if (col->primary())
+        m_primaryColumn = col;
+    else if (m_primaryColumn = col)
+        m_primaryColumn = 0;
+    
+    // FIXME: Invalidate the tree.
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
new file mode 100644
index 0000000..d0caebe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
@@ -0,0 +1,48 @@
+#ifndef DataGridColumnList_h
+#define DataGridColumnList_h
+
+#include "DataGridColumn.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicString;
+
+class DataGridColumnList : public RefCounted<DataGridColumnList> {
+    friend class DataGridColumn;
+public:
+    static PassRefPtr<DataGridColumnList> create()
+    {
+        return new DataGridColumnList();
+    }
+
+    ~DataGridColumnList();
+
+    unsigned length() const { return m_columns.size(); }
+
+    DataGridColumn* item(unsigned index) const { return m_columns[index].get(); }
+    DataGridColumn* itemWithName(const AtomicString&) const;
+
+    DataGridColumn* primaryColumn() const { return m_primaryColumn.get(); }
+
+    DataGridColumn* sortColumn() const { return m_sortColumn.get(); }
+
+    DataGridColumn* add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable);
+    void remove(DataGridColumn*);
+    void move(DataGridColumn*, unsigned long index);
+    void clear();
+
+private:
+    void primaryColumnChanged(DataGridColumn* col);
+
+    Vector<RefPtr<DataGridColumn> > m_columns;
+    RefPtr<DataGridColumn> m_primaryColumn;
+    RefPtr<DataGridColumn> m_sortColumn;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumnList_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
new file mode 100644
index 0000000..cab4339
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter,
+        HasNameGetter
+    ] DataGridColumnList {
+        DataGridColumn item(in [IsIndex] unsigned long index);
+        readonly attribute unsigned long length;
+
+        readonly attribute DataGridColumn sortColumn;
+        readonly attribute DataGridColumn primaryColumn;
+
+        DataGridColumn add(in DOMString id, in DOMString label, in DOMString type, in boolean primary, in unsigned short sortable);
+        void remove(in DataGridColumn column);
+        void move(in DataGridColumn column, in unsigned long index);
+        void clear();
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
index 64a9d10..d06ad82 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
@@ -88,5 +88,4 @@ void HTMLDataGridCellElement::setProgress(float progress)
     setAttribute(progressAttr, String::number(progress));
 }
 
-}
-
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
index b17634b..9de6e40 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridCellElement : public HTMLElement
-{
+class HTMLDataGridCellElement : public HTMLElement {
 public:
     HTMLDataGridCellElement(const QualifiedName&, Document*);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
index 32d820c..4d15f6f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
@@ -25,15 +25,17 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridCellElement : HTMLElement {
-    attribute DOMString label; // The text to display in the column, assuming the type supports text.
-    
-    attribute boolean focused; // Whether or not this cell is currently focused.
-    
-    attribute boolean checked; // The checked state of the column, assuming the type of the column is checkbox.
-    attribute boolean indeterminate; // If the checked state is indeterminate.
-    
-    attribute float progress; // For progress cells, a value from 0-1.0 indicating the state of progress.
-};
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridCellElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column, assuming the type supports text.
+
+        attribute boolean focused; // Whether or not this cell is currently focused.
+
+        attribute boolean checked; // The checked state of the column, assuming the type of the column is checkbox.
+        attribute boolean indeterminate; // If the checked state is indeterminate.
+
+        attribute float progress; // For progress cells, a value from 0-1.0 indicating the state of progress.
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
index b5c8714..b209447 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
@@ -58,24 +58,35 @@ void HTMLDataGridColElement::setType(const String& type)
     setAttribute(typeAttr, type);
 }
 
-bool HTMLDataGridColElement::sortable() const
+unsigned short HTMLDataGridColElement::sortable() const
 {
     return hasAttribute(sortableAttr);
 }
 
-void HTMLDataGridColElement::setSortable(bool sortable)
+void HTMLDataGridColElement::setSortable(unsigned short sortable)
 {
     setAttribute(sortableAttr, sortable ? "" : 0);
 }
 
-String HTMLDataGridColElement::sortDirection() const
+unsigned short HTMLDataGridColElement::sortDirection() const
 {
-    return getAttribute(sortdirectionAttr);
+    String sortDirection = getAttribute(sortdirectionAttr);
+    if (equalIgnoringCase(sortDirection, "ascending"))
+        return 1;
+    if (equalIgnoringCase(sortDirection, "descending"))
+        return 2;
+    return 0;
 }
 
-void HTMLDataGridColElement::setSortDirection(const String& sortDirection)
+void HTMLDataGridColElement::setSortDirection(unsigned short sortDirection)
 {
-    setAttribute(sortdirectionAttr, sortDirection);
+    // FIXME: Check sortable rules.
+    if (sortDirection == 0)
+        setAttribute(sortdirectionAttr, "natural");
+    else if (sortDirection == 1)
+        setAttribute(sortdirectionAttr, "ascending");
+    else if (sortDirection == 2)
+        setAttribute(sortdirectionAttr, "descending");
 }
 
 bool HTMLDataGridColElement::primary() const
@@ -88,5 +99,4 @@ void HTMLDataGridColElement::setPrimary(bool primary)
     setAttribute(primaryAttr, primary ? "" : 0);
 }
 
-}
-
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
index 6d599b1..87133cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridColElement : public HTMLElement
-{
+class HTMLDataGridColElement : public HTMLElement {
 public:
     HTMLDataGridColElement(const QualifiedName&, Document*);
 
@@ -44,16 +43,16 @@ public:
     String type() const;
     void setType(const String&);
     
-    bool sortable() const;
-    void setSortable(bool);
+    unsigned short sortable() const;
+    void setSortable(unsigned short);
     
-    String sortDirection() const;
-    void setSortDirection(const String&);
+    unsigned short sortDirection() const;
+    void setSortDirection(unsigned short);
     
     bool primary() const;
     void setPrimary(bool);
 };
 
-} //namespace
+} // namespace WebCore
 
-#endif
+#endif // HTMLDataGridColElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
index 59c3be0..c72751c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
@@ -25,14 +25,16 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridColElement : HTMLElement {
-    attribute DOMString label; // The text to display in the column.
-    attribute DOMString type; // The type of data displayed in this column.
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridColElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
 
-    attribute boolean sortable; // Whether or not the column can be sorted.
-    attribute DOMString sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+        attribute unsigned short sortable; // Whether or not the column can be sorted.  Values are none, ascending/descending, and ascending/descending/na
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
     
-    attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
-};
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
index a9e2f3d..2d9f852 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
@@ -38,6 +38,7 @@ HTMLDataGridElement::HTMLDataGridElement(const QualifiedName& tagName, Document*
     : HTMLElement(tagName, document)
     , m_initializationTimer(this, &HTMLDataGridElement::initializationTimerFired)
 {
+    m_columns = DataGridColumnList::create();
 }
 
 HTMLDataGridElement::~HTMLDataGridElement()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
index 2dad4d0..646c97e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
@@ -26,6 +26,7 @@
 #ifndef HTMLDataGridElement_h
 #define HTMLDataGridElement_h
 
+#include "DataGridColumnList.h"
 #include "DataGridDataSource.h"
 #include "HTMLElement.h"
 #include "Timer.h"
@@ -39,26 +40,30 @@ public:
 
     virtual int tagPriority() const { return 6; } // Same as <select>s
     virtual bool checkDTD(const Node*);
-    
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     bool autofocus() const;
     void setAutofocus(bool);
-    
+
     bool disabled() const;
     void setDisabled(bool);
-    
+
     bool multiple() const;
     void setMultiple(bool);
 
     void setDataSource(PassRefPtr<DataGridDataSource>);
     DataGridDataSource* dataSource() const { return m_dataSource.get(); }
 
+    DataGridColumnList* columns() const { return m_columns.get(); }
+
 private:
     void initializationTimerFired(Timer<HTMLDataGridElement>*);
 
     Timer<HTMLDataGridElement> m_initializationTimer;
     RefPtr<DataGridDataSource> m_dataSource;
+
+    RefPtr<DataGridColumnList> m_columns;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
index f777a9c..b4b0897 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
@@ -30,6 +30,8 @@ module html {
     ] HTMLDataGridElement : HTMLElement {
         attribute [Custom] DataGridDataSource dataSource;
 
+        readonly attribute DataGridColumnList columns;
+
         attribute boolean autofocus; // Whether or not the datagrid should autofocus.
         attribute boolean disabled; // Whether or not the datagrid can be interacted with.
         attribute boolean multiple; // Whether or not the datagrid supports multiple selection.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
index 87fb31d..e671806 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
@@ -75,4 +75,4 @@ void HTMLDataGridRowElement::setExpanded(bool expanded)
     setAttribute(expandedAttr, expanded ? "" : 0);
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
index 9774baa..d911db2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridRowElement : public HTMLElement
-{
+class HTMLDataGridRowElement : public HTMLElement {
 public:
     HTMLDataGridRowElement(const QualifiedName&, Document*);
 
@@ -51,4 +50,3 @@ public:
 } // namespace WebCore
 
 #endif // HTMLDataGridRowElement_h
-
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
index 825bec6..4aeb4d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
@@ -25,11 +25,13 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridRowElement : HTMLElement {
-    attribute boolean selected; // Whether or not the row is currently selected.
-    attribute boolean focused; // Whether or not the row is the current object in the tree for keyboard navigation (or as the principal item of a multiple selection).
-    
-    attribute boolean expanded; // Whether or not the row is open (if it is, child rows will be shown).
-};
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridRowElement : HTMLElement {
+        attribute boolean selected; // Whether or not the row is currently selected.
+        attribute boolean focused; // Whether or not the row is the current object in the tree for keyboard navigation (or as the principal item of a multiple selection).
+        
+        attribute boolean expanded; // Whether or not the row is open (if it is, child rows will be shown).
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 76a9703..cb8f36c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -225,11 +225,11 @@ void HTMLLinkElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
 
+    document()->removeStyleSheetCandidateNode(this);
+
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
-    if (document()->renderer()) {
-        document()->removeStyleSheetCandidateNode(this);
+    if (document()->renderer())
         document()->updateStyleSelector();
-    }
 }
 
 void HTMLLinkElement::finishParsingChildren()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 9789a82..3d48b82 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -1610,8 +1610,7 @@ bool HTMLMediaElement::processingUserGesture() const
 void HTMLMediaElement::deliverNotification(MediaPlayerProxyNotificationType notification)
 {
     if (notification == MediaPlayerNotificationPlayPauseButtonPressed) {
-        ExceptionCode ec;
-        togglePlayState(ec);
+        togglePlayState();
         return;
     }
 
@@ -1630,7 +1629,7 @@ String HTMLMediaElement::initialURL()
     KURL initialSrc = document()->completeURL(getAttribute(srcAttr));
     
     if (!initialSrc.isValid())
-        initialSrc = selectNextSourceChild(0, DoNothing).string();
+        initialSrc = selectNextSourceChild(0, DoNothing);
 
     m_currentSrc = initialSrc.string();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
index 95038e6..c47bb70 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
@@ -80,9 +80,14 @@ void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
     SelectElement::deselectItems(m_data, this, excludeElement);
 }
 
-void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect, bool fireOnChange)
+void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect)
 {
-    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChange);
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, false, false);
+}
+
+void HTMLSelectElement::setSelectedIndexByUser(int optionIndex, bool deselect, bool fireOnChangeNow)
+{
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChangeNow, true);
 }
 
 int HTMLSelectElement::activeSelectionStartListIndex() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
index b00d68f..e523641 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
@@ -39,7 +39,8 @@ public:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual int selectedIndex() const;
-    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
+    virtual void setSelectedIndex(int index, bool deselect = true);
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false);
 
     unsigned length() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
index f6b5924..206aec4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
@@ -71,8 +71,7 @@ void HTMLStyleElement::insertedIntoDocument()
 void HTMLStyleElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
     StyleElement::removedFromDocument(document());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index d4d6df7..13404cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -56,9 +56,16 @@ HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeT
 
 Tokenizer* HTMLViewSourceDocument::createTokenizer()
 {
-    if (implementation()->isTextMIMEType(m_type))
-        return createTextTokenizer(this);
-    return new HTMLTokenizer(this);
+    // Use HTMLTokenizer if applicable, otherwise use TextTokenizer.
+    if (m_type == "text/html" || m_type == "application/xhtml+xml" || m_type == "image/svg+xml" || implementation()->isXMLMIMEType(m_type)
+#if ENABLE(XHTMLMP)
+        || m_type == "application/vnd.wap.xhtml+xml"
+#endif
+        ) {
+        return new HTMLTokenizer(this);
+    }
+
+    return createTextTokenizer(this);
 }
 
 void HTMLViewSourceDocument::createContainingTable()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
index 4e725c7..57a8f21 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
@@ -38,9 +38,10 @@ public:
     {
         return new HTMLViewSourceDocument(frame, mimeType);
     }
-    
+
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
     virtual Tokenizer* createTokenizer();
-    
+
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index f85b731..429c2c3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -157,7 +157,7 @@ WebInspector.DatabaseQueryView.prototype = {
         else if (error.code == 2)
             var message = WebInspector.UIString("Database no longer has expected version.");
         else
-            var message = WebInspector.UIString("An unexpected error %s occured.", error.code);
+            var message = WebInspector.UIString("An unexpected error %s occurred.", error.code);
 
         this._appendQueryResult(query, message, "error");
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index d00733c..bc78fc8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -166,8 +166,8 @@ WebInspector.ProfileView.prototype = {
         for (var index = 0; index < count; ++index)
             this.dataGrid.appendChild(children[index]);
 
