Merge remote branch 'oslo-staging-2/4.7' into qtbug-11996

110 files changed, 1983 insertions, 575 deletions

diff --git a/src/3rdparty/phonon/mmf/abstractaudioeffect.h b/src/3rdparty/phonon/mmf/abstractaudioeffect.h
index 70adcf6..8879636 100644
--- a/src/3rdparty/phonon/mmf/abstractaudioeffect.h
+++ b/src/3rdparty/phonon/mmf/abstractaudioeffect.h
@@ -21,7 +21,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 #include <QScopedPointer>
 
-#include <AudioEffectBase.h>
+#include <audioeffectbase.h>
 
 #include <phonon/effectinterface.h>
 
diff --git a/src/3rdparty/phonon/mmf/abstractmediaplayer.h b/src/3rdparty/phonon/mmf/abstractmediaplayer.h
index 23a8233..7d28caf 100644
--- a/src/3rdparty/phonon/mmf/abstractmediaplayer.h
+++ b/src/3rdparty/phonon/mmf/abstractmediaplayer.h
@@ -71,7 +71,6 @@ protected:
     virtual int openFile(RFile& file) = 0;
     virtual int openUrl(const QString& url) = 0;
     virtual int bufferStatus() const = 0;
-    virtual void close() = 0;
 
     void updateMetaData();
     virtual int numberOfMetaDataEntries() const = 0;
diff --git a/src/3rdparty/phonon/mmf/abstractplayer.h b/src/3rdparty/phonon/mmf/abstractplayer.h
index ab892f5..30d5243 100644
--- a/src/3rdparty/phonon/mmf/abstractplayer.h
+++ b/src/3rdparty/phonon/mmf/abstractplayer.h
@@ -55,6 +55,7 @@ public:
     AbstractPlayer(const AbstractPlayer *player);
 
     virtual void open(const Phonon::MediaSource&, RFile&) = 0;
+    virtual void close() = 0;
 
     // MediaObjectInterface (implemented)
     qint32 tickInterval() const;
diff --git a/src/3rdparty/phonon/mmf/abstractvideooutput.cpp b/src/3rdparty/phonon/mmf/abstractvideooutput.cpp
index a8aabfd..2d221ed 100644
--- a/src/3rdparty/phonon/mmf/abstractvideooutput.cpp
+++ b/src/3rdparty/phonon/mmf/abstractvideooutput.cpp
@@ -60,7 +60,8 @@ MMF::AbstractVideoOutput::AbstractVideoOutput(QWidget *parent)
     ,   m_aspectRatio(DefaultAspectRatio)
     ,   m_scaleMode(DefaultScaleMode)
 {
-
+    // Ensure that this widget has a native window handle
+    winId();
 }
 
 MMF::AbstractVideoOutput::~AbstractVideoOutput()
diff --git a/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp b/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp
index 2e0ab1c..9ea4d18 100644
--- a/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp
+++ b/src/3rdparty/phonon/mmf/abstractvideoplayer.cpp
@@ -66,6 +66,8 @@ void MMF::AbstractVideoPlayer::construct()
 
     createPlayer();
 
+    m_player->RegisterForVideoLoadingNotification(*this);
+
     TRACE_EXIT_0();
 }
 
@@ -211,7 +213,8 @@ void MMF::AbstractVideoPlayer::aspectRatioChanged()
     TRACE_CONTEXT(AbstractVideoPlayer::aspectRatioChanged, EVideoInternal);
     TRACE_ENTRY("state %d aspectRatio %d", state());
 
-    updateScaleFactors(m_videoOutput->videoWindowSize());
+    if (m_videoOutput)
+        updateScaleFactors(m_videoOutput->videoWindowSize());
 
     TRACE_EXIT_0();
 }
@@ -221,7 +224,8 @@ void MMF::AbstractVideoPlayer::scaleModeChanged()
     TRACE_CONTEXT(AbstractVideoPlayer::scaleModeChanged, EVideoInternal);
     TRACE_ENTRY("state %d", state());
 
-    updateScaleFactors(m_videoOutput->videoWindowSize());
+    if (m_videoOutput)
+        updateScaleFactors(m_videoOutput->videoWindowSize());
 
     TRACE_EXIT_0();
 }
@@ -357,6 +361,8 @@ void MMF::AbstractVideoPlayer::videoOutputChanged()
 
 void MMF::AbstractVideoPlayer::initVideoOutput()
 {
+    Q_ASSERT(m_videoOutput);
+
     bool connected = connect(
         m_videoOutput, SIGNAL(videoWindowChanged()),
         this, SLOT(videoWindowChanged())
@@ -378,9 +384,6 @@ void MMF::AbstractVideoPlayer::initVideoOutput()
     // Suppress warnings in release builds
     Q_UNUSED(connected);
 
-    // Do these after all connections are complete, to ensure
-    // that any signals generated get to their destinations.
-    m_videoOutput->winId();
     m_videoOutput->setVideoSize(m_videoFrameSize);
 }
 
@@ -400,6 +403,8 @@ QSize scaleToAspect(const QSize &srcRect, int aspectWidth, int aspectHeight)
 
 void MMF::AbstractVideoPlayer::updateScaleFactors(const QSize &windowSize, bool apply)
 {
+    Q_ASSERT(m_videoOutput);
+
     if (m_videoFrameSize.isValid()) {
         QRect videoRect;
 
diff --git a/src/3rdparty/phonon/mmf/audioequalizer.cpp b/src/3rdparty/phonon/mmf/audioequalizer.cpp
index 1d2bbd4..28433f6 100644
--- a/src/3rdparty/phonon/mmf/audioequalizer.cpp
+++ b/src/3rdparty/phonon/mmf/audioequalizer.cpp
@@ -16,7 +16,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 */
 
-#include <AudioEqualizerBase.h>
+#include <audioequalizerbase.h>
 #include "audioequalizer.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/bassboost.cpp b/src/3rdparty/phonon/mmf/bassboost.cpp
index 67076f6..81d9208 100644
--- a/src/3rdparty/phonon/mmf/bassboost.cpp
+++ b/src/3rdparty/phonon/mmf/bassboost.cpp
@@ -16,7 +16,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 */
 
-#include <BassBoostBase.h>
+#include <bassboostbase.h>
 #include "bassboost.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/dummyplayer.cpp b/src/3rdparty/phonon/mmf/dummyplayer.cpp
index 6970088..d39ef76 100644
--- a/src/3rdparty/phonon/mmf/dummyplayer.cpp
+++ b/src/3rdparty/phonon/mmf/dummyplayer.cpp
@@ -97,6 +97,10 @@ void MMF::DummyPlayer::open(const Phonon::MediaSource &, RFile &)
 
 }
 
+void MMF::DummyPlayer::close()
+{
+
+}
 
 //-----------------------------------------------------------------------------
 // AbstractPlayer
diff --git a/src/3rdparty/phonon/mmf/dummyplayer.h b/src/3rdparty/phonon/mmf/dummyplayer.h
index 6841b5d..9d45696 100644
--- a/src/3rdparty/phonon/mmf/dummyplayer.h
+++ b/src/3rdparty/phonon/mmf/dummyplayer.h
@@ -58,6 +58,7 @@ public:
 
     // AbstractPlayer
     virtual void open(const Phonon::MediaSource&, RFile&);
+    virtual void close();
     virtual void doSetTickInterval(qint32 interval);
 };
 }
diff --git a/src/3rdparty/phonon/mmf/environmentalreverb.cpp b/src/3rdparty/phonon/mmf/environmentalreverb.cpp
index d4f5223..c500385 100644
--- a/src/3rdparty/phonon/mmf/environmentalreverb.cpp
+++ b/src/3rdparty/phonon/mmf/environmentalreverb.cpp
@@ -16,7 +16,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 */
 
-#include <EnvironmentalReverbBase.h>
+#include <environmentalreverbbase.h>
 #include "environmentalreverb.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/loudness.cpp b/src/3rdparty/phonon/mmf/loudness.cpp
index ca05ab0..22d7518 100644
--- a/src/3rdparty/phonon/mmf/loudness.cpp
+++ b/src/3rdparty/phonon/mmf/loudness.cpp
@@ -16,7 +16,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 */
 
-#include <LoudnessBase.h>
+#include <loudnessbase.h>
 #include "loudness.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/mediaobject.cpp b/src/3rdparty/phonon/mmf/mediaobject.cpp
index e1b921b..d264377 100644
--- a/src/3rdparty/phonon/mmf/mediaobject.cpp
+++ b/src/3rdparty/phonon/mmf/mediaobject.cpp
@@ -281,6 +281,9 @@ void MMF::MediaObject::createPlayer(const MediaSource &source)
         break;
     }
 
+    if (oldPlayer)
+        oldPlayer->close();
+
     AbstractPlayer* newPlayer = 0;
 
     // Construct newPlayer using oldPlayer (if not 0) in order to copy
diff --git a/src/3rdparty/phonon/mmf/stereowidening.cpp b/src/3rdparty/phonon/mmf/stereowidening.cpp
index f90651b..e452160 100644
--- a/src/3rdparty/phonon/mmf/stereowidening.cpp
+++ b/src/3rdparty/phonon/mmf/stereowidening.cpp
@@ -16,7 +16,7 @@ along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 */
 
-#include <StereoWideningBase.h>
+#include <stereowideningbase.h>
 #include "stereowidening.h"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
index 1925471..deb9774 100644
--- a/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
+++ b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
@@ -61,6 +61,8 @@ DsaVideoPlayer::~DsaVideoPlayer()
 
 void MMF::DsaVideoPlayer::videoWindowScreenRectChanged()
 {
+    Q_ASSERT(m_videoOutput);
+
     QRect windowRect = static_cast<DsaVideoOutput *>(m_videoOutput)->videoWindowScreenRect();
 
     // Clip to physical window size
@@ -124,12 +126,12 @@ void MMF::DsaVideoPlayer::createPlayer()
 
     // CVideoPlayerUtility::NewL starts DSA
     m_dsaActive = true;
-
-    m_player->RegisterForVideoLoadingNotification(*this);
 }
 
 void MMF::DsaVideoPlayer::initVideoOutput()
 {
+    Q_ASSERT(m_videoOutput);
+
     bool connected = connect(
         m_videoOutput, SIGNAL(videoWindowScreenRectChanged()),
         this, SLOT(videoWindowScreenRectChanged())
@@ -156,7 +158,8 @@ void MMF::DsaVideoPlayer::initVideoOutput()
 
 void MMF::DsaVideoPlayer::prepareCompleted()
 {
-    videoWindowScreenRectChanged();
+    if (m_videoOutput)
+        videoWindowScreenRectChanged();
 }
 
 void MMF::DsaVideoPlayer::handleVideoWindowChanged()
diff --git a/src/3rdparty/phonon/mmf/videoplayer_surface.cpp b/src/3rdparty/phonon/mmf/videoplayer_surface.cpp
index fda7342..f380e69 100644
--- a/src/3rdparty/phonon/mmf/videoplayer_surface.cpp
+++ b/src/3rdparty/phonon/mmf/videoplayer_surface.cpp
@@ -59,7 +59,8 @@ SurfaceVideoPlayer::~SurfaceVideoPlayer()
 
 void MMF::SurfaceVideoPlayer::videoWindowSizeChanged()
 {
-    updateScaleFactors(m_videoOutput->videoWindowSize());
+    if (m_videoOutput)
+        updateScaleFactors(m_videoOutput->videoWindowSize());
 }
 