-        if (selectedProfileNode && selectedProfileNode._dataGridNode)
-            selectedProfileNode._dataGridNode.selected = true;
+        if (selectedProfileNode)
+            selectedProfileNode.selected = true;
     },
 
     refreshVisibleData: function()
@@ -196,8 +196,7 @@ WebInspector.ProfileView.prototype = {
                 delete profileNode._searchMatchedCallsColumn;
                 delete profileNode._searchMatchedFunctionColumn;
 
-                if (profileNode._dataGridNode)
-                    profileNode._dataGridNode.refresh();
+                profileNode.refresh();
             }
         }
 
@@ -313,7 +312,7 @@ WebInspector.ProfileView.prototype = {
                 profileDataGridNode._searchMatchedTotalColumn ||
                 profileDataGridNode._searchMatchedAverageColumn ||
                 profileDataGridNode._searchMatchedCallsColumn ||
-                profileDataGridNode._searchMatchedFunctionColumn);
+                profileDataGridNode._searchMatchedFunctionColumn)
             {
                 profileDataGridNode.refresh();
                 return true;
@@ -322,48 +321,14 @@ WebInspector.ProfileView.prototype = {
             return false;
         }
 
-        var current = this.dataGrid;
-        var ancestors = [];
-        var nextIndexes = [];
-        var startIndex = 0;
+        var current = this.profileDataGridTree.children[0];
 
         while (current) {
-            var children = current.children;
-            var childrenLength = children.length;
-
-            if (startIndex >= childrenLength) {
-                current = ancestors.pop();
-                startIndex = nextIndexes.pop();
-                continue;
+            if (matchesQuery(current)) {
+                this._searchResults.push({ profileNode: current });
             }
 
-            for (var i = startIndex; i < childrenLength; ++i) {
-                var child = children[i];
-
-                if (matchesQuery(child)) {
-                    if (child._dataGridNode) {
-                        // The child has a data grid node already, no need to remember the ancestors.
-                        this._searchResults.push({ profileNode: child });
-                    } else {
-                        var ancestorsCopy = [].concat(ancestors);
-                        ancestorsCopy.push(current);
-                        this._searchResults.push({ profileNode: child, ancestors: ancestorsCopy });
-                    }
-                }
-
-                if (child.children.length) {
-                    ancestors.push(current);
-                    nextIndexes.push(i + 1);
-                    current = child;
-                    startIndex = 0;
-                    break;
-                }
-
-                if (i === (childrenLength - 1)) {
-                    current = ancestors.pop();
-                    startIndex = nextIndexes.pop();
-                }
-            }
+            current = current.traverseNextNode(false, null, false);
         }
 
         finishedCallback(this, this._searchResults.length);
@@ -419,26 +384,9 @@ WebInspector.ProfileView.prototype = {
         if (!searchResult)
             return;
 
-        var profileNode = this._searchResults[index].profileNode;
-        if (!profileNode._dataGridNode && searchResult.ancestors) {
-            var ancestors = searchResult.ancestors;
-            for (var i = 0; i < ancestors.length; ++i) {
-                var ancestorProfileNode = ancestors[i];
-                var gridNode = ancestorProfileNode._dataGridNode;
-                if (gridNode)
-                    gridNode.expand();
-            }
-
-            // No need to keep the ancestors around.
-            delete searchResult.ancestors;
-        }
-
-        gridNode = profileNode._dataGridNode;
-        if (!gridNode)
-            return;
-
-        gridNode.reveal();
-        gridNode.select();
+        var profileNode = searchResult.profileNode;
+        profileNode.reveal();
+        profileNode.select();
     },
 
     _changeView: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
index 46502a6..e6413a9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
@@ -31,6 +31,19 @@ WebInspector.Script = function(sourceID, sourceURL, source, startingLine, errorL
     this.startingLine = startingLine;
     this.errorLine = errorLine;
     this.errorMessage = errorMessage;
+
+    // if no URL, look for "//@ sourceURL=" decorator
+    // note that this sourceURL comment decorator is behavior that FireBug added
+    // in it's 1.1 release as noted in the release notes:
+    // http://fbug.googlecode.com/svn/branches/firebug1.1/docs/ReleaseNotes_1.1.txt
+    if (!sourceURL) {
+        // use of [ \t] rather than \s is to prevent \n from matching
+        var pattern = /^\s*\/\/[ \t]*@[ \t]*sourceURL[ \t]*=[ \t]*(\S+).*$/m;
+        var match = pattern.exec(source);
+
+        if (match)
+            this.sourceURL = WebInspector.UIString("(program): %s", match[1]);
+    }
 }
 
 WebInspector.Script.prototype = {
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 81ebf1f..e1a92d5 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -283,6 +283,11 @@ public:
 
     virtual void registerForIconNotification(bool) { }
 
+#if USE(V8)
+    virtual void didCreateScriptContext() { }
+    virtual void didDestroyScriptContext() { }
+#endif
+
 #if PLATFORM(MAC)
     virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long, NSCachedURLResponse* response) const { return response; }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index b862002..8c050f0 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -211,7 +211,12 @@ namespace WebCore {
         virtual void windowObjectCleared() = 0;
         virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
-        
+
+#if USE(V8)
+        virtual void didCreateScriptContext() = 0;
+        virtual void didDestroyScriptContext() = 0;
+#endif
+
         virtual void registerForIconNotification(bool listen = true) = 0;
         
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 6ba8f7b..006f3b5 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -451,6 +451,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
             m_currentHandle->cancel();
             m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
             // Load the next resource, if any.
             startLoadingEntry();
             return;
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index e412939..329c3a7 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -856,6 +856,21 @@ bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity g
     return false;
 }
 
+bool EventHandler::scrollRecursively(ScrollDirection direction, ScrollGranularity granularity)
+{
+    bool handled = scrollOverflow(direction, granularity);
+    if (!handled) {
+        Frame* frame = m_frame;
+        do {
+            FrameView* view = frame->view();
+            handled = view ? view->scroll(direction, granularity) : false;
+            frame = frame->tree()->parent();
+        } while (!handled && frame);
+     }
+
+    return handled;
+}
+
 IntPoint EventHandler::currentMousePosition() const
 {
     return m_currentMousePosition;
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 06ed956..583122c 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -109,6 +109,8 @@ public:
 
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
+    bool scrollRecursively(ScrollDirection, ScrollGranularity);
+
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
 
     bool tabsToLinks(KeyboardEvent*) const;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 9ce3c82..41f2c5c 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -420,6 +420,11 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
 void FrameView::updateCompositingLayers(CompositingUpdate updateType)
 {
     RenderView* view = m_frame->contentRenderer();
+    if (view && view->compositor()) {
+        // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
+        view->compositor()->cacheAcceleratedCompositingEnabledFlag();
+    }
+    
     if (!view || !view->usesCompositing())
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 3a00b8e..a476099 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -28,6 +28,7 @@
 
 #include "Frame.h"
 #include "FrameTree.h"
+#include "FrameView.h"
 #include "HistoryItem.h"
 #include "Page.h"
 #include "PageCache.h"
@@ -37,7 +38,7 @@ using namespace std;
 
 namespace WebCore {
 
-static void setNeedsReapplyStylesInAllFrames(Page* page)
+static void setNeedsReapplyStylesInAllFrames(Page* page, bool /*updateCompositingLayers*/ = false)
 {
     for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
         frame->setNeedsReapplyStyles();
@@ -104,6 +105,11 @@ Settings::Settings(Page* page)
     // they can't use by. Leaving enabled for now to not change existing behavior.
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_acceleratedCompositingEnabled(true)
+#else
+    , m_acceleratedCompositingEnabled(false)
+#endif
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -464,4 +470,13 @@ void Settings::setXSSAuditorEnabled(bool xssAuditorEnabled)
     m_xssAuditorEnabled = xssAuditorEnabled;
 }
 
+void Settings::setAcceleratedCompositingEnabled(bool enabled)
+{
+    if (m_acceleratedCompositingEnabled == enabled)
+        return;
+        
+    m_acceleratedCompositingEnabled = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page, true);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 9d4e422..4b9b40a 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -241,6 +241,9 @@ namespace WebCore {
         void setXSSAuditorEnabled(bool);
         bool xssAuditorEnabled() const { return m_xssAuditorEnabled; }
 
+        void setAcceleratedCompositingEnabled(bool);
+        bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
+
     private:
         Page* m_page;
         
@@ -301,6 +304,7 @@ namespace WebCore {
         unsigned m_editingBehavior : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
+        bool m_acceleratedCompositingEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
index 310af59..1cae191 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
@@ -29,10 +29,15 @@
 #include "IntSize.h"
 #include <wtf/Platform.h>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 #if PLATFORM(CG)
 typedef struct CGPoint CGPoint;
 #endif
 
+
 #if PLATFORM(MAC)
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGPoint NSPoint;
@@ -169,6 +174,23 @@ inline bool operator!=(const IntPoint& a, const IntPoint& b)
     return a.x() != b.x() || a.y() != b.y();
 }
 
+#if PLATFORM(QT)
+inline QDataStream& operator<<(QDataStream& stream, const IntPoint& point)
+{
+    stream << point.x() << point.y();
+    return stream;
+}
+
+inline QDataStream& operator>>(QDataStream& stream, IntPoint& point)
+{
+    int x, y;
+    stream >> x >> y;
+    point.setX(x);
+    point.setY(y);
+    return stream;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // IntPoint_h
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
index db6ecb6..9bdd276 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
@@ -41,6 +41,7 @@ class NSPasteboard;
 namespace WebCore {
 
 class Frame;
+class FileList;
 
 class ClipboardMac : public Clipboard, public CachedResourceClient {
 public:
@@ -60,6 +61,7 @@ public:
     
     // extensions beyond IE's API
     virtual HashSet<String> types() const;
+    virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
     void setDragImageElement(Node *, const IntPoint&);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index d1b66a7..52bc952 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -31,6 +31,7 @@
 #import "DragController.h"
 #import "Editor.h"
 #import "FoundationExtras.h"
+#import "FileList.h"
 #import "Frame.h"
 #import "Image.h"
 #import "Page.h"
@@ -139,7 +140,7 @@ void ClipboardMac::clearAllData()
     [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
 }
 
-static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL)
+static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL = false)
 {
     NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
 
@@ -163,7 +164,7 @@ static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bo
     return urls;
 }
 
-static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL)
+static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL = false)
 {
     // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
     // or CoreFoundation will printf when there is not data of the corresponding type.
@@ -274,6 +275,26 @@ HashSet<String> ClipboardMac::types() const
     return result;
 }
 
+// FIXME: We could cache the computed fileList if necessary
+// Currently each access gets a new copy, setData() modifications to the
+// clipboard are not reflected in any FileList objects the page has accessed and stored
+PassRefPtr<FileList> ClipboardMac::files() const
+{
+    if (policy() != ClipboardReadable)
+        return FileList::create();
+
+    NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get());
+    NSUInteger count = [absoluteURLs count];
+
+    RefPtr<FileList> fileList = FileList::create();
+    for (NSUInteger x = 0; x < count; x++) {
+        NSURL *absoluteURL = [NSURL URLWithString:[absoluteURLs objectAtIndex:x]];
+        ASSERT([absoluteURL isFileURL]);
+        fileList->append(File::create([absoluteURL path]));
+    }
+    return fileList.release(); // We will always return a FileList, sometimes empty
+}
+
 // The rest of these getters don't really have any impact on security, so for now make no checks
 
 void ClipboardMac::setDragImage(CachedImage* img, const IntPoint &loc)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 9c49594..fddda01 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -32,16 +32,19 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "Element.h"
+#include "FileList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
 #include "Image.h"
 #include "IntPoint.h"
 #include "KURL.h"
 #include "markup.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
 #include "StringHash.h"
+
 #include <QList>
 #include <QMimeData>
 #include <QStringList>
@@ -178,6 +181,12 @@ HashSet<String> ClipboardQt::types() const
     return result;
 }
 
+PassRefPtr<FileList> ClipboardQt::files() const
+{
+    notImplemented();
+    return 0;
+}
+
 void ClipboardQt::setDragImage(CachedImage* image, const IntPoint& point) 
 {
     setDragImage(image, 0, point);
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
index caf040f..44324f2 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
@@ -56,8 +56,9 @@ namespace WebCore {
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        HashSet<String> types() const;
-    
+        virtual HashSet<String> types() const;
+        virtual PassRefPtr<FileList> files() const;
+
         void setDragImage(CachedImage*, const IntPoint&);
         void setDragImageElement(Node*, const IntPoint&);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 88cca5a..955da9b 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -511,6 +511,15 @@ void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool)
         m_text = String();
         m_unmodifiedText = String();
     } else {
+        /*
+            When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+            empty. If we're asked to disambiguate the event into a Char keyboard event,
+            we try to detect this situation and still set the text, to ensure that the
+            general event handling sends a key press event after this disambiguation.
+        */
+        if (m_text.isEmpty() && m_windowsVirtualKeyCode && m_qtEvent->key() < Qt::Key_Escape)
+            m_text.append(UChar(m_windowsVirtualKeyCode));
+
         m_keyIdentifier = String();
         m_windowsVirtualKeyCode = 0;
     }
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index 659dde2..ee2c8ce 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -49,6 +49,7 @@ typedef const struct __CFString * CFStringRef;
 QT_BEGIN_NAMESPACE
 class QString;
 QT_END_NAMESPACE
+#include <QDataStream>
 #endif
 
 #if PLATFORM(WX)
@@ -248,6 +249,11 @@ private:
     RefPtr<StringImpl> m_impl;
 };
 
+#if PLATFORM(QT)
+QDataStream& operator<<(QDataStream& stream, const String& str);
+QDataStream& operator>>(QDataStream& stream, String& str);
+#endif
+
 String operator+(const String&, const String&);
 String operator+(const String&, const char*);
 String operator+(const char*, const String&);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
index de9f527..97bbf40 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
@@ -51,6 +51,22 @@ String::operator QString() const
     return QString(reinterpret_cast<const QChar*>(characters()), length());
 }
 
+QDataStream& operator<<(QDataStream& stream, const String& str)
+{
+    // could be faster
+    stream << QString(str);
+    return stream;
+}
+
+QDataStream& operator>>(QDataStream& stream, String& str)
+{
+    // mabe not the fastest way, but really easy
+    QString tmp;
+    stream >> tmp;
+    str = tmp;
+    return stream;
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index e477965..67c34eb 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -110,11 +110,6 @@ static BYTE* endPaint;
 
 HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return 0;
-#else     
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so set up the PAINTSTRUCT so
@@ -130,16 +125,10 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    beginPaint
-#endif
 }
 
 BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return FALSE;
-#else      
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so we don't have to do any
@@ -152,10 +141,8 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    endPaint
-#endif      
 }
 
-#if (!COMPILER(MINGW))
 static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE*& pProc, const void* pNewProc)
 {
     // See <http://www.fengyuan.com/article/wmprint.html> for an explanation of
@@ -196,7 +183,6 @@ static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAIN
     hook("user32.dll", "BeginPaint", beginPaintSysCall, beginPaint, hookedBeginPaint);
     hook("user32.dll", "EndPaint", endPaintSysCall, endPaint, hookedEndPaint);
 }
-#endif
 
 static bool registerPluginView()
 {
@@ -940,9 +926,8 @@ void PluginView::init()
 
     if (m_isWindowed) {
         registerPluginView();
-#if (!COMPILER(MINGW))       
         setUpOffscreenPaintingHooks(hookedBeginPaint, hookedEndPaint);
-#endif
+
         DWORD flags = WS_CHILD;
         if (isSelfVisible())
             flags |= WS_VISIBLE;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
index 32e67a4..b207a31 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
@@ -82,12 +82,24 @@ void RenderDataGrid::paintObject(PaintInfo& paintInfo, int tx, int ty)
     if (style()->visibility() != VISIBLE)
         return;
 
-    // FIXME: Column and cell foregrounds will paint here.
-    
     // Paint our background and border.
     RenderBlock::paintObject(paintInfo, tx, ty);
     
-    // FIXME: Row, cell and column backgrounds will paint here.
+    if (paintInfo.phase != PaintPhaseForeground)
+        return;
+
+    // Paint our column headers first.
+    paintColumnHeaders(paintInfo, tx, ty);
+}
+
+void RenderDataGrid::paintColumnHeaders(PaintInfo&, int, int)
+{
+    gridElement()->columns();
+    
+}
+
+void RenderDataGrid::rebuildColumns()
+{
 }
 
 // Scrolling implementation functions
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
index a6566d7..6a4b32e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
@@ -26,8 +26,12 @@
 #ifndef RenderDataGrid_h
 #define RenderDataGrid_h
 
+#include "HTMLDataGridElement.h"
 #include "RenderBlock.h"
 #include "ScrollbarClient.h"
+#include "StyleImage.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -44,7 +48,14 @@ public:
     
     virtual void paintObject(PaintInfo&, int tx, int ty);
 
+    void columnsChanged();
+
 private:
+    void paintColumnHeaders(PaintInfo&, int tx, int ty);
+    void rebuildColumns();
+
+    HTMLDataGridElement* gridElement() const { return static_cast<HTMLDataGridElement*>(node()); }
+
     // ScrollbarClient interface.
     virtual void valueChanged(Scrollbar*);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 56ad490..cd84a09 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -452,11 +452,9 @@ bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         int tx = _tx + x();
         int ty = _ty + y();
         
-        HTMLMapElement* map = imageMap();
-        if (map) {
-            // we're a client side image map
-            inside = map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult);
-            tempResult.setInnerNonSharedNode(node());
+        if (HTMLMapElement* map = imageMap()) {
+            if (map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult))
+                tempResult.setInnerNonSharedNode(node());
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 94ca6c7..620d03d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -238,6 +238,15 @@ void RenderLayer::rendererContentChanged()
 }
 #endif // USE(ACCELERATED_COMPOSITING)
 
+bool RenderLayer::hasAcceleratedCompositing() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return compositor()->hasAcceleratedCompositing();
+#else
+    return false;
+#endif
+}
+
 void RenderLayer::setStaticY(int staticY)
 {
     if (m_staticY == staticY)
@@ -339,7 +348,7 @@ void RenderLayer::updateTransform()
         ASSERT(box);
         m_transform->makeIdentity();
         box->style()->applyTransform(*m_transform, box->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
-        makeMatrixRenderable(*m_transform);
+        makeMatrixRenderable(*m_transform, hasAcceleratedCompositing());
     }
 
     if (had3DTransform != has3DTransform())
@@ -356,7 +365,7 @@ TransformationMatrix RenderLayer::currentTransform() const
         TransformationMatrix currTransform;
         RefPtr<RenderStyle> style = renderer()->animation()->getAnimatedStyleForRenderer(renderer());
         style->applyTransform(currTransform, renderBox()->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
-        makeMatrixRenderable(currTransform);
+        makeMatrixRenderable(currTransform, hasAcceleratedCompositing());
         return currTransform;
     }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index 2bbb433..4feede8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -289,6 +289,9 @@ public:
     // Allows updates of layer content without repainting.
     void rendererContentChanged();
 #endif
+
+    // Returns true if the accelerated compositing is enabled
+    bool hasAcceleratedCompositing() const;
     
     void updateLayerPosition();
     void updateLayerPositions(bool doFullRepaint = false, bool checkForRepaint = true);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index a1da7ce..dd5fafd 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -120,7 +120,7 @@ void RenderLayerBacking::updateLayerTransform()
     TransformationMatrix t;
     if (m_owningLayer->hasTransform()) {
         style->applyTransform(t, toRenderBox(renderer())->borderBoxRect().size(), RenderStyle::ExcludeTransformOrigin);
-        makeMatrixRenderable(t);
+        makeMatrixRenderable(t, compositor()->hasAcceleratedCompositing());
     }
     
     m_graphicsLayer->setTransform(t);
@@ -698,27 +698,47 @@ bool RenderLayerBacking::paintingGoesToWindow() const
 
 void RenderLayerBacking::setContentsNeedDisplay()
 {
-    if (m_graphicsLayer)
+    bool needViewUpdate = false;
+
+    if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
         m_graphicsLayer->setNeedsDisplay();
-    if (m_contentsLayer)
+        needViewUpdate = true;
+    }
+    
+    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
         m_contentsLayer->setNeedsDisplay();
+        needViewUpdate = true;
+    }
+    
+    // Make sure layout happens before we get rendered again.
+    if (needViewUpdate)
+        compositor()->scheduleViewUpdate();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
-    if (m_graphicsLayer) {
+    bool needViewUpdate = false;
+
+    if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
         FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
-        if (bounds.intersects(dirtyRect))
+        if (bounds.intersects(dirtyRect)) {
             m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
+            needViewUpdate = true;
+        }
     }
 
-    if (m_contentsLayer) {
+    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
         // FIXME: do incremental repaint
         m_contentsLayer->setNeedsDisplay();
+        needViewUpdate = true;
     }
+
+    // Make sure layout happens before we get rendered again.
+    if (needViewUpdate)
+        compositor()->scheduleViewUpdate();
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index d06629b..8b720a1 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -40,6 +40,7 @@
 #include "RenderLayerBacking.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 #if PROFILE_LAYER_REBUILD
 #include <wtf/CurrentTime.h>
@@ -87,6 +88,7 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_compositing(false)
     , m_rootLayerAttached(false)
     , m_compositingLayersNeedUpdate(false)
+    , m_hasAcceleratedCompositing(true)
 #if PROFILE_LAYER_REBUILD
     , m_rootLayerUpdateCount(0)
 #endif // PROFILE_LAYER_REBUILD
@@ -109,9 +111,23 @@ void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
         // the empty root layer, which has minimal overhead.
         if (m_compositing)
             ensureRootPlatformLayer();
+        else
+            destroyRootPlatformLayer();
     }
 }
 
+void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
+{
+    bool hasAcceleratedCompositing = false;
+    if (Settings* settings = m_renderView->document()->settings())
+        hasAcceleratedCompositing = settings-> acceleratedCompositingEnabled();
+
+    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing)
+        setCompositingLayersNeedUpdate();
+        
+    m_hasAcceleratedCompositing = hasAcceleratedCompositing;
+}
+
 void RenderLayerCompositor::setCompositingLayersNeedUpdate(bool needUpdate)
 {
     if (inCompositingMode()) {
@@ -173,6 +189,9 @@ void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
                     m_rootLayerUpdateCount, 1000.0 * (endTime - startTime));
 #endif
     ASSERT(updateRoot || !m_compositingLayersNeedUpdate);
+
+    if (!hasAcceleratedCompositing())
+        enableCompositingMode(false);
 }
 
 bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeRepaint shouldRepaint)
@@ -485,7 +504,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasMask() || o->hasReflection())
+    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
@@ -514,7 +533,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
 
     // host the document layer in the RenderView's root layer
-    if (layer->isRootLayer())
+    if (layer->isRootLayer() && layer->isComposited())
         parentInRootLayer(layer);
 
     CompositingState childState = ioCompState;
@@ -711,7 +730,7 @@ bool RenderLayerCompositor::has3DContent() const
 
 bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 {
-    return requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers();
+    return m_hasAcceleratedCompositing && (requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers());
 }
 
 #define VERBOSE_COMPOSITINGLAYER    0
@@ -869,6 +888,16 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     didMoveOnscreen();
 }
 
+void RenderLayerCompositor::destroyRootPlatformLayer()
+{
+    if (!m_rootPlatformLayer)
+        return;
+
+    willMoveOffscreen();
+    delete m_rootPlatformLayer;
+    m_rootPlatformLayer = 0;
+}
+
 bool RenderLayerCompositor::layerHas3DContent(const RenderLayer* layer) const
 {
     const RenderStyle* style = layer->renderer()->style();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
index c522180..38995f8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -56,6 +56,12 @@ public:
     // This will make a compositing layer at the root automatically, and hook up to
     // the native view/window system.
     void enableCompositingMode(bool enable = true);
+    
+    // Returns true if the accelerated compositing is enabled
+    bool hasAcceleratedCompositing() const { return m_hasAcceleratedCompositing; }
+    
+    // Copy the acceleratedCompositingEnabledFlag from Settings
+    void cacheAcceleratedCompositingEnabledFlag();
 
     void setCompositingLayersNeedUpdate(bool needUpdate = true);
     bool compositingLayersNeedUpdate() const { return m_compositingLayersNeedUpdate; }
@@ -137,7 +143,8 @@ private:
     bool layerHas3DContent(const RenderLayer*) const;
 
     void ensureRootPlatformLayer();
-
+    void destroyRootPlatformLayer();
+    
     // Whether a running transition or animation enforces the need for a compositing layer.
     static bool requiresCompositingForAnimation(RenderObject*);
     static bool requiresCompositingForTransform(RenderObject*);
@@ -149,6 +156,8 @@ private:
     bool m_compositing;
     bool m_rootLayerAttached;
     bool m_compositingLayersNeedUpdate;
+    bool m_hasAcceleratedCompositing;
+    
 #if PROFILE_LAYER_REBUILD
     int m_rootLayerUpdateCount;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
index 95de7a2..4cd7b43 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
@@ -297,7 +297,7 @@ void RenderMenuList::hidePopup()
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    select->setSelectedIndex(select->listToOptionIndex(listIndex), true, fireOnChange);
+    select->setSelectedIndexByUser(select->listToOptionIndex(listIndex), true, fireOnChange);
 }
 