 
@@ -80,6 +81,8 @@ void MMF::SurfaceVideoPlayer::createPlayer()
 
 void MMF::SurfaceVideoPlayer::initVideoOutput()
 {
+    Q_ASSERT(m_videoOutput);
+
     bool connected = connect(
         m_videoOutput, SIGNAL(videoWindowSizeChanged()),
         this, SLOT(videoWindowSizeChanged())
@@ -104,6 +107,9 @@ void MMF::SurfaceVideoPlayer::handleVideoWindowChanged()
 
 void MMF::SurfaceVideoPlayer::handleParametersChanged(VideoParameters parameters)
 {
+    TRACE_CONTEXT(SurfaceVideoPlayer::handleParametersChanged, EVideoApi);
+    TRACE_ENTRY("parameters 0x%x", parameters.operator int());
+
     TRect rect;
     if (m_videoOutput) {
         m_videoOutput->dump();
@@ -115,23 +121,14 @@ void MMF::SurfaceVideoPlayer::handleParametersChanged(VideoParameters parameters
     if (player) {
         int err = KErrNone;
         if (parameters & WindowHandle) {
-            if (m_displayWindow)
-                player->RemoveDisplayWindow(*m_displayWindow);
-
-            RWindow *window = static_cast<RWindow *>(m_window);
-            if (window) {
-                window->SetBackgroundColor(TRgb(0, 0, 0, 255));
-                TRAP(err, player->AddDisplayWindowL(m_wsSession, m_screenDevice, *window, rect, rect));
-                if (KErrNone != err) {
-                    setError(tr("Video display error"), err);
-                    window = 0;
-                }
-            }
-            m_displayWindow = window;
+            removeDisplayWindow();
+            addDisplayWindow(rect);
         }
 
         if (KErrNone == err) {
             if (parameters & ScaleFactors) {
+                if (!m_displayWindow)
+                    addDisplayWindow(rect);
                 Q_ASSERT(m_displayWindow);
                 TRAP(err, player->SetVideoExtentL(*m_displayWindow, rect));
                 if (KErrNone == err)
@@ -143,6 +140,45 @@ void MMF::SurfaceVideoPlayer::handleParametersChanged(VideoParameters parameters
             }
         }
     }
+
+    TRACE_EXIT_0();
+}
+
+void MMF::SurfaceVideoPlayer::addDisplayWindow(const TRect &rect)
+{
+    TRACE_CONTEXT(SurfaceVideoPlayer::addDisplayWindow, EVideoApi);
+    TRACE_ENTRY("rect %d %d - %d %d", rect.iTl.iX, rect.iTl.iY, rect.iBr.iX, rect.iBr.iY);
+
+    Q_ASSERT(!m_displayWindow);
+    RWindow *window = static_cast<RWindow *>(m_window);
+
+    TRACE("window 0x%08x", window);
+
+    if (window) {
+        window->SetBackgroundColor(TRgb(0, 0, 0, 255));
+        CVideoPlayerUtility2 *player = static_cast<CVideoPlayerUtility2 *>(m_player.data());
+        Q_ASSERT(player);
+        TRAPD(err, player->AddDisplayWindowL(m_wsSession, m_screenDevice, *window, rect, rect));
+        if (KErrNone == err)
+            m_displayWindow = window;
+        else
+            setError(tr("Video display error"), err);
+	TRACE("err %d", err);
+    }
+
+    TRACE_EXIT_0();
+}
+
+void MMF::SurfaceVideoPlayer::removeDisplayWindow()
+{
+    TRACE_CONTEXT(SurfaceVideoPlayer::removeDisplayWindow, EVideoApi);
+    TRACE("player 0x%08x window 0x%08x", m_player.data(), m_displayWindow);
+
+    CVideoPlayerUtility2 *player = static_cast<CVideoPlayerUtility2 *>(m_player.data());
+    if (player && m_displayWindow) {
+        player->RemoveDisplayWindow(*m_displayWindow);
+        m_displayWindow = 0;
+    }
 }
 
 QT_END_NAMESPACE
diff --git a/src/3rdparty/phonon/mmf/videoplayer_surface.h b/src/3rdparty/phonon/mmf/videoplayer_surface.h
index c05da9c..8572fdc 100644
--- a/src/3rdparty/phonon/mmf/videoplayer_surface.h
+++ b/src/3rdparty/phonon/mmf/videoplayer_surface.h
@@ -62,6 +62,9 @@ private:
     void handleVideoWindowChanged();
     void handleParametersChanged(VideoParameters parameters);
 
+    void addDisplayWindow(const TRect &rect);
+    void removeDisplayWindow();
+
 private:
     // Window handle which has been passed to the MMF via
     // CVideoPlayerUtility2::SetDisplayWindowL
diff --git a/src/3rdparty/sqlite/sqlite3.c b/src/3rdparty/sqlite/sqlite3.c
index 46d3dfc..27a8d18 100644
--- a/src/3rdparty/sqlite/sqlite3.c
+++ b/src/3rdparty/sqlite/sqlite3.c
@@ -48449,11 +48449,15 @@ SQLITE_PRIVATE void sqlite3VdbeIOTraceSql(Vdbe *p){
 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
 
 /*
-** Allocate space from a fixed size buffer.  Make *pp point to the
-** allocated space.  (Note:  pp is a char* rather than a void** to
-** work around the pointer aliasing rules of C.)  *pp should initially
-** be zero.  If *pp is not zero, that means that the space has already
-** been allocated and this routine is a noop.
+** Allocate space from a fixed size buffer and return a pointer to
+** that space.  If insufficient space is available, return NULL.
+**
+** The pBuf parameter is the initial value of a pointer which will
+** receive the new memory.  pBuf is normally NULL.  If pBuf is not
+** NULL, it means that memory space has already been allocated and that
+** this routine should not allocate any new memory.  When pBuf is not
+** NULL simply return pBuf.  Only allocate new memory space when pBuf
+** is NULL.
 **
 ** nByte is the number of bytes of space needed.
 **
@@ -48464,23 +48468,23 @@ SQLITE_PRIVATE void sqlite3VdbeIOTraceSql(Vdbe *p){
 ** to allocate.  If there is insufficient space in *ppFrom to satisfy the
 ** request, then increment *pnByte by the amount of the request.
 */
-static void allocSpace(
-  char *pp,            /* IN/OUT: Set *pp to point to allocated buffer */
+static void *allocSpace(
+  void *pBuf,          /* Where return pointer will be stored */
   int nByte,           /* Number of bytes to allocate */
   u8 **ppFrom,         /* IN/OUT: Allocate from *ppFrom */
   u8 *pEnd,            /* Pointer to 1 byte past the end of *ppFrom buffer */
   int *pnByte          /* If allocation cannot be made, increment *pnByte */
 ){
   assert( EIGHT_BYTE_ALIGNMENT(*ppFrom) );
-  if( (*(void**)pp)==0 ){
-    nByte = ROUND8(nByte);
-    if( &(*ppFrom)[nByte] <= pEnd ){
-      *(void**)pp = (void *)*ppFrom;
-      *ppFrom += nByte;
-    }else{
-      *pnByte += nByte;
-    }
+  if( pBuf ) return pBuf;
+  nByte = ROUND8(nByte);
+  if( &(*ppFrom)[nByte] <= pEnd ){
+    pBuf = (void*)*ppFrom;
+    *ppFrom += nByte;
+  }else{
+    *pnByte += nByte;
   }
+  return pBuf;
 }
 
 /*
@@ -48553,13 +48557,12 @@ SQLITE_PRIVATE void sqlite3VdbeMakeReady(
 
     do {
       nByte = 0;
-      allocSpace((char*)&p->aMem, nMem*sizeof(Mem), &zCsr, zEnd, &nByte);
-      allocSpace((char*)&p->aVar, nVar*sizeof(Mem), &zCsr, zEnd, &nByte);
-      allocSpace((char*)&p->apArg, nArg*sizeof(Mem*), &zCsr, zEnd, &nByte);
-      allocSpace((char*)&p->azVar, nVar*sizeof(char*), &zCsr, zEnd, &nByte);
-      allocSpace((char*)&p->apCsr, 
-                 nCursor*sizeof(VdbeCursor*), &zCsr, zEnd, &nByte
-      );
+      p->aMem = allocSpace(p->aMem, nMem*sizeof(Mem), &zCsr, zEnd, &nByte);
+      p->aVar = allocSpace(p->aVar, nVar*sizeof(Mem), &zCsr, zEnd, &nByte);
+      p->apArg = allocSpace(p->apArg, nArg*sizeof(Mem*), &zCsr, zEnd, &nByte);
+      p->azVar = allocSpace(p->azVar, nVar*sizeof(char*), &zCsr, zEnd, &nByte);
+      p->apCsr = allocSpace(p->apCsr, nCursor*sizeof(VdbeCursor*),
+                            &zCsr, zEnd, &nByte);
       if( nByte ){
         p->pFree = sqlite3DbMallocZero(db, nByte);
       }
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index 0b824b7..1d1c8ed 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-d59845f6fec84f15da116f50a1a0e52ce26116e9
+ad96ca2f9b57271da4ea7432022ac686ee0981c2
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index c970745..2e5ebd0 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        d59845f6fec84f15da116f50a1a0e52ce26116e9
+        ad96ca2f9b57271da4ea7432022ac686ee0981c2
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index a4ae758..a993a97 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,505 @@
+2010-05-14  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Move the m_width(Length) and m_columns(RenderTable::ColumnStruct)
+        vector out-of-bounds check out of the ASSERT into the main code.
+        https://bugs.webkit.org/show_bug.cgi?id=38261
+
+        Test: fast/table/fixed-table-layout-large-colspan-crash.html
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+
+2010-05-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8009118> Crash in WebCore::toAlphabetic() 
+        while running MangleMe
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=39508
+
+        The math was slightly off here, and we wound up trying to access an 
+        array at index -1 in some cases. We need to decrement numberShadow 
+        rather than subtracting one from the result of the modulo 
+        operation.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toAlphabeticOrNumeric):
+
+2010-05-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/8007953> Textarea using custom font appears blank
+
+        Test: fast/css/font-face-in-shadow-DOM.html
+
+        When a remote font is loaded, CSSFontSelector forces a style recalc, which replaces all
+        RenderSyles that have FontFallbackLists referencing the placeholder font with fresh
+        RenderStyles. However, it does not descend into shadow DOM trees, so those may end up with
+        styles that still reference the placeholder font.
+
+        The fix is to add RenderObject::requiresForcedStyleRecalcPropagation() and have it return
+        true from renderers that maintain shadow DOM trees or otherwise keep their own RenderStyles.
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Check if forced style recalc needs to propagated.
+        * rendering/RenderButton.h:
+        (WebCore::RenderButton::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderFileUploadControl.h:
+        (WebCore::RenderFileUploadControl::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderListItem.h:
+        (WebCore::RenderListItem::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderMenuList.h:
+        (WebCore::RenderMenuList::RenderMenuList::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderProgress.h:
+        (WebCore::RenderProgress::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderSlider.h:
+        (WebCore::RenderSlider::requiresForcedStyleRecalcPropagation):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::requiresForcedStyleRecalcPropagation):
+
+2010-04-02  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        XHR allows arbitrary XSRF across domains 
+        https://bugs.webkit.org/show_bug.cgi?id=36843
+
+        Added a one-line change to prevent bypassing the XDC check on
+        synchronous preflighted requests. Added layout tests to cover
+        variations of this problem.
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-async-header-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-async-method-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-sync-header-denied.html
+               http/tests/xmlhttprequest/access-control-preflight-sync-method-denied.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::preflightFailure):
+
+2010-04-28  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [XHR] Cross-Origin synchronous request with credential raises NETWORK_ERR
+        https://bugs.webkit.org/show_bug.cgi?id=37781
+        <rdar://problem/7905150>
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-credential-async.html
+               http/tests/xmlhttprequest/access-control-preflight-credential-sync.html
+
+        Rolling the patch in as I could not reproduce Qt results locally.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Now we remove the
+        credential from the request here to avoid forgetting to do so in the different code path.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Just add the
+        "Origin" header.
+        (WebCore::DocumentThreadableLoader::loadRequest): Check here the the credential have
+        been removed so that we don't leak them. Also tweaked a comment to make it clear that
+        the URL check has issue when credential is involved.
+
+2010-04-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Declare CFURLConnectionCreateWithProperties
+        for now, as it's mistakenly missing from WebKitSupportLibrary headers.
+
+2010-05-19  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Check that the node is a text node before doing a static cast
+        to a Text class pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=38626    
+
+        Test: fast/text/text-transform-nontext-node-crash.xhtml
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
+
+2010-05-12  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTML Entity Escape the contents of a textarea node when accessed
+        via the innerHTML and outerHTML node properties.
+        https://bugs.webkit.org/show_bug.cgi?id=38922
+
+        Test: fast/innerHTML/innerHTML-special-elements.html
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup):
+
+2010-05-12  James Robinson  <jamesr@chromium.org>
+
+        Patch by Dan Bernstein.
+
+        Reviewed by David Hyatt.
+
+        Fix marking the layout root's parent as needing layout
+        https://bugs.webkit.org/show_bug.cgi?id=37760
+
+        If an element gets marked as needing layout due to the recalcStyle()
+        call in FrameView::layout(), the m_layoutSchedulingEnabled flag will
+        be set to false.  It's possible at this point that a parent of the
+        existing FrameView::m_layoutRoot will be marked as needing layout.
+
+        This patch updates FrameView::scheduleRelayoutOfSubtree to account
+        for this case.
+
+        Manual test only due to subtle timing issues.
+
+        * manual-tests/layoutroot_detach.xml: Added.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
+
+2010-05-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=38583
+        <rdar://problem/7948784> Crash in Element::normalizeAttributes.
+
+        Test: fast/dom/Element/normalize-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::normalizeAttributes): Copy attributes to a vector
+        before iterating.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::copyAttributesToVector): Added.
+        * dom/NamedAttrMap.h:
+
+2010-05-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Based on a patch by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28697
+        <rdar://problem/7946578> WebKit crash on WebCore::Node::nodeIndex()
+
+        It's not OK to call ContainerNode::willRemoveChild() in a loop, because Range code assumes
+        that it can adjust start and end position to any node except for the one being removed -
+        so these notifications cannot be batched.
+
+        Test: fast/dom/Range/remove-all-children-crash.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChild): Removed unused ExceptionCode.
+        (WebCore::willRemoveChildren): New function, used in removeChildren() case.
+        (WebCore::ContainerNode::removeChild): ExceptionCode return was always 0, don't bother with it.
+        (WebCore::ContainerNode::removeChildren): Call willRemoveChildrenFromNode.
+        (WebCore::dispatchChildRemovalEvents): Moved some logic out into willRemoveChildrenFromNode
+        and willRemoveChild.
+
+        * dom/Document.cpp:
+        (WebCore::Document::nodeChildrenWillBeRemoved): New function, used in removeChildren() case.
+
+        * dom/Document.h: 
+        (WebCore::Document::nodeChildrenWillBeRemoved): New function, used in removeChildren() case.
+
+        * dom/Range.h:
+        * dom/Range.cpp:
+        (WebCore::boundaryNodeChildrenWillBeRemoved): New function, used in removeChildren() case.
+        (WebCore::Range::nodeChildrenWillBeRemoved): Ditto.
+
+2010-05-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38497
+        <rdar://problem/7759438> Make sure that http URLs always have a host in SecurityOrigin
+
+        This is a hardening fix, and behavior really depends on what an underlying networking layer
+        does. So, no test.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::schemeRequiresAuthority): List schemes that need an authority for successful loading.
+        (WebCore::SecurityOrigin::SecurityOrigin): Never let e.g. http origins with empty authorities
+        have the same security origin.
+
+2010-05-03  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for controlling clipboard access from javascript.
+        Clipboard access from javascript is disabled by default.
+        https://bugs.webkit.org/show_bug.cgi?id=27751
+
+        Test: editing/execCommand/clipboard-access.html
+
+        * WebCore.base.exp:
+        * editing/EditorCommand.cpp:
+        (WebCore::supportedCopyCut):
+        (WebCore::supportedPaste):
+        (WebCore::createCommandMap):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setJavaScriptCanAccessClipboard):
+        * page/Settings.h:
+        (WebCore::Settings::javaScriptCanAccessClipboard):
+
+2010-04-30  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Convert m_documentUnderMouse, m_dragInitiator to RefPtr.
+        Eliminated unused m_dragInitiator accessor to prevent dereferencing.
+        https://bugs.webkit.org/show_bug.cgi?id=37618
+
+        Test: editing/pasteboard/drag-drop-iframe-refresh-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+        * page/DragController.h:
+        (WebCore::DragController::draggingImageURL):
+        (WebCore::DragController::documentUnderMouse):
+
+2010-04-14  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Javascript URL can be set as iframe.src via multiple DOM aliases
+        https://bugs.webkit.org/show_bug.cgi?id=37031
+
+        Moved frame/iframe checks from Attr to Node on inherited members.
+        Node child manipulation methods now return NOT_SUPPORTED_ERR if used
+        on a frame/iframe src attribute.
+        NamedNodeMap set methods now perform frame/iframe src checks.
+        Moved allowSettingSrcToJavascriptURL static helper function from 
+        JSElementCustom.cpp to exported function in JSDOMBinding.h.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::setNamedItem):
+        (WebCore::JSNamedNodeMap::setNamedItemNS):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::isAttrFrameSrc):
+        (WebCore::JSNode::setNodeValue):
+        (WebCore::JSNode::setTextContent):
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::V8NamedNodeMap::setNamedItemNSCallback):
+        (WebCore::V8NamedNodeMap::setNamedItemCallback):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::isFrameSrc):
+        (WebCore::V8Node::textContentAccessorSetter):
+        (WebCore::V8Node::nodeValueAccessorSetter):
+        (WebCore::V8Node::insertBeforeCallback):
+        (WebCore::V8Node::replaceChildCallback):
+        (WebCore::V8Node::removeChildCallback):
+        (WebCore::V8Node::appendChildCallback):
+        * dom/Attr.idl:
+        * dom/NamedNodeMap.idl:
+        * dom/Node.idl:
+
+2010-03-26  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Security: iFrame.src accepts JavaScript URL via nodeValue or textContent
+        https://bugs.webkit.org/show_bug.cgi?id=36502
+
+        Overrode inherited nodeValue and textContent in Attr.idl so they proxy 
+        to value, which performs a security check.
+
+        Test: http/tests/security/xss-DENIED-iframe-src-alias.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::nodeValue):
+        (WebCore::JSAttr::setNodeValue):
+        (WebCore::JSAttr::textContent):
+        (WebCore::JSAttr::setTextContent):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::V8Attr::nodeValueAccessorSetter):
+        (WebCore::V8Attr::nodeValueAccessorGetter):
+        (WebCore::V8Attr::textContentAccessorSetter):
+        (WebCore::V8Attr::textContentAccessorGetter):
+        * dom/Attr.idl:
+
+2010-05-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38260
+        <rdar://problem/7917548> Fix whitespace removing in deprecatedParseURL().
+
+        Broken all the way since r4 (yes, that's a revision number).
+
+        Test: http/tests/security/xss-DENIED-javascript-with-spaces.html
+
+        * css/CSSHelper.cpp: (WebCore::deprecatedParseURL): Fixed loop conditions for remaining length.
+
+2010-04-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7898436> :after content is duplicated
+
+        Test: fast/css-generated-content/after-duplicated-after-split.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines): Pass the correct owner of the child list.
+
+2010-03-30  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Taint the canvas if an SVG-derived pattern is rendered into it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36838
+
+        Test: fast/canvas/svg-taint.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createPattern):
+          Take into account the image's hasSingleSecurityOrigin() property.
+
+2010-04-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darinn Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37230
+        <rdar://problem/7813115> REGRESSION (4.0.5): Safari asks for credentials all the time when
+        authenticating to Windows IIS Server
+
+        * platform/network/ProtectionSpace.h: (WebCore::ProtectionSpaceAuthenticationScheme): Added
+        a constant for ProtectionSpaceAuthenticationSchemeUnknown.
+
+        * platform/network/cf/AuthenticationCF.cpp: (WebCore::core):
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: (WebCore::authenticationSchemeFromAuthenticationMethod):
+        Return ProtectionSpaceAuthenticationSchemeUnknown for unknown scheme.
+
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Support NTLM on systems older than 10.6. We actually get this string from
+        NSURLConnection, even though there was no public constant.
+        (WebCore::core): Return ProtectionSpaceAuthenticationSchemeUnknown for unknown scheme.
+
+2010-04-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make the fix for <rdar://problem/7873647> from r57759 more robust.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateHoverActiveState): Use RefPtrs for the Nodes.
+
+2010-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7873647> Crash when updating hover state
+
+        Test: fast/dynamic/hover-style-recalc-crash.html
+
+        Updating the hover state of an element caused the document to need style
+        recalc, and then updating the hover state of a link caused style recalc,
+        which changed the render tree while updateHoverActiveState() was iterating
+        over it, leading to a crash.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateHoverActiveState): Collect the nodes to be
+        updated into vectors, then update their active and hover states.
+
+2010-03-31  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <http://webkit.org/b/36878> REGRESSION: Trailing colon on hostnames (with no port specified) causes "Not allowed to use restricted network port"
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Explicitly handle the case of a colon being present in the URL after the host name but with
+        no port number before the path.  This is handled in the same manner as the colon and port being omitted completely.
+
+2010-03-24  Mark Rowe  <mrowe@apple.com>
+
+        Revert the portion of r56489 that dealt with port zero as it introduced some test failures.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Use the "ok" argument to charactersToUIntStrict to determine whether
+        it was able to successfully parse the string as an unsigned integer, rather than relying on
+        the fact it returned zero when it failed.
+
+2010-03-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit should treat port numbers outside the valid range as being blacklisted
+        <http://webkit.org/b/36571> / <rdar://problem/7790908>
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::port): Map invalid port numbers to invalidPortNumber.
+        (WebCore::portAllowed): Add invalidPortNumber to the blacklist.
+        * platform/KURLGoogle.cpp:  invalid port numbers to invalidPortNumber.
+        (WebCore::KURL::port): Add invalidPortNumber to the blacklist.
+        Also bring this in to sync with KURL.  Having this identical code in two places is stupid.
+
+2010-05-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26824
+        <rdar://problem/7018610> EventHandler can operate on a wrong frame if focus changes during
+        keyboard event dispatch.
+
+        EventHandler object is tied to a frame, so it's wrong for it to continue processing a keyboard
+        event if focused frame changes between keydown and keypress.
+
+        * manual-tests/focus-change-between-key-events.html: Added.
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::keyEvent): Bail out early if focused frame
+        changes while dispatching keydown. Also made similar changes for Windows to maintain matching
+        behavior, even though EventHandler was re-entered anyway due to WM_KEYDOWN and WM_CHAR being
+        separate events.
+
+2010-07-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Canvas arcTo() should draw straight line to p1 if p0, p1 and p2 are collinear
+
+        The implementation of PathQt's addArcTo() was not float-safe and also had
+        a case where it drew an 'infinite' line, which is not part of the spec.
+
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-arcto
+
+        We now use qFuzzyCompare() in both cases. The method isPointOnPathBorder()
+        also had the same problem, and was refactored a bit in the process of fixing
+        the bug.
+
+        Initial patch by Andreas Kling.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41412
+
+        * platform/graphics/qt/PathQt.cpp:
+
 2010-03-26  Shu Chang  <chang.shu@nokia.com>
 