 String RenderMenuList::itemText(unsigned listIndex) const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index 1c01b8a..098932a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -1699,7 +1699,7 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
         transform.multLeft(layer->currentTransform());
     
 #if ENABLE(3D_RENDERING)
-    if (containerObject && containerObject->style()->hasPerspective()) {
+    if (containerObject && containerObject->hasLayer() && containerObject->style()->hasPerspective()) {
         // Perpsective on the container affects us, so we have to factor it in here.
         ASSERT(containerObject->hasLayer());
         FloatPoint perspectiveOrigin = toRenderBox(containerObject)->layer()->perspectiveOrigin();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index f85cf76..311ef9c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -959,12 +959,14 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
         last->scheduleRelayout();
 }
 
-inline void makeMatrixRenderable(TransformationMatrix& matrix)
+inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
+    UNUSED_PARAM(has3DRendering);
     matrix.makeAffine();
 #else
-    UNUSED_PARAM(matrix);
+    if (!has3DRendering)
+        matrix.makeAffine();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 7d5b493..b756ab7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -581,6 +581,12 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
     return 1;
 }
 
+// static
+void RenderThemeChromiumSkia::setDefaultFontSize(int fontSize)
+{
+    defaultFontSize = static_cast<float>(fontSize);
+}
+
 double RenderThemeChromiumSkia::caretBlinkIntervalInternal() const
 {
     return RenderTheme::caretBlinkInterval();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
index 421bd26..d91c0d7 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -116,6 +116,13 @@ namespace WebCore {
         virtual int buttonInternalPaddingTop() const;
         virtual int buttonInternalPaddingBottom() const;
 
+        // Provide a way to pass the default font size from the Settings object
+        // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
+        // to remove the default font size from this object and have callers
+        // that need the value to get it directly from the appropriate Settings
+        // object.
+        static void setDefaultFontSize(int);
+
     protected:
         static const String& defaultGUIFont();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
index ffc13e1..4ed8d88 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -425,7 +425,7 @@ bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const RenderObject::
 // static
 void RenderThemeChromiumWin::setDefaultFontSize(int fontSize)
 {
-    defaultFontSize = static_cast<float>(fontSize);
+    RenderThemeChromiumSkia::setDefaultFontSize(fontSize);
 
     // Reset cached fonts.
     smallSystemFont = menuFont = labelFont = FontDescription();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
index af51e79..5e98c9b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -81,11 +81,8 @@ namespace WebCore {
         // entire menulist.
         virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
-        // Provide a way to pass the default font size from the Settings object
-        // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
-        // to remove the default font size from this object and have callers
-        // that need the value to get it directly from the appropriate Settings
-        // object.
+        // Override RenderThemeChromiumSkia's setDefaultFontSize method to also reset the local font property caches.
+        // See comment in RenderThemeChromiumSkia::setDefaultFontSize() regarding ugliness of this hack.
         static void setDefaultFontSize(int);
 
     protected:
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
index 1cfc119..978e67b 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
@@ -33,7 +33,6 @@
 #include "FileSystem.h"
 #include "Frame.h"
 #include "FrameTree.h"
-#include "LocalStorageArea.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "StorageArea.h"
@@ -90,11 +89,11 @@ PassRefPtr<StorageArea> LocalStorage::storageArea(SecurityOrigin* origin)
     // FIXME: If the storage area is being established for the first time here, we need to 
     // sync its existance and quota out to disk via an task of type AreaSync
 
-    RefPtr<LocalStorageArea> storageArea;
+    RefPtr<StorageArea> storageArea;
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = LocalStorageArea::create(origin, m_syncManager);
+    storageArea = StorageArea::createLocalStorage(origin, m_syncManager);
     m_storageAreaMap.set(origin, storageArea);
     return storageArea.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h b/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
index cc874d7..5139415 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorageArea.h"
 #include "SecurityOriginHash.h"
 
 #include <wtf/HashMap.h>
@@ -52,7 +51,7 @@ namespace WebCore {
     private:
         LocalStorage(const String& path);
 
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<LocalStorageArea>, SecurityOriginHash> LocalStorageAreaMap;
+        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> LocalStorageAreaMap;
         LocalStorageAreaMap m_storageAreaMap;
 
         String m_path;
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index 915639a..2b04120 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -29,12 +29,12 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "LocalStorage.h"
-#include "LocalStorageArea.h"
 #include "LocalStorageThread.h"
+#include "StorageAreaSync.h"
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageArea> area)
+LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
     : m_type(type)
     , m_area(area)
 {
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index eb2cbcc..2c397da 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -34,25 +34,26 @@
 
 namespace WebCore {
 
-    class LocalStorageArea;
+    class StorageAreaSync;
     class LocalStorageThread;
 
+    // FIXME: Rename this class to StorageTask
     class LocalStorageTask : public ThreadSafeShared<LocalStorageTask> {
     public:
         enum Type { AreaImport, AreaSync, TerminateThread };
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<LocalStorageArea> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<LocalStorageArea> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
         static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<LocalStorageArea>);
+        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
         LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
 
         Type m_type;
-        RefPtr<LocalStorageArea> m_area;
+        RefPtr<StorageAreaSync> m_area;
         RefPtr<LocalStorageThread> m_thread;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index 60cc9fa..ef1e3c6 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -29,8 +29,8 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "LocalStorage.h"
-#include "LocalStorageArea.h"
 #include "LocalStorageTask.h"
+#include "StorageAreaSync.h"
 
 namespace WebCore {
 
@@ -87,13 +87,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<LocalStorageArea> area)
+void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<LocalStorageArea> area)
+void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index f11660a..3d58427 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -35,17 +35,18 @@
 
 namespace WebCore {
 
-    class LocalStorageArea;
+    class StorageAreaSync;
     class LocalStorageTask;
 
+    // FIXME: Rename this class to StorageThread
     class LocalStorageThread : public ThreadSafeShared<LocalStorageThread> {
     public:
         static PassRefPtr<LocalStorageThread> create();
 
         bool start();
 
-        void scheduleImport(PassRefPtr<LocalStorageArea>);
-        void scheduleSync(PassRefPtr<LocalStorageArea>);
+        void scheduleImport(PassRefPtr<StorageAreaSync>);
+        void scheduleSync(PassRefPtr<StorageAreaSync>);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
index c10a1be..7c2df16 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
@@ -56,7 +56,7 @@ PassRefPtr<SessionStorage> SessionStorage::copy(Page* newPage)
     
     SessionStorageAreaMap::iterator end = m_storageAreaMap.end();
     for (SessionStorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
-        RefPtr<SessionStorageArea> areaCopy = i->second->copy(i->first.get(), newPage);
+        RefPtr<StorageArea> areaCopy = i->second->copy(i->first.get(), newPage);
         newSession->m_storageAreaMap.set(i->first, areaCopy.release());
     }
     
@@ -65,11 +65,11 @@ PassRefPtr<SessionStorage> SessionStorage::copy(Page* newPage)
 
 PassRefPtr<StorageArea> SessionStorage::storageArea(SecurityOrigin* origin)
 {
-    RefPtr<SessionStorageArea> storageArea;
+    RefPtr<StorageArea> storageArea;
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
         
-    storageArea = SessionStorageArea::create(origin, m_page);
+    storageArea = StorageArea::createSessionStorage(origin, m_page);
     m_storageAreaMap.set(origin, storageArea);
     return storageArea.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h b/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
index 99fc380..b1244c2 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
+++ b/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
@@ -29,7 +29,7 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "SecurityOriginHash.h"
-#include "SessionStorageArea.h"
+#include "StorageArea.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -56,7 +56,7 @@ namespace WebCore {
 
         Page* m_page;
         
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<SessionStorageArea>, SecurityOriginHash> SessionStorageAreaMap;
+        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> SessionStorageAreaMap;
         SessionStorageAreaMap m_storageAreaMap;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
deleted file mode 100644
index 7fb6ca8..0000000
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "SessionStorageArea.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "DOMWindow.h"
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "HTMLElement.h"
-#include "Page.h"
-#include "PlatformString.h"
-#include "SecurityOrigin.h"
-#include "StorageEvent.h"
-#include "StorageMap.h"
-
-namespace WebCore {
-
-PassRefPtr<SessionStorageArea> SessionStorageArea::copy(SecurityOrigin* origin, Page* page)
-{
-    return adoptRef(new SessionStorageArea(origin, page, this));
-}
-
-SessionStorageArea::SessionStorageArea(SecurityOrigin* origin, Page* page)
-    : StorageArea(origin)
-    , m_page(page)
-{
-    ASSERT(page);
-}
-
-SessionStorageArea::SessionStorageArea(SecurityOrigin* origin, Page* page, SessionStorageArea* area)
-    : StorageArea(origin, area)
-    , m_page(page)
-{
-    ASSERT(page);
-}
-
-void SessionStorageArea::itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    dispatchStorageEvent(key, oldValue, newValue, sourceFrame);
-}
-
-void SessionStorageArea::itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame)
-{
-    dispatchStorageEvent(key, oldValue, String(), sourceFrame);
-}
-
-void SessionStorageArea::areaCleared(Frame* sourceFrame)
-{
-    dispatchStorageEvent(String(), String(), String(), sourceFrame);
-}
-
-void SessionStorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    // For SessionStorage events, each frame in the page's frametree with the same origin as this StorageArea needs to be notified of the change
-    Vector<RefPtr<Frame> > frames;
-    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-        if (frame->document()->securityOrigin()->equal(securityOrigin()))
-            frames.append(frame);
-    }
-
-    for (unsigned i = 0; i < frames.size(); ++i)
-        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
index 97bfd9f..992ddd5 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
@@ -28,30 +28,64 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "CString.h"
+#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "StorageEvent.h"
+#include "StorageAreaSync.h"
 #include "StorageMap.h"
+#include "StorageSyncManager.h"
 
 namespace WebCore {
 
-StorageArea::StorageArea(SecurityOrigin* origin)
+PassRefPtr<StorageArea> StorageArea::createLocalStorage(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+{
+    return adoptRef(new StorageArea(origin, syncManager));
+}
+
+StorageArea::StorageArea(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
     : m_securityOrigin(origin)
     , m_storageMap(StorageMap::create())
+    , m_storageSyncManager(syncManager)
+    , m_sessionStoragePage(0)
 {
+    ASSERT(m_securityOrigin);
+    ASSERT(m_storageMap);
+
+    // FIXME: If there's no backing storage for LocalStorage, the default WebKit behavior should be that of private browsing,
+    // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
+    if (m_storageSyncManager) {
+        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this);
+        ASSERT(m_storageAreaSync);
+    }
 }
 
-StorageArea::StorageArea(SecurityOrigin* origin, StorageArea* area)
-    : m_securityOrigin(origin)
-    , m_storageMap(area->m_storageMap)
+PassRefPtr<StorageArea> StorageArea::createSessionStorage(SecurityOrigin* origin, Page* page)
+{
+    return adoptRef(new StorageArea(origin, page, 0));
+}
+
+PassRefPtr<StorageArea> StorageArea::copy(SecurityOrigin* origin, Page* page)
 {
+    return adoptRef(new StorageArea(origin, page, m_storageMap));
 }
 
-StorageArea::~StorageArea()
+StorageArea::StorageArea(SecurityOrigin* origin, Page* page, PassRefPtr<StorageMap> storageMap)
+    : m_securityOrigin(origin)
+    , m_storageMap(storageMap)
+    , m_sessionStoragePage(page)
 {
+    ASSERT(m_securityOrigin);
+    ASSERT(m_sessionStoragePage);
+
+    if (!m_storageMap) {
+        m_storageMap = StorageMap::create();
+        ASSERT(m_storageMap);
+    }
 }
 
 unsigned StorageArea::length() const
@@ -104,8 +138,11 @@ void StorageArea::setItem(const String& key, const String& value, ExceptionCode&
         m_storageMap = newMap.release();
 
     // Only notify the client if an item was actually changed
-    if (oldValue != value)
-        itemChanged(key, oldValue, value, frame);
+    if (oldValue != value) {
+        if (m_storageAreaSync)
+            m_storageAreaSync->scheduleItemForSync(key, value);
+        dispatchStorageEvent(key, oldValue, value, frame);
+    }
 }
 
 void StorageArea::removeItem(const String& key, Frame* frame)
@@ -121,8 +158,11 @@ void StorageArea::removeItem(const String& key, Frame* frame)
         m_storageMap = newMap.release();
 