         Reviewed by Eric Seidel.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index 3c01535..4cd40ac 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -33,6 +33,7 @@
 #include "Document.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -46,13 +47,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
-    if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
-            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
-                return;
-        }
-    }
+    if (ownerElement && !allowSettingSrcToJavascriptURL(exec, ownerElement, imp->name(), attrValue))
+        return;
 
     ExceptionCode ec = 0;
     imp->setValue(attrValue, ec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index f294dad..393c1ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -24,6 +24,7 @@
 #include "debugger/DebuggerCallFrame.h"
 
 #include "ActiveDOMObject.h"
+#include "CSSHelper.h"
 #include "DOMCoreException.h"
 #include "DOMObjectHashTableMap.h"
 #include "Document.h"
@@ -33,6 +34,7 @@
 #include "Frame.h"
 #include "HTMLAudioElement.h"
 #include "HTMLCanvasElement.h"
+#include "HTMLFrameElementBase.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "HTMLScriptElement.h"
@@ -630,6 +632,16 @@ bool shouldAllowNavigation(ExecState* exec, Frame* frame)
     return lexicalFrame && lexicalFrame->loader()->shouldAllowNavigation(frame);
 }
 
+bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
+{
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
+          Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+          if (contentDocument && !checkNodeSecurity(exec, contentDocument))
+              return false;
+      }
+      return true;
+}
+
 void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 219472b..40f7e40 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -301,6 +301,8 @@ namespace WebCore {
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
     bool shouldAllowNavigation(JSC::ExecState*, Frame*);
+    bool allowSettingSrcToJavascriptURL(JSC::ExecState*, Element*, const String&, const String&);
+
     void printErrorMessageForFrame(Frame*, const String& message);
     JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, JSC::JSValue, const JSC::Identifier& propertyName);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index c725290..94012fd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -36,6 +36,7 @@
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
 #include "JSAttr.h"
+#include "JSDOMBinding.h"
 #include "JSHTMLElementWrapperFactory.h"
 #include "JSNodeList.h"
 #include "NodeList.h"
@@ -63,16 +64,6 @@ void JSElement::markChildren(MarkStack& markStack)
         markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
 }
 
-static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
-{
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
-        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
-            return false;
-    }
-    return true;
-}
-
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 13f3628..965498a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -35,6 +35,38 @@ using namespace JSC;
 
 namespace WebCore {
 
+JSValue JSNamedNodeMap::setNamedItem(ExecState* exec, const ArgList& args)
+{
+    NamedNodeMap* imp = static_cast<NamedNodeMap*>(impl());
+    ExceptionCode ec = 0;
+    Node* newNode = toNode(args.at(0));
+
+    if (newNode && newNode->nodeType() == Node::ATTRIBUTE_NODE && imp->element()) {
+        if (!allowSettingSrcToJavascriptURL(exec, imp->element(), newNode->nodeName(), newNode->nodeValue()))
+            return jsNull();
+    }
+
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(imp->setNamedItem(newNode, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSNamedNodeMap::setNamedItemNS(ExecState* exec, const ArgList& args)
+{
+    NamedNodeMap* imp = static_cast<NamedNodeMap*>(impl());
+    ExceptionCode ec = 0;
+    Node* newNode = toNode(args.at(0));
+
+    if (newNode && newNode->nodeType() == Node::ATTRIBUTE_NODE && imp->element()) {
+        if (!allowSettingSrcToJavascriptURL(exec, imp->element(), newNode->nodeName(), newNode->nodeValue()))
+            return jsNull();
+    }
+
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(imp->setNamedItemNS(newNode, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
 bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Identifier& propertyName)
 {
     return impl->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 134c581..bf6c633 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSAttr.h"
 #include "JSCDATASection.h"
 #include "JSComment.h"
+#include "JSDOMBinding.h"
 #include "JSDocument.h"
 #include "JSDocumentFragment.h"
 #include "JSDocumentType.h"
@@ -66,12 +67,53 @@ using namespace JSC;
 
 namespace WebCore {
 
-typedef int ExpectionCode;
+static inline bool isAttrFrameSrc(Element *element, const String& name)
+{
+    return element && (element->hasTagName(HTMLNames::iframeTag) || element->hasTagName(HTMLNames::frameTag)) && equalIgnoringCase(name, "src");
+}
+
+void JSNode::setNodeValue(JSC::ExecState* exec, JSC::JSValue value)
+{
+    Node* imp = static_cast<Node*>(impl());
+    String nodeValue = valueToStringWithNullCheck(exec, value);
+
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE) {
+        Element* ownerElement = static_cast<Attr*>(impl())->ownerElement();
+        if (ownerElement && !allowSettingSrcToJavascriptURL(exec, ownerElement, imp->nodeName(), nodeValue))
+            return;
+    }
+
+    ExceptionCode ec = 0;
+    imp->setNodeValue(nodeValue, ec);
+    setDOMException(exec, ec);
+}
+
+void JSNode::setTextContent(JSC::ExecState* exec, JSC::JSValue value)
+{
+    Node* imp = static_cast<Node*>(impl());
+    String nodeValue = valueToStringWithNullCheck(exec, value);
+
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE) {
+        Element* ownerElement = static_cast<Attr*>(impl())->ownerElement();
+        if (ownerElement && !allowSettingSrcToJavascriptURL(exec, ownerElement, imp->nodeName(), nodeValue))
+            return;
+    }
+
+    ExceptionCode ec = 0;
+    imp->setTextContent(nodeValue, ec);
+    setDOMException(exec, ec);
+}
 
 JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 {
+    Node* imp = static_cast<Node*>(impl());
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE && isAttrFrameSrc(static_cast<Attr*>(impl())->ownerElement(), imp->nodeName())) {
+        setDOMException(exec, NOT_SUPPORTED_ERR);
+        return jsNull();
+    }
+
     ExceptionCode ec = 0;
-    bool ok = impl()->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
+    bool ok = imp->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
         return args.at(0);
@@ -80,8 +122,14 @@ JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 {
+    Node* imp = static_cast<Node*>(impl());
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE && isAttrFrameSrc(static_cast<Attr*>(impl())->ownerElement(), imp->nodeName())) {
+        setDOMException(exec, NOT_SUPPORTED_ERR);
+        return jsNull();
+    }
+
     ExceptionCode ec = 0;
-    bool ok = impl()->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
+    bool ok = imp->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
         return args.at(1);
@@ -90,8 +138,14 @@ JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 {
+    Node* imp = static_cast<Node*>(impl());
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE && isAttrFrameSrc(static_cast<Attr*>(impl())->ownerElement(), imp->nodeName())) {
+        setDOMException(exec, NOT_SUPPORTED_ERR);
+        return jsNull();
+    }
+
     ExceptionCode ec = 0;
-    bool ok = impl()->removeChild(toNode(args.at(0)), ec);
+    bool ok = imp->removeChild(toNode(args.at(0)), ec);
     setDOMException(exec, ec);
     if (ok)
         return args.at(0);
@@ -100,8 +154,14 @@ JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 {
+    Node* imp = static_cast<Node*>(impl());
+    if (imp->nodeType() == Node::ATTRIBUTE_NODE && isAttrFrameSrc(static_cast<Attr*>(impl())->ownerElement(), imp->nodeName())) {
+        setDOMException(exec, NOT_SUPPORTED_ERR);
+        return jsNull();
+    }
+
     ExceptionCode ec = 0;
-    bool ok = impl()->appendChild(toNode(args.at(0)), ec, true);
+    bool ok = imp->appendChild(toNode(args.at(0)), ec, true);
     setDOMException(exec, ec);
     if (ok)
         return args.at(0);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSHelper.cpp b/src/3rdparty/webkit/WebCore/css/CSSHelper.cpp
index 8e6f3a0..c3418b4 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSHelper.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSHelper.cpp
@@ -36,7 +36,7 @@ String deprecatedParseURL(const String& url)
     int o = 0;
     int l = i->length();
 
-    while (o < l && (*i)[o] <= ' ') {
+    while (0 < l && (*i)[o] <= ' ') {
         ++o;
         --l;
     }
@@ -53,7 +53,7 @@ String deprecatedParseURL(const String& url)
         l -= 5;
     }
 
-    while (o < l && (*i)[o] <= ' ') {
+    while (0 < l && (*i)[o] <= ' ') {
         ++o;
         --l;
     }
@@ -65,7 +65,7 @@ String deprecatedParseURL(const String& url)
         l -= 2;
     }
 
-    while (o < l && (*i)[o] <= ' ') {
+    while (0 < l && (*i)[o] <= ' ') {
         ++o;
         --l;
     }
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index af84478..3c73bc0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -28,7 +28,9 @@ module core {
         // DOM Level 1
 
         readonly attribute [ConvertNullStringTo=Null] DOMString name;
+
         readonly attribute boolean specified;
+
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString, CustomSetter] DOMString value 
                      setter raises(DOMException);
 
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index fb2852f..c17489a 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -292,19 +292,32 @@ void ContainerNode::willRemove()
     Node::willRemove();
 }
 
-static ExceptionCode willRemoveChild(Node *child)
+static void willRemoveChild(Node* child)
 {
-    ExceptionCode ec = 0;
+    // update auxiliary doc info (e.g. iterators) to note that node is being removed
+    child->document()->nodeWillBeRemoved(child);
+    child->document()->incDOMTreeVersion();
 
     // fire removed from document mutation events.
     dispatchChildRemovalEvents(child);
-    if (ec)
-        return ec;
 
     if (child->attached())
         child->willRemove();
-    
-    return 0;
+}
+
+static void willRemoveChildren(ContainerNode* container)
+{
+    container->document()->nodeChildrenWillBeRemoved(container);
+    container->document()->incDOMTreeVersion();
+
+    // FIXME: Adding new children from event handlers can cause an infinite loop here.
+    for (RefPtr<Node> child = container->firstChild(); child; child = child->nextSibling()) {
+        // fire removed from document mutation events.
+        dispatchChildRemovalEvents(child.get());
+
+        if (child->attached())
+            child->willRemove();
+    }
 }
 
 bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
@@ -328,10 +341,7 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
     }
 
     RefPtr<Node> child = oldChild;
-
-    ec = willRemoveChild(child.get());
-    if (ec)
-        return false;
+    willRemoveChild(child.get());
 
     // Mutation events might have moved this child into a different parent.
     if (child->parentNode() != this) {
@@ -399,14 +409,12 @@ bool ContainerNode::removeChildren()
         return false;
 
     // The container node can be removed from event handlers.
-    RefPtr<Node> protect(this);
-    
+    RefPtr<ContainerNode> protect(this);
+
     // Do any prep work needed before actually starting to detach
     // and remove... e.g. stop loading frames, fire unload events.
-    // FIXME: Adding new children from event handlers can cause an infinite loop here.
-    for (RefPtr<Node> n = m_firstChild; n; n = n->nextSibling())
-        willRemoveChild(n.get());
-    
+    willRemoveChildren(protect.get());
+
     // exclude this node when looking for removed focusedNode since only children will be removed
     document()->removeFocusedNodeOfSubtree(this, true);
 