     // Only notify the client if an item was actually removed
-    if (!oldValue.isNull())
-        itemRemoved(key, oldValue, frame);
+    if (!oldValue.isNull()) {
+        if (m_storageAreaSync)
+            m_storageAreaSync->scheduleItemForSync(key, String());
+        dispatchStorageEvent(key, oldValue, String(), frame);
+    }
 }
 
 void StorageArea::clear(Frame* frame)
@@ -134,7 +174,9 @@ void StorageArea::clear(Frame* frame)
     
     m_storageMap = StorageMap::create();
     
-    areaCleared(frame);
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleClear();
+    dispatchStorageEvent(String(), String(), String(), frame);
 }
 
 bool StorageArea::contains(const String& key) const
@@ -149,6 +191,54 @@ void StorageArea::importItem(const String& key, const String& value)
     m_storageMap->importItem(key, value);
 }
 
+void StorageArea::scheduleFinalSync()
+{
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleFinalSync();
+}
+
+void StorageArea::blockUntilImportComplete() const
+{
+    if (m_storageAreaSync)
+        m_storageAreaSync->blockUntilImportComplete();
+}
+
+void StorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
+{
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+
+    if (m_sessionStoragePage) {
+        // Send events only to our page.
+        for (Frame* frame = m_sessionStoragePage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin()))
+                frames.append(frame);
+        }
+        
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // FIXME: When can this occur?
+        Page* page = sourceFrame->page();
+        if (!page)
+            return;
+
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin()))
+                    frames.append(frame);
+            }
+        }
+        
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
+    }        
+}
+
 }
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index d8e1913..30f0367 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -29,6 +29,10 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "PlatformString.h"
+#include "SecurityOrigin.h"
+#include "StorageAreaSync.h"
+#include "StorageMap.h"
+#include "StorageSyncManager.h"
 
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
@@ -38,14 +42,19 @@
 namespace WebCore {
 
     class Frame;
+    class Page;
     class SecurityOrigin;
+    class StorageAreaSync;
     class StorageMap;
+    class StorageSyncManager;
     typedef int ExceptionCode;
 
-    class StorageArea : public RefCounted<StorageArea> {
+    class StorageArea : public ThreadSafeShared<StorageArea> {
     public:
-        virtual ~StorageArea();
-        
+        static PassRefPtr<StorageArea> createLocalStorage(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager);
+        static PassRefPtr<StorageArea> createSessionStorage(SecurityOrigin* origin, Page* page);
+        PassRefPtr<StorageArea> copy(SecurityOrigin*, Page*);
+
         // The HTML5 DOM Storage API
         unsigned length() const;
         String key(unsigned index, ExceptionCode& ec) const;
@@ -55,24 +64,28 @@ namespace WebCore {
         void clear(Frame* sourceFrame);
 
         bool contains(const String& key) const;
+        void scheduleFinalSync();
 
+        // Could be called from a background thread.
+        void importItem(const String& key, const String& value);
         SecurityOrigin* securityOrigin() { return m_securityOrigin.get(); }
 
     protected:
-        StorageArea(SecurityOrigin*);
-        StorageArea(SecurityOrigin*, StorageArea*);
-                
-        // This is meant to be called from a background thread for LocalStorageArea's background thread import procedure.
-        void importItem(const String& key, const String& value);
+        StorageArea(SecurityOrigin*, PassRefPtr<StorageSyncManager>);
+        StorageArea(SecurityOrigin*, Page*);
+        StorageArea(SecurityOrigin*, Page*, PassRefPtr<StorageMap>);
 
     private:
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame) = 0;
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame) = 0;
-        virtual void areaCleared(Frame* sourceFrame) = 0;
-        virtual void blockUntilImportComplete() const { }
+        void blockUntilImportComplete() const;
+
+        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
+
+        RefPtr<StorageAreaSync> m_storageAreaSync;
+        RefPtr<StorageSyncManager> m_storageSyncManager;
+        Page* m_sessionStoragePage;  // NULL iff it's LocalStorage
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 1c612a0..5cac054 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -24,53 +24,58 @@
  */
 
 #include "config.h"
-#include "LocalStorageArea.h"
+#include "StorageAreaSync.h"
 
 #if ENABLE(DOM_STORAGE)
 
 #include "CString.h"
-#include "DOMWindow.h"
 #include "EventNames.h"
-#include "Frame.h"
 #include "HTMLElement.h"
-#include "LocalStorage.h"
-#include "Page.h"
-#include "PageGroup.h"
 #include "SQLiteStatement.h"
-#include "StorageEvent.h"
+#include "StorageArea.h"
 #include "SuddenTermination.h"
 
 namespace WebCore {
 
-// If the LocalStorageArea undergoes rapid changes, don't sync each change to disk.
+// If the StorageArea undergoes rapid changes, don't sync each change to disk.
 // Instead, queue up a batch of items to sync and actually do the sync at the following interval.
-static const double LocalStorageSyncInterval = 1.0;
+static const double StorageSyncInterval = 1.0;
 
-LocalStorageArea::LocalStorageArea(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
-    : StorageArea(origin)
-    , m_syncTimer(this, &LocalStorageArea::syncTimerFired)
+PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea)
+{
+    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea));
+}
+
+StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea)
+    : m_syncTimer(this, &StorageAreaSync::syncTimerFired)
     , m_itemsCleared(false)
     , m_finalSyncScheduled(false)
-    , m_syncManager(syncManager)
+    , m_storageArea(storageArea)
+    , m_syncManager(storageSyncManager)
     , m_clearItemsWhileSyncing(false)
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
-    if (!m_syncManager || !m_syncManager->scheduleImport(this))
+    ASSERT(m_storageArea);
+    ASSERT(m_syncManager);
+
+    // FIXME: If it can't import, then the default WebKit behavior should be that of private browsing,
+    // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
+    if (!m_syncManager->scheduleImport(this))
         m_importComplete = true;
 }
 
-LocalStorageArea::~LocalStorageArea()
+#ifndef NDEBUG
+StorageAreaSync::~StorageAreaSync()
 {
     ASSERT(!m_syncTimer.isActive());
 }
+#endif
 
-void LocalStorageArea::scheduleFinalSync()
+void StorageAreaSync::scheduleFinalSync()
 {
     ASSERT(isMainThread());
-    if (!m_syncManager)
-        return;
-
+    
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
     else {
@@ -78,67 +83,20 @@ void LocalStorageArea::scheduleFinalSync()
         // syncTimerFired function.
         disableSuddenTermination();
     }
+    // FIXME: This is synchronous.  We should do it on the background process, but
+    // we should do it safely.
     syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
 }
 
-void LocalStorageArea::itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleItemForSync(key, newValue);
-    dispatchStorageEvent(key, oldValue, newValue, sourceFrame);
-}
-
-void LocalStorageArea::itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleItemForSync(key, String());
-    dispatchStorageEvent(key, oldValue, String(), sourceFrame);
-}
-
-void LocalStorageArea::areaCleared(Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), sourceFrame);
-}
-
-void LocalStorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // Need to copy all relevant frames from every page to a vector, since sending the event to one frame might mutate the frame tree
-    // of any given page in the group, or mutate the page group itself
-    Vector<RefPtr<Frame> > frames;
-    const HashSet<Page*>& pages = page->group().pages();
-    
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-    }
-
-    for (unsigned i = 0; i < frames.size(); ++i)
-        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-}
-
-void LocalStorageArea::scheduleItemForSync(const String& key, const String& value)
+void StorageAreaSync::scheduleItemForSync(const String& key, const String& value)
 {
     ASSERT(isMainThread());
     ASSERT(!m_finalSyncScheduled);
 
     m_changedItems.set(key, value);
     if (!m_syncTimer.isActive()) {
-        m_syncTimer.startOneShot(LocalStorageSyncInterval);
+        m_syncTimer.startOneShot(StorageSyncInterval);
 
         // The following is balanced by the call to enableSuddenTermination in the
         // syncTimerFired function.
@@ -146,7 +104,7 @@ void LocalStorageArea::scheduleItemForSync(const String& key, const String& valu
     }
 }
 
-void LocalStorageArea::scheduleClear()
+void StorageAreaSync::scheduleClear()
 {
     ASSERT(isMainThread());
     ASSERT(!m_finalSyncScheduled);
@@ -154,7 +112,7 @@ void LocalStorageArea::scheduleClear()
     m_changedItems.clear();
     m_itemsCleared = true;
     if (!m_syncTimer.isActive()) {
-        m_syncTimer.startOneShot(LocalStorageSyncInterval);
+        m_syncTimer.startOneShot(StorageSyncInterval);
 
         // The following is balanced by the call to enableSuddenTermination in the
         // syncTimerFired function.
@@ -162,11 +120,9 @@ void LocalStorageArea::scheduleClear()
     }
 }
 
-void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
+void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 {
     ASSERT(isMainThread());
-    if (!m_syncManager)
-        return;
 
     HashMap<String, String>::iterator it = m_changedItems.begin();
     HashMap<String, String>::iterator end = m_changedItems.end();
@@ -201,14 +157,12 @@ void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
     m_changedItems.clear();
 }
 
-void LocalStorageArea::performImport()
+void StorageAreaSync::performImport()
 {
     ASSERT(!isMainThread());
     ASSERT(!m_database.isOpen());
-    if (!m_syncManager)
-        return;
 
-    String databaseFilename = m_syncManager->fullDatabaseFilename(securityOrigin());
+    String databaseFilename = m_syncManager->fullDatabaseFilename(m_storageArea->securityOrigin());
 
     if (databaseFilename.isEmpty()) {
         LOG_ERROR("Filename for local storage database is empty - cannot open for persistent storage");
@@ -255,29 +209,33 @@ void LocalStorageArea::performImport()
     HashMap<String, String>::iterator end = itemMap.end();
     
     for (; it != end; ++it)
-        importItem(it->first, it->second);
+        m_storageArea->importItem(it->first, it->second);
     
+    // Break the (ref count) cycle.
+    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
 
-void LocalStorageArea::markImported()
+void StorageAreaSync::markImported()
 {
     ASSERT(!isMainThread());
 
     MutexLocker locker(m_importLock);
+    // Break the (ref count) cycle.
+    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
 
-// FIXME: In the future, we should allow use of localStorage while it's importing (when safe to do so).
+// FIXME: In the future, we should allow use of StorageAreas while it's importing (when safe to do so).
 // Blocking everything until the import is complete is by far the simplest and safest thing to do, but
 // there is certainly room for safe optimization: Key/length will never be able to make use of such an
 // optimization (since the order of iteration can change as items are being added). Get can return any
 // item currently in the map. Get/remove can work whether or not it's in the map, but we'll need a list
 // of items the import should not overwrite. Clear can also work, but it'll need to kill the import
 // job first.
-void LocalStorageArea::blockUntilImportComplete() const
+void StorageAreaSync::blockUntilImportComplete() const
 {
     ASSERT(isMainThread());
 
@@ -289,9 +247,10 @@ void LocalStorageArea::blockUntilImportComplete() const
     while (!m_importComplete)
         m_importCondition.wait(m_importLock);
     ASSERT(m_importComplete);
+    ASSERT(!m_storageArea);
 }
 
-void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& items)
+void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items)
 {
     ASSERT(!isMainThread());
 
@@ -347,7 +306,7 @@ void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& item
     }
 }
 
-void LocalStorageArea::performSync()
+void StorageAreaSync::performSync()
 {
     ASSERT(!isMainThread());
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
index 7a385aa..fa10e63 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
@@ -23,47 +23,50 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef LocalStorageArea_h
-#define LocalStorageArea_h
+#ifndef StorageAreaSync_h
+#define StorageAreaSync_h
 
 #if ENABLE(DOM_STORAGE)
 
 #include "SQLiteDatabase.h"
-#include "StorageArea.h"
 #include "StringHash.h"
 #include "StorageSyncManager.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 
 namespace WebCore {
-    
+
+    class Frame;
+    class StorageArea;    
     class StorageSyncManager;
     
-    class LocalStorageArea : public StorageArea {
+    class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
-        virtual ~LocalStorageArea();
-
-        static PassRefPtr<LocalStorageArea> create(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager) { return adoptRef(new LocalStorageArea(origin, syncManager)); }
+#ifndef NDEBUG
+        ~StorageAreaSync();
+#endif
 
+        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea);
+        
         void scheduleFinalSync();
-
-    private:
-        LocalStorageArea(SecurityOrigin*, PassRefPtr<StorageSyncManager> syncManager);
-
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame);
-        virtual void areaCleared(Frame* sourceFrame);
+        void blockUntilImportComplete() const;
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
+        
+    private:
+        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea);
+
+        
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
-        Timer<LocalStorageArea> m_syncTimer;        
+        Timer<StorageAreaSync> m_syncTimer;        
         HashMap<String, String> m_changedItems;
         bool m_itemsCleared;
         
         bool m_finalSyncScheduled;
 
+        RefPtr<StorageArea> m_storageArea;
         RefPtr<StorageSyncManager> m_syncManager;
 
         // The database handle will only ever be opened and used on the background thread.
@@ -72,11 +75,11 @@ namespace WebCore {
     // The following members are subject to thread synchronization issues.
     public:
         // Called from the background thread
-        virtual void performImport();
-        virtual void performSync();
+        void performImport();
+        void performSync();
 
     private:
-        void syncTimerFired(Timer<LocalStorageArea>*);
+        void syncTimerFired(Timer<StorageAreaSync>*);
         void sync(bool clearItems, const HashMap<String, String>& items);
 
         Mutex m_syncLock;
@@ -88,11 +91,10 @@ namespace WebCore {
         mutable ThreadCondition m_importCondition;
         mutable bool m_importComplete;
         void markImported();
-        void blockUntilImportComplete() const;
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
 
-#endif // LocalStorageArea_h
+#endif // StorageAreaSync_h
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index b2067bc..5dab7a6 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -35,7 +35,7 @@
 #include "FrameTree.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "StorageArea.h"
+#include "StorageAreaSync.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -74,7 +74,7 @@ void StorageSyncManager::close()
     }
 }
 
-bool StorageSyncManager::scheduleImport(PassRefPtr<LocalStorageArea> area)
+bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
 
@@ -84,7 +84,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<LocalStorageArea> area)
     return m_thread;
 }
 
-void StorageSyncManager::scheduleSync(PassRefPtr<LocalStorageArea> area)
+void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index 28370aa..83353ed 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -28,9 +28,10 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorageArea.h"
 #include "LocalStorageTask.h"
 #include "LocalStorageThread.h"
+#include "StorageArea.h"
+#include "StorageAreaSync.h"
 
 #include <wtf/Threading.h>
 
@@ -40,8 +41,8 @@ namespace WebCore {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
 
-        bool scheduleImport(PassRefPtr<LocalStorageArea>);
-        void scheduleSync(PassRefPtr<LocalStorageArea>);
+        bool scheduleImport(PassRefPtr<StorageAreaSync>);
+        void scheduleSync(PassRefPtr<StorageAreaSync>);
 
         void close();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index 725711d..334a6eb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -435,7 +435,7 @@ namespace WebCore {
         if (old && value.isNull()) 
             namedAttrMap->removeAttribute(old->name()); 
         else if (!old && !value.isNull()) 
-            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(QualifiedName(nullAtom, attributeName.localName(), nullAtom), value)); 
+            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
         else if (old && !value.isNull()) 
             old->setValue(value); 
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index 9aff93d..a5684a2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
+                  2004, 2005, 2006, 2007, 2008, 2009 Rob Buis <buis@kde.org>
                   2006 Alexander Kellett <lypanov@kde.org>
 
     This file is part of the KDE project
@@ -93,23 +93,20 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    if (SVGURIReference::isKnownAttribute(attrName))
+        m_imageLoader.updateFromElementIgnoringPreviousError();
+
     if (!renderer())
         return;
 
-    bool isURIAttribute = SVGURIReference::isKnownAttribute(attrName);
-
     if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
         attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
         attrName == SVGNames::preserveAspectRatioAttr ||
         SVGTests::isKnownAttribute(attrName) ||
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        isURIAttribute ||
         SVGStyledTransformableElement::isKnownAttribute(attrName)) {
         renderer()->setNeedsLayout(true);
-
-        if (isURIAttribute)
-            m_imageLoader.updateFromElementIgnoringPreviousError();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
index 300cbf6..aac99db 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 
 WMLAnchorElement::WMLAnchorElement(const QualifiedName& tagName, Document* doc)
     : WMLAElement(tagName, doc)
+    , m_task(0)
 {
     // Calling setIsLink(true), and returning a non-null value on CSSStyleSelectors' linkAttribute
     // method, makes it possible to 'appear as link' (just like <a href="..">) without the need to
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index c8e92af..3713c59 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -206,6 +206,11 @@ void WMLCardElement::handleDeckLevelTaskOverridesIfNeeded()
         (*it)->setActive(!cardDoElementNames.contains((*it)->name()));
 }
 
+String WMLCardElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 void WMLCardElement::parseMappedAttribute(MappedAttribute* attr)
 {
     WMLIntrinsicEventType eventType = WMLIntrinsicEventUnknown;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
index 972961e..e033e3d 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
@@ -47,6 +47,7 @@ public:
     void handleIntrinsicEventIfNeeded();
     void handleDeckLevelTaskOverridesIfNeeded();
 
+    virtual String title() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
index 916bc6e..f553fff 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
@@ -98,8 +98,6 @@ void WMLDoElement::parseMappedAttribute(MappedAttribute* attr)
         m_type = parseValueForbiddingVariableReferences(attr->value());
     else if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::labelAttr)
-        m_label = parseValueSubstitutingVariableReferences(attr->value());
     else if (attr->name() == optionalAttr)
         m_isOptional = (attr->value() == "true");
     else
@@ -145,6 +143,11 @@ void WMLDoElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+String WMLDoElement::label() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::labelAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
index 98e97cc..51e37c4 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
@@ -42,7 +42,7 @@ public:
     void registerTask(WMLTaskElement* task) { m_task = task; }
 
     bool isActive() const { return m_isActive; }
-    String label() const { return m_label; }
+    String label() const;
     String name() const { return m_name; }
 
     void setActive(bool active) { m_isActive = active; }
@@ -53,7 +53,6 @@ private:
     bool m_isActive;
     bool m_isNoop;
     bool m_isOptional;
-    String m_label;
     String m_name;
     String m_type;
 };
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index e818f9d..f59a3a1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -87,7 +87,7 @@ RenderObject* WMLElement::createRenderer(RenderArena*, RenderStyle* style)
     return RenderObject::createObject(this, style);
 }
 
-String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode)
+String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode) const
 {
     bool isValid = false;
     if (!containsVariableReference(value, isValid))
@@ -101,7 +101,7 @@ String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString&
     return substituteVariableReferences(value, document());
 }
 
-String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value)
+String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value) const
 {
     bool isValid = false;
     if (containsVariableReference(value, isValid)) {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.h b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
index 61bd98f..04e28d0 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
@@ -42,8 +42,8 @@ public:
 
 protected:
     // Helper function for derived classes
-    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference);
-    String parseValueForbiddingVariableReferences(const AtomicString&);
+    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
+    String parseValueForbiddingVariableReferences(const AtomicString&) const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
index 8146375..c0b4bc5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
@@ -43,19 +43,12 @@ WMLFieldSetElement::~WMLFieldSetElement()
 {
 }
 
-void WMLFieldSetElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::titleAttr)
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLFieldSetElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    if (m_title.isEmpty())
+    String title = parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+    if (title.isEmpty())
         return;
 
     m_insertedLegendElement = WMLElementFactory::createWMLElement(insertedLegendTag, document());
@@ -67,7 +60,7 @@ void WMLFieldSetElement::insertedIntoDocument()
     ASSERT(ec == 0);
 
     // Create text node holding the 'title' attribute value
-    m_insertedLegendElement->appendChild(document()->createTextNode(m_title), ec);
+    m_insertedLegendElement->appendChild(document()->createTextNode(title), ec);
     ASSERT(ec == 0);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
index 2043364..1087fa1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
@@ -31,14 +31,12 @@ public:
     WMLFieldSetElement(const QualifiedName& tagName, Document*);
     virtual ~WMLFieldSetElement();
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 private:
-    String m_title;
     RefPtr<WMLElement> m_insertedLegendElement;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
index d70731c..3614c6c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
@@ -44,6 +44,11 @@ WMLOptGroupElement::~WMLOptGroupElement()
 {
 }
 
+String WMLOptGroupElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 const AtomicString& WMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
@@ -120,11 +125,6 @@ void WMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChang
 
 void WMLOptGroupElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == HTMLNames::titleAttr) {
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-        return;
-    }
-
     WMLFormControlElement::parseMappedAttribute(attr);
     recalcSelectOptions();
 }
@@ -154,7 +154,7 @@ RenderStyle* WMLOptGroupElement::nonRendererRenderStyle() const
 
 String WMLOptGroupElement::groupLabelText() const
 {
-    String itemText = document()->displayStringModifiedByEncoding(m_title);
+    String itemText = document()->displayStringModifiedByEncoding(title());
 
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     itemText = itemText.stripWhiteSpace();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
index 1ba5ac1..0460056 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
@@ -32,7 +32,7 @@ public:
     WMLOptGroupElement(const QualifiedName& tagName, Document*);
     virtual ~WMLOptGroupElement();
 
-    String title() const { return m_title; }
+    String title() const;
 
     virtual const AtomicString& formControlType() const;
 
@@ -59,7 +59,6 @@ private:
     void recalcSelectOptions();
 
 private:
-    String m_title;
     RefPtr<RenderStyle> m_style;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
index 69f61f5..7d001e1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
@@ -26,7 +26,6 @@
 #include "CString.h"
 #include "TextEncoding.h"
 #include "HTMLNames.h"
-#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLGoElement.h"
 #include "WMLNames.h"
@@ -40,16 +39,6 @@ WMLPostfieldElement::WMLPostfieldElement(const QualifiedName& tagName, Document*
 {
 }
 
-void WMLPostfieldElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::nameAttr)
-        m_name = parseValueSubstitutingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLPostfieldElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
@@ -63,6 +52,16 @@ void WMLPostfieldElement::insertedIntoDocument()
     static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
 }
 
+String WMLPostfieldElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr));
+}
+
+String WMLPostfieldElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 static inline CString encodedString(const TextEncoding& encoding, const String& data)
 {
     return encoding.encode(data.characters(), data.length(), EntitiesForUnencodables);
@@ -70,8 +69,8 @@ static inline CString encodedString(const TextEncoding& encoding, const String&
 
 void WMLPostfieldElement::encodeData(const TextEncoding& encoding, CString& name, CString& value)
 {
-    name = encodedString(encoding, m_name);
-    value = encodedString(encoding, m_value);
+    name = encodedString(encoding, this->name());
+    value = encodedString(encoding, this->value());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
index 59b7f64..945e6d3 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
@@ -30,18 +30,13 @@ class WMLPostfieldElement : public WMLElement {
 public:
     WMLPostfieldElement(const QualifiedName& tagName, Document*);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
+    String name() const;
+    String value() const;
 
     // Encode name() and value() in a CString using the passed encoding
     void encodeData(const TextEncoding&, CString& name, CString& value);
-
-private:
-    String m_name;
-    String m_value;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
index da9a1f4..f0c50cc 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
@@ -43,16 +43,11 @@ WMLSetvarElement::~WMLSetvarElement()
 void WMLSetvarElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr) {
-        String name = parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName);
-        if (!isValidVariableName(name)) {
+        if (!isValidVariableName(parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName))) {
             reportWMLError(document(), WMLErrorInvalidVariableName);
             return;
         }
-
-        m_name = name;
-    } else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
+    } else
         WMLElement::parseMappedAttribute(attr);
 }
 
@@ -70,6 +65,16 @@ void WMLSetvarElement::insertedIntoDocument()
         static_cast<WMLTaskElement*>(parent)->registerVariableSetter(this);
 }
 
+String WMLSetvarElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr), WMLErrorInvalidVariableName);
+}
+
+String WMLSetvarElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
index ebedbc8..12400a5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
@@ -34,12 +34,8 @@ public:
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
-
-private:
-    String m_name;
-    String m_value;
+    String name() const;
+    String value() const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
index 00c7036..a41daf5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
@@ -46,8 +46,6 @@ void WMLTimerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
     else
         WMLElement::parseMappedAttribute(attr);
 }
@@ -57,7 +55,7 @@ void WMLTimerElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     // If the value of timeout is not a positive integer, ignore it
-    if (m_value.toInt() <= 0)
+    if (value().toInt() <= 0)
         return;
 
     Node* parent = parentNode();
@@ -81,10 +79,12 @@ void WMLTimerElement::timerFired(Timer<WMLTimerElement>*)
     if (!pageState)
         return;
 
+    String value = this->value();
+
     // When the timer expires, set the name varialbe of timer to '0'
     if (!m_name.isEmpty()) {
-        m_value = "0";
-        pageState->storeVariable(m_name, m_value);
+        value = "0";
+        pageState->storeVariable(m_name, value);
     }
 
     WMLIntrinsicEventType eventType = WMLIntrinsicEventOnTimer;
@@ -114,7 +114,7 @@ void WMLTimerElement::start(int interval)
     }
 
     if (interval <= 0)
-        interval = m_value.toInt();
+        interval = value().toInt();
 
     if (interval > 0)
         m_timer.startOneShot(interval / 10.0f);
@@ -137,6 +137,11 @@ void WMLTimerElement::storeIntervalToPageState()
         pageState->storeVariable(m_name, String::number(interval));
 }
 
+String WMLTimerElement::value() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
index eecacf3..b367eb9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
@@ -42,10 +42,11 @@ public:
     void stop();
     void storeIntervalToPageState();
 
+    String value() const;
+
 private:
     WMLCardElement* m_card;
     String m_name;
-    String m_value;
     Timer<WMLTimerElement> m_timer;
 };
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
index 07d027d..7cdc00e 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
@@ -28,6 +28,7 @@
 #include "PageGroup.h"
 
 #include <QSharedData>
+#include <QDebug>
 
 /*!
   \class QWebHistoryItem
@@ -213,6 +214,8 @@ bool QWebHistoryItem::isValid() const
   number of items is given by count(), and the history can be cleared with the
   clear() function.
 