@@ -936,6 +944,8 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+    ASSERT(!eventDispatchForbidden());
+
 #if ENABLE(INSPECTOR)    
     if (Page* page = child->document()->page()) {
         if (InspectorController* inspectorController = page->inspectorController())
@@ -946,11 +956,6 @@ static void dispatchChildRemovalEvents(Node* child)
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
-    // update auxiliary doc info (e.g. iterators) to note that node is being removed
-    document->nodeWillBeRemoved(child);
-
-    document->incDOMTreeVersion();
-
     // dispatch pre-removal mutation events
     if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER))
         c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, c->parentNode()));
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index 545819d..9803cf5 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -2957,6 +2957,28 @@ void Document::nodeChildrenChanged(ContainerNode* container)
     }
 }
 
+void Document::nodeChildrenWillBeRemoved(ContainerNode* container)
+{
+    if (!disableRangeMutation(page())) {
+        HashSet<Range*>::const_iterator end = m_ranges.end();
+        for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
+            (*it)->nodeChildrenWillBeRemoved(container);
+    }
+
+    HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = m_nodeIterators.end();
+    for (HashSet<NodeIterator*>::const_iterator it = m_nodeIterators.begin(); it != nodeIteratorsEnd; ++it) {
+        for (Node* n = container->firstChild(); n; n = n->nextSibling())
+            (*it)->nodeWillBeRemoved(n);
+    }
+
+    if (Frame* frame = this->frame()) {
+        for (Node* n = container->firstChild(); n; n = n->nextSibling()) {
+            frame->selection()->nodeWillBeRemoved(n);
+            frame->dragCaretController()->nodeWillBeRemoved(n);
+        }
+    }
+}
+
 void Document::nodeWillBeRemoved(Node* n)
 {
     HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = m_nodeIterators.end();
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 44cdf0d..68927f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -616,6 +616,9 @@ public:
     void detachRange(Range*);
 
     void nodeChildrenChanged(ContainerNode*);
+    // nodeChildrenWillBeRemoved is used when removing all node children at once.
+    void nodeChildrenWillBeRemoved(ContainerNode*);
+    // nodeWillBeRemoved is only safe when removing one node at a time.
     void nodeWillBeRemoved(Node*);
 
     void textInserted(Node*, unsigned offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 6bd512d..a02bb4c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -937,7 +937,7 @@ void Element::recalcStyle(StyleChange change)
                 newStyle->setChildrenAffectedByDirectAdjacentRules();
         }
 
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get()) || change == Force && renderer() && renderer()->requiresForcedStyleRecalcPropagation()) {
             setRenderStyle(newStyle);
         } else if (needsStyleRecalc() && (styleChangeType() != SyntheticStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
@@ -1429,9 +1429,15 @@ void Element::normalizeAttributes()
     NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
-    unsigned numAttrs = attrs->length();
-    for (unsigned i = 0; i < numAttrs; i++) {
-        if (Attr* attr = attrs->attributeItem(i)->attr())
+
+    if (attrs->isEmpty())
+        return;
+
+    Vector<RefPtr<Attribute> > attributeVector;
+    attrs->copyAttributesToVector(attributeVector);
+    size_t numAttrs = attributeVector.size();
+    for (size_t i = 0; i < numAttrs; ++i) {
+        if (Attr* attr = attributeVector[i]->attr())
             attr->normalize();
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index d8a6ba8..ee979cf 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -172,6 +172,11 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     return m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
+void NamedNodeMap::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
+{
+    copy = m_attributes;
+}
+
 Attribute* NamedNodeMap::getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index d5136b5..e292576 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -72,6 +72,8 @@ public:
     Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
     Attribute* getAttributeItem(const QualifiedName&) const;
 
+    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+
     void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
     void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
index 4d36577..7bfbf23 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.idl
@@ -28,7 +28,7 @@ module core {
 
         Node getNamedItem(in DOMString name);
 
-        Node setNamedItem(in Node node)
+        [Custom] Node setNamedItem(in Node node)
             raises(DOMException);
 
         Node removeNamedItem(in DOMString name)
@@ -46,7 +46,7 @@ module core {
             // FIXME: the implementation does take an exceptioncode parameter.
             /*raises(DOMException)*/;
 
-        Node setNamedItemNS(in Node node)
+        [Custom] Node setNamedItemNS(in Node node)
             raises(DOMException);
 
         [OldStyleObjC] Node removeNamedItemNS(in [ConvertNullToNullString] DOMString namespaceURI, 
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index 0489316..22d9a85 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -51,7 +51,7 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString        nodeName;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString        nodeValue
+                 attribute [CustomSetter, ConvertNullStringTo=Null, ConvertNullToNullString] DOMString        nodeValue
                      setter raises(DOMException);
 
         readonly attribute unsigned short   nodeType;
@@ -96,7 +96,7 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString       baseURI;
 
                  // FIXME: the spec says this can also raise on retrieval.
-                 attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString       textContent
+                 attribute [CustomSetter, ConvertNullStringTo=Null, ConvertNullToNullString] DOMString       textContent
                      setter raises(DOMException);
 
         boolean            isSameNode(in Node other);
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index 52d1785..689b590 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -1716,6 +1716,31 @@ void Range::nodeChildrenChanged(ContainerNode* container)
     boundaryNodeChildrenChanged(m_end, container);
 }
 
+static inline void boundaryNodeChildrenWillBeRemoved(RangeBoundaryPoint& boundary, ContainerNode* container)
+{
+    for (Node* nodeToBeRemoved = container->firstChild(); nodeToBeRemoved; nodeToBeRemoved = nodeToBeRemoved->nextSibling()) {
+        if (boundary.childBefore() == nodeToBeRemoved) {
+            boundary.setToStartOfNode(container);
+            return;
+        }
+
+        for (Node* n = boundary.container(); n; n = n->parentNode()) {
+            if (n == nodeToBeRemoved) {
+                boundary.setToStartOfNode(container);
+                return;
+            }
+        }
+    }
+}
+
+void Range::nodeChildrenWillBeRemoved(ContainerNode* container)
+{
+    ASSERT(container);
+    ASSERT(container->document() == m_ownerDocument);
+    boundaryNodeChildrenWillBeRemoved(m_start, container);
+    boundaryNodeChildrenWillBeRemoved(m_end, container);
+}
+
 static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node* nodeToBeRemoved)
 {
     if (boundary.childBefore() == nodeToBeRemoved) {
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index fd0f66a..bfddd32 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -111,6 +111,7 @@ public:
     void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
+    void nodeChildrenWillBeRemoved(ContainerNode*);
     void nodeWillBeRemoved(Node*);
 
     void textInserted(Node*, unsigned offset, unsigned length);
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index 34fa46d..4cb34ac 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1069,6 +1069,21 @@ static bool supportedFromMenuOrKeyBinding(Frame*, EditorCommandSource source)
     return source == CommandFromMenuOrKeyBinding;
 }
 
+static bool supportedCopyCut(Frame* frame, EditorCommandSource source)
+{
+    switch (source) {
+        case CommandFromMenuOrKeyBinding:
+            return true;
+        case CommandFromDOM:
+        case CommandFromDOMWithUserInterface: {
+            Settings* settings = frame ? frame->settings() : 0;
+            return settings && settings->javaScriptCanAccessClipboard();
+        }
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 static bool supportedPaste(Frame* frame, EditorCommandSource source)
 {
     switch (source) {
@@ -1077,7 +1092,7 @@ static bool supportedPaste(Frame* frame, EditorCommandSource source)
         case CommandFromDOM:
         case CommandFromDOMWithUserInterface: {
             Settings* settings = frame ? frame->settings() : 0;
-            return settings && settings->isDOMPasteAllowed();
+            return settings && (settings->javaScriptCanAccessClipboard() ? settings->isDOMPasteAllowed() : 0);
         }
     }
     ASSERT_NOT_REACHED();
@@ -1304,9 +1319,9 @@ static const CommandMap& createCommandMap()
         { "BackColor", { executeBackColor, supported, enabledInRichlyEditableText, stateNone, valueBackColor, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "BackwardDelete", { executeDeleteBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } }, // FIXME: remove BackwardDelete when Safari for Windows stops using it.
         { "Bold", { executeToggleBold, supported, enabledInRichlyEditableText, stateBold, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "Copy", { executeCopy, supported, enabledCopy, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
+        { "Copy", { executeCopy, supportedCopyCut, enabledCopy, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "CreateLink", { executeCreateLink, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "Cut", { executeCut, supported, enabledCut, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
+        { "Cut", { executeCut, supportedCopyCut, enabledCut, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "Delete", { executeDelete, supported, enabledDelete, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackward", { executeDeleteBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackwardByDecomposingPreviousCharacter", { executeDeleteBackwardByDecomposingPreviousCharacter, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 787dad9..7e90107 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -404,10 +404,12 @@ static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Ran
             if (Node* parent = node->parentNode()) {
                 if (parent->hasTagName(scriptTag)
                     || parent->hasTagName(styleTag)
-                    || parent->hasTagName(textareaTag)
                     || parent->hasTagName(xmpTag)) {
                     appendUCharRange(result, ucharRange(node, range));
                     break;
+                } else if (parent->hasTagName(textareaTag)) {
+                    appendEscapedContent(result, ucharRange(node, range), documentIsHTML);                    
+                    break;
                 }
             }
             if (!annotate) {
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index 7aed66c..1232cfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -264,14 +264,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exe
     if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
-    NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(0));
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->setNamedItem(node, ec)));
-    setDOMException(exec, ec);
-    return result;
+    return castedThisObj->setNamedItem(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -325,14 +318,7 @@ JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* e
     if (!thisValue.inherits(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
-    NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(0));
-
-
-    JSC::JSValue result = toJS(exec, castedThisObj->globalObject(), WTF::getPtr(imp->setNamedItemNS(node, ec)));
-    setDOMException(exec, ec);
-    return result;
+    return castedThisObj->setNamedItemNS(exec, args);
 }
 
 JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index 0fa1fdf..b79e97c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -50,6 +50,10 @@ public:
 
     virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&, JSC::EnumerationMode mode = JSC::ExcludeDontEnumProperties);
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
+
+    // Custom functions
+    JSC::JSValue setNamedItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setNamedItemNS(JSC::ExecState*, const JSC::ArgList&);
     NamedNodeMap* impl() const { return m_impl.get(); }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index 47dafd4..1e16be6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -394,11 +394,7 @@ void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValue value,
 
 void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    JSNode* castedThisObj = static_cast<JSNode*>(thisObject);
-    Node* imp = static_cast<Node*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    imp->setNodeValue(valueToStringWithNullCheck(exec, value), ec);
-    setDOMException(exec, ec);
+    static_cast<JSNode*>(thisObject)->setNodeValue(exec, value);
 }
 
 void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
@@ -412,11 +408,7 @@ void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
 
 void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    JSNode* castedThisObj = static_cast<JSNode*>(thisObject);
-    Node* imp = static_cast<Node*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    imp->setTextContent(valueToStringWithNullCheck(exec, value), ec);
-    setDOMException(exec, ec);
+    static_cast<JSNode*>(thisObject)->setTextContent(exec, value);
 }
 
 JSValue JSNode::getConstructor(ExecState* exec, JSGlobalObject* globalObject)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index be6dd23..e2c82c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -54,6 +54,10 @@ public:
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
+    // Custom attributes
+    void setNodeValue(JSC::ExecState*, JSC::JSValue);
+    void setTextContent(JSC::ExecState*, JSC::JSValue);
+
     // Custom functions
     JSC::JSValue insertBefore(JSC::ExecState*, const JSC::ArgList&);
     JSC::JSValue replaceChild(JSC::ExecState*, const JSC::ArgList&);
diff --git a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 9cec7a9..73a572e 100644
--- a/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1215,7 +1215,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    bool originClean = !canvas()->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
+    bool originClean = !canvas()->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url())) && cachedImage->image()->hasSingleSecurityOrigin();
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
index de0a0b0..55f51ac 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -81,16 +81,19 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document* document, Threadabl
     
     ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
 
-    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()))
-        makeSimpleCrossOriginAccessRequest(request);
+    OwnPtr<ResourceRequest> crossOriginRequest(new ResourceRequest(request));
+    crossOriginRequest->removeCredentials();
+    crossOriginRequest->setAllowCookies(m_options.allowCredentials);
+
+    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(crossOriginRequest->httpMethod(), crossOriginRequest->httpHeaderFields()))
+        makeSimpleCrossOriginAccessRequest(*crossOriginRequest);
     else {
-        m_actualRequest.set(new ResourceRequest(request));
-        m_actualRequest->setAllowCookies(m_options.allowCredentials);
+        m_actualRequest.set(crossOriginRequest.release());
 
-        if (CrossOriginPreflightResultCache::shared().canSkipPreflight(document->securityOrigin()->toString(), request.url(), m_options.allowCredentials, request.httpMethod(), request.httpHeaderFields()))
+        if (CrossOriginPreflightResultCache::shared().canSkipPreflight(document->securityOrigin()->toString(), m_actualRequest->url(), m_options.allowCredentials, m_actualRequest->httpMethod(), m_actualRequest->httpHeaderFields()))
             preflightSuccess();
         else
-            makeCrossOriginAccessRequestWithPreflight(request);
+            makeCrossOriginAccessRequestWithPreflight(*m_actualRequest);
     }
 }
 
@@ -106,8 +109,6 @@ void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const Resource
 
     // Make a copy of the passed request so that we can modify some details.
     ResourceRequest crossOriginRequest(request);
-    crossOriginRequest.removeCredentials();
-    crossOriginRequest.setAllowCookies(m_options.allowCredentials);
     crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
 
     loadRequest(crossOriginRequest, DoSecurityCheck);
@@ -287,11 +288,17 @@ void DocumentThreadableLoader::preflightSuccess()
 
 void DocumentThreadableLoader::preflightFailure()
 {
+    m_actualRequest = 0; // Prevent didFinishLoading() from bypassing access check.
     m_client->didFail(ResourceError());
 }
 
 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, SecurityCheckPolicy securityCheck)
 {
+    // Any credential should have been removed from the cross-site requests.
+    const KURL& requestURL = request.url();
+    ASSERT(m_sameOriginRequest || requestURL.user().isEmpty());
+    ASSERT(m_sameOriginRequest || requestURL.pass().isEmpty());
+
     if (m_async) {
         // Don't sniff content or send load callbacks for the preflight request.
         bool sendLoadCallbacks = m_options.sendLoadCallbacks && !m_actualRequest;
@@ -315,15 +322,15 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
 
     // No exception for file:/// resources, see <rdar://problem/4962298>.
     // Also, if we have an HTTP response, then it wasn't a network error in fact.
-    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+    if (!error.isNull() && !requestURL.isLocalFile() && response.httpStatusCode() <= 0) {
         m_client->didFail(error);
         return;
     }
 
     // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
     // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
-    // requested.
-    if (request.url() != response.url() && !isAllowedRedirect(response.url())) {
+    // requested. Also comparing the request and response URLs as strings will fail if the requestURL still has its credentials.
+    if (requestURL != response.url() && !isAllowedRedirect(response.url())) {
         m_client->didFailRedirectCheck();
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index f238b27..0da6873 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -313,7 +313,7 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
         }
 
         IntPoint point = frameView->windowToContents(dragData->clientPosition());
-        Element* element = elementUnderMouse(m_documentUnderMouse, point);
+        Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
@@ -363,7 +363,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return false;
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element = elementUnderMouse(m_documentUnderMouse, point);
+    Element* element = elementUnderMouse(m_documentUnderMouse.get(), point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
@@ -439,7 +439,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartInsert, smartDelete));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText));
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), fragment, true, dragData->canSmartReplace(), chosePlainText));
         }
     } else {
         String text = dragData->asPlainText();
@@ -450,7 +450,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
 
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true));
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse.get(), createFragmentFromText(range.get(), text), true, false, true));
     }
     loader->setAllowStaleResources(false);
 
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.h b/src/3rdparty/webkit/WebCore/page/DragController.h
index 3b2b083..712f9ab 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.h
+++ b/src/3rdparty/webkit/WebCore/page/DragController.h
@@ -67,13 +67,11 @@ namespace WebCore {
         DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
-        void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
-        Document* dragInitiator() const { return m_dragInitiator; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
 
-        Document* documentUnderMouse() const { return m_documentUnderMouse; }
+        Document* documentUnderMouse() const { return m_documentUnderMouse.get(); }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
         
@@ -114,8 +112,8 @@ namespace WebCore {
         Page* m_page;
         DragClient* m_client;
         
-        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
-        Document* m_dragInitiator; // The Document (if any) that initiated the drag.
+        RefPtr<Document> m_documentUnderMouse; // The document the mouse was last dragged over.
+        RefPtr<Document> m_dragInitiator; // The Document (if any) that initiated the drag.
         
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 1654257..f1ee742 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -2163,7 +2163,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 
     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
         node->dispatchEvent(keydown, ec);
-        return keydown->defaultHandled() || keydown->defaultPrevented();
+        // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
+        bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+        return keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
     }
 
     // Run input method in advance of DOM event handling.  This may result in the IM
@@ -2183,7 +2185,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
     }
 
     node->dispatchEvent(keydown, ec);
-    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented();
+    // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
+    bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
     if (handledByInputMethod || (keydownResult && !backwardCompatibilityMode))
         return keydownResult;
     
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 639414b..01f0375 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -1315,14 +1315,13 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
 {
     ASSERT(m_frame->view() == this);
 
-    if (!m_layoutSchedulingEnabled || (m_frame->contentRenderer()
-            && m_frame->contentRenderer()->needsLayout())) {
+    if (m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout()) {
         if (relayoutRoot)
             relayoutRoot->markContainingBlocksForLayout(false);
         return;
     }
 
-    if (layoutPending()) {
+    if (layoutPending() || !m_layoutSchedulingEnabled) {
         if (m_layoutRoot != relayoutRoot) {
             if (isObjectAncestorContainerOf(m_layoutRoot, relayoutRoot)) {
                 // Keep the current root
@@ -1339,7 +1338,7 @@ void FrameView::scheduleRelayoutOfSubtree(RenderObject* relayoutRoot)
                 relayoutRoot->markContainingBlocksForLayout(false);
             }
         }
-    } else {
+    } else if (m_layoutSchedulingEnabled) {
         int delay = m_frame->document()->minimumLayoutDelay();
         m_layoutRoot = relayoutRoot;
         m_delayedLayout = delay != 0;
diff --git a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
index c0b3e22..516c533 100644
--- a/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
@@ -90,6 +90,20 @@ static URLSchemesMap& schemesWithUniqueOrigins()
     return schemesWithUniqueOrigins;
 }
 
+static bool schemeRequiresAuthority(const String& scheme)
+{
+    DEFINE_STATIC_LOCAL(URLSchemesMap, schemes, ());
+
+    if (schemes.isEmpty()) {
+        schemes.add("http");
+        schemes.add("https");
+        schemes.add("ftp");
+    }
+
+    return schemes.contains(scheme);
+}
+
+
 SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     : m_sandboxFlags(sandboxFlags)
     , m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
@@ -103,6 +117,10 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
+    // For edge case URLs that were probably misparsed, make sure that the origin is unique.
+    if (schemeRequiresAuthority(m_protocol) && m_host.isEmpty())
+        m_isUnique = true;
+
     // document.domain starts as m_host, but can be set by the DOM.
     m_domain = m_host;
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 475d373..c0659d2 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -79,6 +79,7 @@ Settings::Settings(Page* page)
     , m_allowUniversalAccessFromFileURLs(true)
     , m_allowFileAccessFromFileURLs(true)
     , m_javaScriptCanOpenWindowsAutomatically(false)
+    , m_javaScriptCanAccessClipboard(false)
     , m_shouldPrintBackgrounds(false)
     , m_textAreasAreResizable(false)
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -291,6 +292,11 @@ void Settings::setJavaScriptCanOpenWindowsAutomatically(bool javaScriptCanOpenWi
     m_javaScriptCanOpenWindowsAutomatically = javaScriptCanOpenWindowsAutomatically;
 }
 
+void Settings::setJavaScriptCanAccessClipboard(bool javaScriptCanAccessClipboard)
+{
+    m_javaScriptCanAccessClipboard = javaScriptCanAccessClipboard;
+}
+
 void Settings::setDefaultTextEncodingName(const String& defaultTextEncodingName)
 {
     m_defaultTextEncodingName = defaultTextEncodingName;
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index b677712..a6653ce 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -122,6 +122,9 @@ namespace WebCore {
         void setJavaScriptCanOpenWindowsAutomatically(bool);
         bool javaScriptCanOpenWindowsAutomatically() const { return m_javaScriptCanOpenWindowsAutomatically; }
 
+        void setJavaScriptCanAccessClipboard(bool);
+        bool javaScriptCanAccessClipboard() const { return m_javaScriptCanAccessClipboard; }
+
         void setSpatialNavigationEnabled(bool);
         bool isSpatialNavigationEnabled() const { return m_isSpatialNavigationEnabled; }
 
@@ -330,6 +333,7 @@ namespace WebCore {
         bool m_allowUniversalAccessFromFileURLs: 1;
         bool m_allowFileAccessFromFileURLs: 1;
         bool m_javaScriptCanOpenWindowsAutomatically : 1;
+        bool m_javaScriptCanAccessClipboard : 1;
         bool m_shouldPrintBackgrounds : 1;
         bool m_textAreasAreResizable : 1;
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/src/3rdparty/webkit/WebCore/platform/KURL.cpp b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
index 40adfbc..3c8d50f 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURL.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURL.cpp
@@ -215,6 +215,9 @@ static const unsigned char characterClassTable[256] = {
     /* 252 */ BadChar, /* 253 */ BadChar, /* 254 */ BadChar, /* 255 */ BadChar
 };
 
+static const unsigned maximumValidPortNumber = 0xFFFE;
+static const unsigned invalidPortNumber = 0xFFFF;
+
 static int copyPathRemovingDots(char* dst, const char* src, int srcStart, int srcEnd);
 static void encodeRelativeString(const String& rel, const TextEncoding&, CharBuffer& ouput);
 static String substituteBackslashes(const String&);
@@ -573,12 +576,17 @@ String KURL::host() const
 
 unsigned short KURL::port() const
 {
-    if (m_hostEnd == m_portEnd)
+    // We return a port of 0 if there is no port specified. This can happen in two situations:
+    // 1) The URL contains no colon after the host name and before the path component of the URL.
+    // 2) The URL contains a colon but there's no port number before the path component of the URL begins.
+    if (m_hostEnd == m_portEnd || m_hostEnd == m_portEnd - 1)
         return 0;
 
-    int number = m_string.substring(m_hostEnd + 1, m_portEnd - m_hostEnd - 1).toInt();
-    if (number < 0 || number > 0xFFFF)
-        return 0;
+    const UChar* stringData = m_string.characters();
+    bool ok = false;
+    unsigned number = charactersToUIntStrict(stringData + m_hostEnd + 1, m_portEnd - m_hostEnd - 1, &ok);
+    if (!ok || number > maximumValidPortNumber)
+        return invalidPortNumber;
     return number;
 }
 