+  QWebHistory's state can be saved with saveState() and loaded with restoreState().
+
   \sa QWebHistoryItem, QWebHistoryInterface, QWebPage
 */
 
@@ -405,9 +408,13 @@ int QWebHistory::currentItemIndex() const
 */
 QWebHistoryItem QWebHistory::itemAt(int i) const
 {
-    WebCore::HistoryItem *item = d->lst->itemAtIndex(i);
-
-    QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(item);
+    QWebHistoryItemPrivate *priv;
+    if (i < 0 || i >= count())
+        priv = new QWebHistoryItemPrivate(0);
+    else {
+        WebCore::HistoryItem *item = d->lst->entries()[i].get();
+        priv = new QWebHistoryItemPrivate(item);
+    }
     return QWebHistoryItem(priv);
 }
 
@@ -441,3 +448,129 @@ void QWebHistory::setMaximumItemCount(int count)
     d->lst->setCapacity(count);
 }
 
+/*!
+   \enum QWebHistory::HistoryStateVersion
+
+   This enum describes the versions available for QWebHistory's saveState() function:
+
+   \value HistoryVersion_1 Version 1 (Qt 4.6)
+   \value DefaultHistoryVersion The current default version in 1.
+*/
+
+/*!
+  \since 4.6
+
+  Restores the state of QWebHistory from the given \a buffer. Returns true
+  if the history was successfully restored; otherwise returns false.
+
+  \sa saveState()
+*/
+bool QWebHistory::restoreState(const QByteArray& buffer)
+{
+    QDataStream stream(buffer);
+    int version;
+    bool result = false;
+    stream >> version;
+
+    switch (version) {
+    case HistoryVersion_1: {
+        int count;
+        int currentIndex;
+        stream >> count >> currentIndex;
+
+        clear();
+        // only if there are elements
+        if (count) {
+            // after clear() is new clear HistoryItem (at the end we had to remove it)
+            WebCore::HistoryItem *nullItem = d->lst->currentItem();
+            for (int i = 0;i < count;i++) {
+                WTF::PassRefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create();
+                item->restoreState(stream, version);
+                d->lst->addItem(item);
+            }
+            d->lst->removeItem(nullItem);
+            goToItem(itemAt(currentIndex));
+            result = stream.status() == QDataStream::Ok;
+        }
+        break;
+    }
+    default: {} // result is false;
+    }
+
+    return result;
+};
+
+/*!
+  \since 4.6
+  Saves the state of this QWebHistory into a QByteArray.
+
+  Saves the current state of this QWebHistory. The version number, \a version, is
+  stored as part of the data.
+
+  To restore the saved state, pass the return value to restoreState().
+
+  \sa restoreState()
+*/
+QByteArray QWebHistory::saveState(HistoryStateVersion version) const
+{
+    QByteArray buffer;
+    QDataStream stream(&buffer, QIODevice::WriteOnly);
+    stream << version;
+
+    switch (version) {
+    case HistoryVersion_1: {
+        stream << count() << currentItemIndex();
+
+        const WebCore::HistoryItemVector &items = d->lst->entries();
+        for (int i = 0; i < items.size(); i++)
+            items[i].get()->saveState(stream, version);
+
+        if (stream.status() != QDataStream::Ok)
+            buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
+        break;
+    }
+    default:
+        buffer.clear();
+
+    }
+
+    return buffer;
+}
+
+/*!
+  \since 4.6
+  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+  \relates QWebHistory
+
+  Saves the given \a history into the specified \a stream. This is a convenience function
+  and is equivalent to calling the saveState() method.
+
+  \sa QWebHistory::saveState()
+*/
+
+QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+{
+    return stream << history.saveState();
+}
+
+/*!
+  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+  \relates QWebHistory
+  \since 4.6
+
+  Loads a QWebHistory from the specified \a stream into the given \a history.
+  This is a convenience function and it is equivalent to calling the restoreState()
+  method.
+
+  \sa QWebHistory::restoreState()
+*/
+
+QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+{
+    QByteArray buffer;
+    stream >> buffer;
+    history.restoreState(buffer);
+    return stream;
+}
+
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
index c39077d..d74db8f 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
@@ -42,6 +42,9 @@ public:
     QWebHistoryItem &operator=(const QWebHistoryItem &other);
     ~QWebHistoryItem();
 
+    //bool restoreState(QByteArray& buffer);
+    //QByteArray saveState(QWebHistory::HistoryStateVersion version = DefaultHistoryVersion) const;
+
     QUrl originalUrl() const;
     QUrl url() const;
 
@@ -60,13 +63,29 @@ private:
     friend class QWebHistory;
     friend class QWebPage;
     friend class WebCore::FrameLoaderClientQt;
+    friend class QWebHistoryItemPrivate;
+    //friend QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
+    //friend QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
     QExplicitlySharedDataPointer<QWebHistoryItemPrivate> d;
 };
 
+//QWEBKIT_EXPORT QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
+//QWEBKIT_EXPORT QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
+
+
 class QWebHistoryPrivate;
 class QWEBKIT_EXPORT QWebHistory
 {
 public:
+    enum HistoryStateVersion {
+        HistoryVersion_1,
+        /*, HistoryVersion_2, */
+        DefaultHistoryVersion = HistoryVersion_1
+    };
+    
+    bool restoreState(const QByteArray& buffer);
+    QByteArray saveState(HistoryStateVersion version = DefaultHistoryVersion) const;
+    
     void clear();
 
     QList<QWebHistoryItem> items() const;
@@ -98,10 +117,15 @@ private:
 
     friend class QWebPage;
     friend class QWebPagePrivate;
+    friend QDataStream& operator>>(QDataStream&, QWebHistory&);
+    friend QDataStream& operator<<(QDataStream&, const QWebHistory&);
 
     Q_DISABLE_COPY(QWebHistory)
 
     QWebHistoryPrivate *d;
 };
 
+QWEBKIT_EXPORT QDataStream& operator<<(QDataStream& stream, const QWebHistory& history);
+QWEBKIT_EXPORT QDataStream& operator>>(QDataStream& stream, QWebHistory& history);
+
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
index 32e69fe..4bee62b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
@@ -22,10 +22,16 @@
 
 #include "BackForwardList.h"
 #include "HistoryItem.h"
+#include <QtCore/qglobal.h>
+#include <QtCore/qshareddata.h>
 
-class QWebHistoryItemPrivate : public QSharedData
+class Q_AUTOTEST_EXPORT QWebHistoryItemPrivate : public QSharedData
 {
 public:
+    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem *q)
+    {
+        return q->d;
+    }
     QWebHistoryItemPrivate(WebCore::HistoryItem *i)
     {
         if (i)
@@ -37,6 +43,25 @@ public:
         if (item)
             item->deref();
     }
+
+ /*   QByteArray saveStateWithoutVersionControl(QWebHistory::HistoryStateVersion version)
+    {
+        QByteArray buffer;
+        switch(version){
+            case QWebHistory::HistoryVersion1:
+                buffer=item->saveState(version);
+                break;
+            default:{}
+        }
+        return buffer;
+    }
+
+    bool restoreStateWithoutVersionControl(QWebHistory::HistoryStateVersion version,QDataStream& stream)
+    {
+
+    }
+*/
+
     WebCore::HistoryItem *item;
 };
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 3370f15..5c2214d 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -796,7 +796,7 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
             defaultFont = view->font();
         QFontMetrics fm(defaultFont);
         int fontHeight = fm.height();
-        if (!handleScrolling(ev)) {
+        if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
             case Qt::Key_Back:
                 q->triggerAction(QWebPage::Back);
@@ -999,7 +999,7 @@ void QWebPagePrivate::shortcutOverrideEvent(QKeyEvent* event)
     }
 }
 
-bool QWebPagePrivate::handleScrolling(QKeyEvent *ev)
+bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
 {
     ScrollDirection direction;
     ScrollGranularity granularity;
@@ -1046,10 +1046,7 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev)
         }
     }
 
-    if (!mainFrame->d->frame->eventHandler()->scrollOverflow(direction, granularity))
-        mainFrame->d->frame->view()->scroll(direction, granularity);
-
-    return true;
+    return frame->eventHandler()->scrollRecursively(direction, granularity);
 }
 
 /*!
@@ -1115,6 +1112,7 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
    changes the behaviour to a case sensitive find operation.
    \value FindWrapsAroundDocument Makes findText() restart from the beginning of the document if the end
    was reached and the text was not found.
+   \value HighlightAllOccurrences Highlights all existing occurrences of a specific string.
 */
 
 /*!
@@ -2356,8 +2354,18 @@ bool QWebPage::supportsExtension(Extension extension) const
 }
 
 /*!
-    Finds the next occurrence of the string, \a subString, in the page, using the given \a options.
-    Returns true of \a subString was found and selects the match visually; otherwise returns false.
+    Finds the specified string, \a subString, in the page, using the given \a options.
+
+    If the HighlightAllOccurrences flag is passed, the function will highlight all occurrences
+    that exist in the page. All subsequent calls will extend the highlight, rather than
+    replace it, with occurrences of the new string.
+
+    If the HighlightAllOccurrences flag is not passed, the function will select an occurrence
+    and all subsequent calls will replace the current occurrence with the next one.
+
+    To clear the selection, just pass an empty string.
+
+    Returns true if \a subString was found; otherwise returns false.
 */
 bool QWebPage::findText(const QString &subString, FindFlags options)
 {
@@ -2365,13 +2373,22 @@ bool QWebPage::findText(const QString &subString, FindFlags options)
     if (options & FindCaseSensitively)
         caseSensitivity = ::TextCaseSensitive;
 
-    ::FindDirection direction = ::FindDirectionForward;
-    if (options & FindBackward)
-        direction = ::FindDirectionBackward;
+    if (options & HighlightAllOccurrences) {
+        if (subString.isEmpty()) {
+            d->page->unmarkAllTextMatches();
+            return true;
+        } else {
+            return d->page->markAllMatchesForText(subString, caseSensitivity, true, 0);
+        }
+    } else {
+        ::FindDirection direction = ::FindDirectionForward;
+        if (options & FindBackward)
+            direction = ::FindDirectionBackward;
 
-    const bool shouldWrap = options & FindWrapsAroundDocument;
+        const bool shouldWrap = options & FindWrapsAroundDocument;
 
-    return d->page->findString(subString, caseSensitivity, direction, shouldWrap);
+        return d->page->findString(subString, caseSensitivity, direction, shouldWrap);
+    }
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 7edc060..86822d2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -172,7 +172,8 @@ public:
     enum FindFlag {
         FindBackward = 1,
         FindCaseSensitively = 2,
-        FindWrapsAroundDocument = 4
+        FindWrapsAroundDocument = 4,
+        HighlightAllOccurrences = 8
     };
     Q_DECLARE_FLAGS(FindFlags, FindFlag)
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index a897bf1..984bec1 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -45,6 +45,7 @@ namespace WebCore
     class Element;
     class Node;
     class Page;
+    class Frame;
 
 #ifndef QT_NO_CURSOR
     class SetCursorEvent : public QEvent {
@@ -113,7 +114,7 @@ public:
 
     void shortcutOverrideEvent(QKeyEvent*);
     void leaveEvent(QEvent *);
-    bool handleScrolling(QKeyEvent*);
+    bool handleScrolling(QKeyEvent*, WebCore::Frame*);
 
 #ifndef QT_NO_SHORTCUT
     static QWebPage::WebAction editorActionForKeyEvent(QKeyEvent* event);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 3c56b93..c634a7f 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -646,9 +646,18 @@ void QWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
 
 
 /*!
-    Finds the next occurrence of the string, \a subString, in the page, using
-    the given \a options. Returns true of \a subString was found and selects
-    the match visually; otherwise returns false.
+    Finds the specified string, \a subString, in the page, using the given \a options.
+
+    If the HighlightAllOccurrences flag is passed, the function will highlight all occurrences
+    that exist in the page. All subsequent calls will extend the highlight, rather than
+    replace it, with occurrences of the new string.
+
+    If the HighlightAllOccurrences flag is not passed, the function will select an occurrence
+    and all subsequent calls will replace the current occurrence with the next one.
+
+    To clear the selection, just pass an empty string.
+
+    Returns true if \a subString was found; otherwise returns false.
 
     \sa selectedText(), selectionChanged()
 */
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index c2ed475..bd1530e 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,116 @@
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::restoreState):
+        (QWebHistory::saveState):
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+        * Api/qwebhistory_p.h:
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::):
+        (tst_QWebHistory::init):
+        (tst_QWebHistory::title):
+        (tst_QWebHistory::count):
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::itemAt):
+        (tst_QWebHistory::goToItem):
+        (tst_QWebHistory::items):
+        (tst_QWebHistory::serialize_1):
+        (tst_QWebHistory::serialize_2):
+        (tst_QWebHistory::serialize_3):
+        (tst_QWebHistory::saveAndRestore_1):
+        (tst_QWebHistory::saveAndRestore_2):
+        (tst_QWebHistory::saveAndRestore_3):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the behaviour of QWebHistory::itemAt to interpret the specified index as absolute index.
+
+        Returns an invalid QWebHistoryItem if the index is out of range.
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::itemAt):
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::itemAt):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added a few autotest to QWebHistory.
+
+        * tests/qwebhistory/data/page1.html: Added.
+        * tests/qwebhistory/data/page2.html: Added.
+        * tests/qwebhistory/data/page3.html: Added.
+        * tests/qwebhistory/data/page4.html: Added.
+        * tests/qwebhistory/data/page5.html: Added.
+        * tests/qwebhistory/data/page6.html: Added.
+        * tests/qwebhistory/qwebhistory.pro: Added.
+        * tests/qwebhistory/tst_qwebhistory.cpp: Added.
+        (tst_QWebHistory::):
+        (tst_QWebHistory::tst_QWebHistory):
+        (tst_QWebHistory::~tst_QWebHistory):
+        (tst_QWebHistory::init):
+        (tst_QWebHistory::cleanup):
+        (tst_QWebHistory::title):
+        (tst_QWebHistory::count):
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::goToItem):
+        (tst_QWebHistory::items):
+        * tests/qwebhistory/tst_qwebhistory.qrc: Added.
+        * tests/tests.pro:
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix support for documenting functions prefixed with QWEBKIT_EXPORT
+
+        Add QWEBKIT_EXPORT to the list of macros to ignore by qdoc.
+
+        * docs/qtwebkit.qdocconf:
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Send scrolling events to current focused frame, bubble the event
+        up to parent frame if it is not handled.  Use EventHandler's new
+        shared scrolling code.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::keyPressEvent):
+        (QWebPagePrivate::handleScrolling):
+        * Api/qwebpage_p.h:
+
+2009-06-25  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Add highlight functionality to the QWebPage::findText() method. Introduced is
+        new HighlightAllOccurrences flag which passed to the function will make it mark
+        all existing occurrences of specified string in the page.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::findText):
+        * Api/qwebpage.h:
+        * Api/qwebview.cpp:
+
 2009-06-19  Daniel Teske <qt-info@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
index e60e586..6343b17 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
+++ b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
@@ -146,7 +146,8 @@ Cpp.ignoretokens        = QAXFACTORY_EXPORT \
                           QT_END_NAMESPACE \
                           QT_END_INCLUDE_NAMESPACE \
                           PHONON_EXPORT \
-                          EXTENSIONSYSTEM_EXPORT
+                          EXTENSIONSYSTEM_EXPORT \
+                          QWEBKIT_EXPORT
 Cpp.ignoredirectives    = Q_DECLARE_HANDLE \
                           Q_DECLARE_INTERFACE \
                           Q_DECLARE_METATYPE \
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html
new file mode 100644
index 0000000..82fa4af
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html
@@ -0,0 +1 @@
+<title>page1</title><body><h1>page1</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html
new file mode 100644
index 0000000..5307bdc
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html
@@ -0,0 +1 @@
+<title>page2</title><body><h1>page2</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html
new file mode 100644
index 0000000..4e5547c
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html
@@ -0,0 +1 @@
+<title>page3</title><body><h1>page3</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html
new file mode 100644
index 0000000..3c57aed
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html
@@ -0,0 +1 @@
+<title>page4</title><body><h1>page4</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html
new file mode 100644
index 0000000..8593552
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html
@@ -0,0 +1 @@
+<title>page5</title><body><h1>page5</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html
new file mode 100644
index 0000000..c5bbc6f
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html
@@ -0,0 +1 @@
+<title>page6</title><body><h1>page6</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
new file mode 100644
index 0000000..fd1074c
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -0,0 +1,7 @@
+TEMPLATE = app
+TARGET = tst_qwebhistory
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebhistory.cpp
+RESOURCES  += tst_qwebhistory.qrc
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
new file mode 100644
index 0000000..5b55613
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -0,0 +1,326 @@
+/*
+    Copyright (C) 2008 Holger Hans Peter Freyther
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include "qwebpage.h"
+#include "qwebview.h"
+#include "qwebframe.h"
+#include "qwebhistory.h"
+#include "qdebug.h"
+
+class tst_QWebHistory : public QObject
+{
+    Q_OBJECT
+
+public:
+    tst_QWebHistory();
+    virtual ~tst_QWebHistory();
+
+protected :
+    void loadPage(int nr)
+    {
+        frame->load(QUrl("qrc:/data/page" + QString::number(nr) + ".html"));
+        waitForLoadFinished.exec();
+    }
+
+public slots:
+    void init();
+    void cleanup();
+
+private slots:
+    void title();
+    void count();
+    void back();
+    void forward();
+    void itemAt();
+    void goToItem();
+    void items();
+    void serialize_1(); //QWebHistory countity
+    void serialize_2(); //QWebHistory index
+    void serialize_3(); //QWebHistoryItem
+    void saveAndRestore_1();  //simple checks saveState and restoreState
+    void saveAndRestore_2();  //bad parameters saveState and restoreState
+    void saveAndRestore_3();  //try use different version
+
+private:
+    QWebPage* page;
+    QWebFrame* frame;
+    QWebHistory* hist;
+    QEventLoop waitForLoadFinished;  //operation on history are asynchronous!
+    int histsize;
+};
+
+tst_QWebHistory::tst_QWebHistory()
+{
+}
+
+tst_QWebHistory::~tst_QWebHistory()
+{
+}
+
+void tst_QWebHistory::init()
+{
+    page = new QWebPage(this);
+    frame = page->mainFrame();
+    connect(page, SIGNAL(loadFinished(bool)), &waitForLoadFinished, SLOT(quit()));
+
+    for (int i = 1;i < 6;i++) {
+        loadPage(i);
+    }
+    hist = page->history();
+    histsize = 5;
+}
+
+void tst_QWebHistory::cleanup()
+{
+    delete page;
+}
+
+/**
+  * Check QWebHistoryItem::title() method
+  */
+void tst_QWebHistory::title()
+{
+    QCOMPARE(hist->currentItem().title(), QString("page5"));
+}
+
+/**
+  * Check QWebHistory::count() method
+  */
+void tst_QWebHistory::count()
+{
+    QCOMPARE(hist->count(), histsize);
+}
+
+/**
+  * Check QWebHistory::back() method
+  */
+void tst_QWebHistory::back()
+{
+    for (int i = histsize;i > 1;i--) {
+        QCOMPARE(page->mainFrame()->toPlainText(), QString("page") + QString::number(i));
+        hist->back();
+        waitForLoadFinished.exec();
+    }
+}
+
+/**
+  * Check QWebHistory::forward() method
+  */
+void tst_QWebHistory::forward()
+{
+    //rewind history :-)
+    while (hist->canGoBack()) {
+        hist->back();
+        waitForLoadFinished.exec();
+    }
+
+    for (int i = 1;i < histsize;i++) {
+        QCOMPARE(page->mainFrame()->toPlainText(), QString("page") + QString::number(i));
+        hist->forward();
+        waitForLoadFinished.exec();
+    }
+}
+
+/**
+  * Check QWebHistory::itemAt() method
+  */
+void tst_QWebHistory::itemAt()
+{
+    for (int i = 1;i < histsize;i++) {
+        QCOMPARE(hist->itemAt(i - 1).title(), QString("page") + QString::number(i));
+        QVERIFY(hist->itemAt(i - 1).isValid());
+    }
+    //check out of range values
+    QVERIFY(!hist->itemAt(-1).isValid());
+    QVERIFY(!hist->itemAt(histsize).isValid());
+}
+
+/**
+  * Check QWebHistory::goToItem() method
+  */
+void tst_QWebHistory::goToItem()
+{
+    QWebHistoryItem current = hist->currentItem();
+    hist->back();
+    waitForLoadFinished.exec();
+    hist->back();
+    waitForLoadFinished.exec();
+    QVERIFY(hist->currentItem().title() != current.title());
+    hist->goToItem(current);
+    waitForLoadFinished.exec();
+    QCOMPARE(hist->currentItem().title(), current.title());
+}
+
+/**
+  * Check QWebHistory::items() method
+  */
+void tst_QWebHistory::items() 
+{
+    QList<QWebHistoryItem> items = hist->items();
+    //check count
+    QCOMPARE(histsize, items.count());
+
+    //check order
+    for (int i = 1;i <= histsize;i++) {
+        QCOMPARE(items.at(i - 1).title(), QString("page") + QString::number(i));
+    }
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks history size, history order
+  */
+void tst_QWebHistory::serialize_1() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    QCOMPARE(hist->count(), histsize);
+
+    //check size of history
+    //load next page to find differences
+    loadPage(6);
+    QCOMPARE(hist->count(), histsize + 1);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+    QCOMPARE(hist->count(), histsize);
+
+    //check order of historyItems
+    QList<QWebHistoryItem> items = hist->items();
+    for (int i = 1;i <= histsize;i++) {
+        QCOMPARE(items.at(i - 1).title(), QString("page") + QString::number(i));
+    }
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks history currentIndex value
+  */
+void tst_QWebHistory::serialize_2() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    int oldCurrentIndex = hist->currentItemIndex();
+
+    hist->back();
+    waitForLoadFinished.exec();
+    hist->back();
+    waitForLoadFinished.exec();
+    //check if current index was changed (make sure that it is not last item)
+    QVERIFY(hist->currentItemIndex() != oldCurrentIndex);
+    //save current index
+    oldCurrentIndex = hist->currentItemIndex();
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+
+    //check current index
+    QCOMPARE(hist->currentItemIndex(), oldCurrentIndex);
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks QWebHistoryItem public property after serialization
+  */
+void tst_QWebHistory::serialize_3() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    //prepare two different history items
+    QWebHistoryItem a = hist->currentItem();
+    a.setUserData("A - user data");
+
+    //check properties BEFORE serialization
+    QString title(a.title());
+    QDateTime lastVisited(a.lastVisited());
+    QUrl originalUrl(a.originalUrl());
+    QUrl url(a.url());
+    QVariant userData(a.userData());
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    QVERIFY(!load.atEnd());
+    hist->clear();
+    QVERIFY(hist->count() == 1);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+    QWebHistoryItem b = hist->currentItem();
+
+    //check properties AFTER serialization
+    QCOMPARE(b.title(), title);
+    QCOMPARE(b.lastVisited(), lastVisited);
+    QCOMPARE(b.originalUrl(), originalUrl);
+    QCOMPARE(b.url(), url);
+    QCOMPARE(b.userData(), userData);
+
+    //Check if all data was read
+    QVERIFY(load.atEnd());
+}
+
+/** Simple checks should be a bit redundant to streaming operators */
+void tst_QWebHistory::saveAndRestore_1() 
+{
+    hist->back();
+    waitForLoadFinished.exec();
+    QByteArray buffer(hist->saveState());
+    hist->clear();
+    QVERIFY(hist->count() == 1);
+    hist->restoreState(buffer);
+
+    //check only few values, do not make full test
+    //because most of the code is shared with streaming operators
+    //and these are checked before
+    QCOMPARE(hist->count(), histsize);
+    QCOMPARE(hist->currentItemIndex(), histsize - 2);
+    QCOMPARE(hist->itemAt(0).title(), QString("page1"));
+    QCOMPARE(hist->itemAt(histsize - 1).title(), QString("page") + QString::number(histsize));
+}
+
+/** Check returns value if there are bad parameters. Actually, result
+  * is no so importent. The test shouldn't crash :-) */
+void tst_QWebHistory::saveAndRestore_2() 
+{
+    QByteArray buffer;
+    hist->restoreState(buffer);
+    QVERIFY(hist->count() == 1);
+    QVERIFY(hist->itemAt(0).isValid());
+}
+
+/** Try to use bad version value */
+void tst_QWebHistory::saveAndRestore_3() 
+{
+    QByteArray tmp = hist->saveState((QWebHistory::HistoryStateVersion)29999);
+    QVERIFY(hist->saveState((QWebHistory::HistoryStateVersion)29999).isEmpty());
+    QVERIFY(hist->count() == histsize);
+    QVERIFY(hist->itemAt(3).isValid());
+}
+
+QTEST_MAIN(tst_QWebHistory)
+#include "tst_qwebhistory.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
new file mode 100644
index 0000000..7c5ff0e
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
@@ -0,0 +1,11 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource>
+    <file>data/page1.html</file>
+    <file>data/page2.html</file>    
+    <file>data/page3.html</file>
+    <file>data/page4.html</file>
+    <file>data/page5.html</file>
+    <file>data/page6.html</file>
+</qresource>
+</RCC>
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
index e898ca0..076046f 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
@@ -1,3 +1,3 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview
+SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview qwebhistory