@@ -1757,7 +1765,7 @@ bool portAllowed(const KURL& url)
         6667, // Standard IRC [Apple addition]
         6668, // Alternate IRC [Apple addition]
         6669, // Alternate IRC [Apple addition]
-
+        invalidPortNumber, // Used to block all invalid port numbers
     };
     const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
index 8be7009..10b9bb8 100644
--- a/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/KURLGoogle.cpp
@@ -57,6 +57,8 @@ using std::binary_search;
 
 namespace WebCore {
 
+static const unsigned invalidPortNumber = 0xFFFF;
+
 // Wraps WebCore's text encoding in a character set converter for the
 // canonicalizer.
 class KURLCharsetConverter : public url_canon::CharsetConverter {
@@ -499,7 +501,7 @@ String KURL::host() const
 unsigned short KURL::port() const
 {
     if (!m_url.m_isValid || m_url.m_parsed.port.len <= 0)
-        return 0;
+        return invalidPortNumber;
     int port = url_parse::ParsePort(m_url.utf8String().data(), m_url.m_parsed.port);
     if (port == url_parse::PORT_UNSPECIFIED)
         return 0;
@@ -853,6 +855,12 @@ bool portAllowed(const KURL& url)
         3659, // apple-sasl / PasswordServer [Apple addition]
         4045, // lockd
         6000, // X11
+        6665, // Alternate IRC [Apple addition]
+        6666, // Alternate IRC [Apple addition]
+        6667, // Standard IRC [Apple addition]
+        6668, // Alternate IRC [Apple addition]
+        6669, // Alternate IRC [Apple addition]
+        invalidPortNumber, // Used to block all invalid port numbers
     };
     const unsigned short* const blockedPortListEnd = blockedPortList + sizeof(blockedPortList) / sizeof(blockedPortList[0]);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
index a7351a0..c96fe25 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/PathQt.cpp
@@ -69,23 +69,31 @@ Path& Path::operator=(const Path& other)
     return *this;
 }
 
+static inline bool areCollinear(const QPointF& a, const QPointF& b, const QPointF& c)
+{
+    // Solved from comparing the slopes of a to b and b to c: (ay-by)/(ax-bx) == (cy-by)/(cx-bx)
+    return qFuzzyCompare((c.y() - b.y()) * (a.x() - b.x()), (a.y() - b.y()) * (c.x() - b.x()));
+}
+
+static inline bool withinRange(qreal p, qreal a, qreal b)
+{
+    return (p >= a && p <= b) || (p >= b && p <= a);
+}
+
 // Check whether a point is on the border
-bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
+static bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
 {
     QPointF p1 = border.at(0);
     QPointF p2;
 
     for (int i = 1; i < border.size(); ++i) {
         p2 = border.at(i);
-        //  (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2)  && (y2-y1)(x-x1) == (y-y1)(x2-x1)
-        //  In which, (y2-y1)(x-x1) == (y-y1)(x2-x1) is from (y2-y1)/(x2-x1) == (y-y1)/(x-x1)
-        //  it want to check the slope between p1 and p2 is same with slope between p and p1,
-        //  if so then the three points lie on the same line.
-        //  In which, (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2) want to make sure p is
-        //  between p1 and p2, not outside.
-        if (((p.x() <= p1.x() && p.x() >= p2.x()) || (p.x() >= p1.x() && p.x() <= p2.x()))
-            && ((p.y() <= p1.y() && p.y() >= p2.y()) || (p.y() >= p1.y() && p.y() <= p2.y()))
-            && (p2.y() - p1.y()) * (p.x() - p1.x()) == (p.y() - p1.y()) * (p2.x() - p1.x())) {
+        if (areCollinear(p, p1, p2)
+                // Once we know that the points are collinear we
+                // only need to check one of the coordinates
+                && (qAbs(p2.x() - p1.x()) > qAbs(p2.y() - p1.y()) ?
+                        withinRange(p.x(), p1.x(), p2.x()) :
+                        withinRange(p.y(), p1.y(), p2.y()))) {
             return true;
         }
         p1 = p2;
@@ -199,19 +207,14 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
     float p1p2_length = sqrtf(p1p2.x() * p1p2.x() + p1p2.y() * p1p2.y());
 
     double cos_phi = (p1p0.x() * p1p2.x() + p1p0.y() * p1p2.y()) / (p1p0_length * p1p2_length);
-    // all points on a line logic
-    if (cos_phi == -1) {
+
+    // The points p0, p1, and p2 are on the same straight line (HTML5, 4.8.11.1.8)
+    // We could have used areCollinear() here, but since we're reusing
+    // the variables computed above later on we keep this logic.
+    if (qFuzzyCompare(qAbs(cos_phi), 1.0)) {
         m_path.lineTo(p1);
         return;
     }
-    if (cos_phi == 1) {
-        // add infinite far away point
-        unsigned int max_length = 65535;
-        double factor_max = max_length / p1p0_length;
-        FloatPoint ep((p0.x() + factor_max * p1p0.x()), (p0.y() + factor_max * p1p0.y()));
-        m_path.lineTo(ep);
-        return;
-    }
 
     float tangent = radius / tan(acos(cos_phi) / 2);
     float factor_p1p0 = tangent / p1p0_length;
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
index 126b499..42cbc8a 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ProtectionSpace.h
@@ -47,6 +47,7 @@ enum ProtectionSpaceAuthenticationScheme {
   ProtectionSpaceAuthenticationSchemeHTMLForm = 4,
   ProtectionSpaceAuthenticationSchemeNTLM = 5,
   ProtectionSpaceAuthenticationSchemeNegotiate = 6,
+  ProtectionSpaceAuthenticationSchemeUnknown = 100,
 };
 
 class ProtectionSpace {
diff --git a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
index 09af518..4d6b88c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/FixedTableLayout.cpp
@@ -166,8 +166,7 @@ int FixedTableLayout::calcWidthArray(int)
                 
                 int usedSpan = 0;
                 int i = 0;
-                while (usedSpan < span) {
-                    ASSERT(cCol + i < nEffCols);
+                while (usedSpan < span && cCol + i < nEffCols) {
                     int eSpan = m_table->spanOfEffCol(cCol + i);
                     // Only set if no col element has already set it.
                     if (m_width[cCol + i].isAuto() && w.type() != Auto) {
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
index 7fd6ab0..1fc5eb6 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderButton.h
@@ -57,12 +57,14 @@ public:
 
     virtual bool canHaveChildren() const;
 
-protected:
+private:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual bool hasLineIfEmpty() const { return true; }
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     void timerFired(Timer<RenderButton>*);
 
     RenderTextFragment* m_buttonText;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
index 467edcc..ce221ea 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
@@ -53,6 +53,8 @@ public:
 private:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     RenderStyle* columnStyle(DataGridColumn*);
     RenderStyle* headerStyle(DataGridColumn*);
     void recalcStyleForColumns();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
index 99dd35c..a5f3367 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFileUploadControl.h
@@ -56,6 +56,8 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     // FileChooserClient methods.
     void valueChanged();
     void repaint() { RenderBlock::repaint(); }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
index 1d76742..5b1deff 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderInline.cpp
@@ -274,7 +274,7 @@ void RenderInline::splitInlines(RenderBlock* fromBlock, RenderBlock* toBlock,
             // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that the inline's :after
             // content gets properly destroyed.
             if (document()->usesBeforeAfterRules())
-                inlineCurr->children()->updateBeforeAfterContent(this, AFTER);
+                inlineCurr->children()->updateBeforeAfterContent(inlineCurr, AFTER);
 
             // Now we need to take all of the children starting from the first child
             // *after* currChild and append them all to the clone.
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index a012868..2aec361 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -3178,22 +3178,33 @@ void RenderLayer::updateHoverActiveState(const HitTestRequest& request, HitTestR
     // Locate the common ancestor render object for the two renderers.
     RenderObject* ancestor = commonAncestor(oldHoverObj, newHoverObj);
 
+    Vector<RefPtr<Node>, 32> nodesToRemoveFromChain;
+    Vector<RefPtr<Node>, 32> nodesToAddToChain;
+
     if (oldHoverObj != newHoverObj) {
         // The old hover path only needs to be cleared up to (and not including) the common ancestor;
         for (RenderObject* curr = oldHoverObj; curr && curr != ancestor; curr = curr->hoverAncestor()) {
-            if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain())) {
-                curr->node()->setActive(false);
-                curr->node()->setHovered(false);
-            }
+            if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain()))
+                nodesToRemoveFromChain.append(curr->node());
         }
     }
 
     // Now set the hover state for our new object up to the root.
     for (RenderObject* curr = newHoverObj; curr; curr = curr->hoverAncestor()) {
-        if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain())) {
-            curr->node()->setActive(request.active());
-            curr->node()->setHovered(true);
-        }
+        if (curr->node() && !curr->isText() && (!mustBeInActiveChain || curr->node()->inActiveChain()))
+            nodesToAddToChain.append(curr->node());
+    }
+
+    size_t removeCount = nodesToRemoveFromChain.size();
+    for (size_t i = 0; i < removeCount; ++i) {
+        nodesToRemoveFromChain[i]->setActive(false);
+        nodesToRemoveFromChain[i]->setHovered(false);
+    }
+
+    size_t addCount = nodesToAddToChain.size();
+    for (size_t i = 0; i < addCount; ++i) {
+        nodesToAddToChain[i]->setActive(request.active());
+        nodesToAddToChain[i]->setHovered(true);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
index c4c41dc..d140979 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListItem.h
@@ -63,6 +63,8 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     void updateMarkerLocation();
     inline int calcValue() const;
     void updateValueNow() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
index d0353ee..6c8f769 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderListMarker.cpp
@@ -101,8 +101,10 @@ static inline String toAlphabeticOrNumeric(int number, const UChar* sequence, in
     int length = 1;
 
     if (type == AlphabeticSequence) {
-        while ((numberShadow /= sequenceSize) > 0)
-            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize - 1];
+        while ((numberShadow /= sequenceSize) > 0) {
+            --numberShadow;
+            letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
+        }
     } else {
         while ((numberShadow /= sequenceSize) > 0)
             letters[lettersSize - ++length] = sequence[numberShadow % sequenceSize];
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
index 0d24c4c..32d6d65 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.h
@@ -118,6 +118,8 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     RefPtr<HTMLElement> m_controlsShadowRoot;
     RefPtr<MediaControlElement> m_panel;
     RefPtr<MediaControlMuteButtonElement> m_muteButton;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
index aeb6205..5ee8588 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.h
@@ -78,6 +78,8 @@ private:
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     // PopupMenuClient methods
     virtual String itemText(unsigned listIndex) const;
     virtual String itemToolTip(unsigned listIndex) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index d928521..593fa52 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -322,6 +322,8 @@ public:
     bool cellWidthChanged() const { return m_cellWidthChanged; }
     void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return false; }
+
 #if ENABLE(MATHML)
     virtual bool isRenderMathMLBlock() const { return false; }
 #endif // ENABLE(MATHML)
@@ -412,7 +414,6 @@ public:
     void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
                            int angleSpan, BoxSide, Color, const Color& textcolor, EBorderStyle, bool firstCorner);
 
-public:
     // The pseudo element style can be cached or uncached.  Use the cached method if the pseudo element doesn't respect
     // any pseudo classes (and therefore has no concept of changing state).
     RenderStyle* getCachedPseudoStyle(PseudoId, RenderStyle* parentStyle = 0) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h
index 0a90fde..7aa1efe 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderProgress.h
@@ -40,6 +40,8 @@ private:
     virtual void calcPrefWidths();
     virtual void layout();
     virtual void updateFromElement();
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     int m_position;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
index 92ad73b..fc8ce24 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderSlider.h
@@ -58,6 +58,8 @@ namespace WebCore {
 
         virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+        virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
         PassRefPtr<RenderStyle> createThumbStyle(const RenderStyle* parentStyle);
 
         int trackSize();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index 307db64..c08adc2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -203,7 +203,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return e ? static_cast<Text*>(e)->dataImpl() : 0;
+    return (e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
index 2fc8edc..984f41d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextControl.h
@@ -107,6 +107,8 @@ private:
 
     virtual bool canBeProgramaticallyScrolled(bool) const { return true; }
 
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
     String finishText(Vector<UChar>&) const;
 
     bool m_wasChangedSinceLastChangeEvent;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
index f3398a3..1e15d66 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTextFragment.cpp
@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
+    RefPtr<StringImpl> result = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
     return result.release();
@@ -80,7 +80,7 @@ UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
+        StringImpl*  original = ((e && e->isTextNode()) ? static_cast<Text*>(e)->dataImpl() : contentString());
         if (original)
             return (*original)[start() - 1];
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
index 47b4f3b..d907d86 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.cpp
@@ -187,6 +187,7 @@ void QWebSettingsPrivate::apply()
         value = attributes.value(QWebSettings::JavascriptCanAccessClipboard,
                                       global->attributes.value(QWebSettings::JavascriptCanAccessClipboard));
         settings->setDOMPasteAllowed(value);
+        settings->setJavaScriptCanAccessClipboard(value);
 
         value = attributes.value(QWebSettings::DeveloperExtrasEnabled,
                                       global->attributes.value(QWebSettings::DeveloperExtrasEnabled));
@@ -235,8 +236,8 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::LocalContentCanAccessFileUrls));
         settings->setAllowFileAccessFromFileURLs(value);
 
-        value = attributes.value(QWebSettings::XSSAuditorEnabled,
-                                      global->attributes.value(QWebSettings::XSSAuditorEnabled));
+        value = attributes.value(QWebSettings::XSSAuditingEnabled,
+                                      global->attributes.value(QWebSettings::XSSAuditingEnabled));
         settings->setXSSAuditorEnabled(value);
 
 #if ENABLE(TILED_BACKING_STORE)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
index 207a9b6..156f633 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebsettings.h
@@ -68,7 +68,7 @@ public:
 #endif
         LocalContentCanAccessRemoteUrls,
         DnsPrefetchEnabled,
-        XSSAuditorEnabled,
+        XSSAuditingEnabled,
         AcceleratedCompositingEnabled,
         SpatialNavigationEnabled,
         LocalContentCanAccessFileUrls,
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index 9dd129e..63d5568 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,65 @@
+2010-07-09  Simon Hausmann <simon.hausmann@nokia.com>
+
+        Unreviewed trivial Symbian build fix.
+
+        [Qt] Fix the Symbian build when compiling without S60
+
+        Use Q_OS_SYMBIAN instead of Q_WS_S60 for the user agent
+        determination.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::userAgentForUrl):
+
+2010-07-09  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fixed Qt symbian/linux-armcc mkspec when configured with -qtlibinfix.
+
+        * declarative/declarative.pro: Use QT_LIBINFIX.
+
+2010-06-01  Raine Makelainen  <raine.makelainen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt]: REGRESSION(r58703): QWebSettings::JavascriptCanAccessClipboard has wrong case in "Javascript" part.
+        https://bugs.webkit.org/show_bug.cgi?id=39878        
+
+        QWebSettings::JavaScriptCanAccessClipboard reverted back to
+        QWebSettings::JavascriptCanAccessClipboard. QWebSettings::DOMPasteAllowed enum removed.
+
+        Value of QWebSettings::JavascriptCanAccessClipboard to setDOMPasteAllowed and 
+        setJavaScriptCanAccessClipboard of WebCore::Settings.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
+2010-05-03  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add support for controlling clipboard access from javascript.
+        Clipboard access from javascript is disabled by default.
+        https://bugs.webkit.org/show_bug.cgi?id=27751
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
+2010-03-24  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Rename QWebSettings::XSSAuditorEnabled to XSSAuditingEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=36522
+
+        For consistency with other QWebSettings attributes.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
 2010-05-19  Antti Koivisto  <koivisto@iki.fi>
 
         Rubber-stamped by Kenneth Rohde Christiansen.
diff --git a/src/corelib/io/qprocess.cpp b/src/corelib/io/qprocess.cpp
index 8eba2b0..9bc4063 100644
--- a/src/corelib/io/qprocess.cpp
+++ b/src/corelib/io/qprocess.cpp
@@ -1377,6 +1377,50 @@ void QProcess::setStandardOutputProcess(QProcess *destination)
     dto->stdinChannel.pipeFrom(dfrom);
 }
 
+#if defined(Q_OS_WIN) || defined(Q_OS_SYMBIAN)
+
+/*!
+    \since 4.7
+
+    Returns the additional native command line arguments for the program.
+
+    \note This function is available only on the Windows and Symbian
+    platforms.
+
+    \sa setNativeArguments()
+*/
+QString QProcess::nativeArguments() const
+{
+    Q_D(const QProcess);
+    return d->nativeArguments;
+}
+
+/*!
+    \since 4.7
+    \overload
+
+    Sets additional native command line arguments for the program.
+
+    On operating systems where the system API for passing command line
+    arguments to a subprocess natively uses a single string, one can
+    conceive command lines which cannot be passed via QProcess's portable
+    list-based API. In such cases this function must be used to set a
+    string which is \e appended to the string composed from the usual
+    argument list, with a delimiting space.
+
+    \note This function is available only on the Windows and Symbian
+    platforms.
+
+    \sa nativeArguments()
+*/
+void QProcess::setNativeArguments(const QString &arguments)
+{
+    Q_D(QProcess);
+    d->nativeArguments = arguments;
+}
+
+#endif
+
 /*!
     If QProcess has been assigned a working directory, this function returns
     the working directory that the QProcess will enter before the program has
@@ -2082,14 +2126,19 @@ QProcess::ExitStatus QProcess::exitStatus() const
     process.
 
     On Windows, arguments that contain spaces are wrapped in quotes.
+
+    If the process cannot be started, -2 is returned. If the process
+    crashes, -1 is returned. Otherwise, the process' exit code is
+    returned.
 */
 int QProcess::execute(const QString &program, const QStringList &arguments)
 {
     QProcess process;
     process.setReadChannelMode(ForwardedChannels);
     process.start(program, arguments);
-    process.waitForFinished(-1);
-    return process.exitCode();
+    if (!process.waitForFinished(-1))
+        return -2;
+    return process.exitStatus() == QProcess::NormalExit ? process.exitCode() : -1;
 }
 
 /*!
@@ -2104,8 +2153,9 @@ int QProcess::execute(const QString &program)
     QProcess process;
     process.setReadChannelMode(ForwardedChannels);
     process.start(program);
-    process.waitForFinished(-1);
-    return process.exitCode();
+    if (!process.waitForFinished(-1))
+        return -2;
+    return process.exitStatus() == QProcess::NormalExit ? process.exitCode() : -1;
 }
 
 /*!
diff --git a/src/corelib/io/qprocess.h b/src/corelib/io/qprocess.h
index f84b855..b07d742 100644
--- a/src/corelib/io/qprocess.h
+++ b/src/corelib/io/qprocess.h
@@ -148,6 +148,11 @@ public:
     void setStandardErrorFile(const QString &fileName, OpenMode mode = Truncate);
     void setStandardOutputProcess(QProcess *destination);
 
+#if defined(Q_OS_WIN) || defined(Q_OS_SYMBIAN)
+    QString nativeArguments() const;
+    void setNativeArguments(const QString &arguments);
+#endif
+
     QString workingDirectory() const;
     void setWorkingDirectory(const QString &dir);
 
diff --git a/src/corelib/io/qprocess_p.h b/src/corelib/io/qprocess_p.h
index 60b7b5a..8b7e3ff 100644
--- a/src/corelib/io/qprocess_p.h
+++ b/src/corelib/io/qprocess_p.h
@@ -181,6 +181,9 @@ public:
 
     QString program;
     QStringList arguments;
+#if defined(Q_OS_WIN) || defined(Q_OS_SYMBIAN)
+    QString nativeArguments;
+#endif
     QProcessEnvironment environment;
 
     QRingBuffer outputReadBuffer;
diff --git a/src/corelib/io/qprocess_symbian.cpp b/src/corelib/io/qprocess_symbian.cpp
index 92212fe..af657b2 100644
--- a/src/corelib/io/qprocess_symbian.cpp
+++ b/src/corelib/io/qprocess_symbian.cpp
@@ -219,7 +219,8 @@ static bool qt_rprocess_running(RProcess *proc)
     return false;
 }
 
-static void qt_create_symbian_commandline(const QStringList &arguments, QString &commandLine)
+static void qt_create_symbian_commandline(
+    const QStringList &arguments, const QString &nativeArguments, QString &commandLine)
 {
     for (int i = 0; i < arguments.size(); ++i) {
         QString tmp = arguments.at(i);
@@ -243,12 +244,14 @@ static void qt_create_symbian_commandline(const QStringList &arguments, QString
         }
     }
 
-    // Chop the extra trailing space if any arguments were appended
-    if (arguments.size())
+    if (!nativeArguments.isEmpty())
+        commandLine += nativeArguments;
+    else if (!commandLine.isEmpty()) // Chop the extra trailing space if any arguments were appended
         commandLine.chop(1);
 }
 
-static TInt qt_create_symbian_process(RProcess **proc, const QString &programName, const QStringList &arguments)
+static TInt qt_create_symbian_process(RProcess **proc,
+    const QString &programName, const QStringList &arguments, const QString &nativeArguments)
 {
     RProcess *newProc = NULL;
     newProc = new RProcess();
@@ -257,7 +260,7 @@ static TInt qt_create_symbian_process(RProcess **proc, const QString &programNam
         return KErrNoMemory;
 
     QString commandLine;
-    qt_create_symbian_commandline(arguments, commandLine);
+    qt_create_symbian_commandline(arguments, nativeArguments, commandLine);
 
     TPtrC program_ptr(reinterpret_cast<const TText*>(programName.constData()));
     TPtrC cmdline_ptr(reinterpret_cast<const TText*>(commandLine.constData()));
@@ -794,7 +797,7 @@ void QProcessPrivate::startProcess()
                          q, SLOT(_q_processDied()));
     }
 
-    TInt err = qt_create_symbian_process(&symbianProcess, program, arguments);
+    TInt err = qt_create_symbian_process(&symbianProcess, program, arguments, nativeArguments);
 
     if (err == KErrNone) {
         pid = symbianProcess->Id().Id();
@@ -1030,7 +1033,7 @@ bool QProcessPrivate::startDetached(const QString &program, const QStringList &a
 
     RProcess *newProc = NULL;
 
-    TInt err = qt_create_symbian_process(&newProc, program, arguments);
+    TInt err = qt_create_symbian_process(&newProc, program, arguments, QString());
 
     if (err == KErrNone) {
         if (pid)
diff --git a/src/corelib/io/qprocess_win.cpp b/src/corelib/io/qprocess_win.cpp
index cb25a58..702349f 100644
--- a/src/corelib/io/qprocess_win.cpp
+++ b/src/corelib/io/qprocess_win.cpp
@@ -366,6 +366,11 @@ void QProcessPrivate::startProcess()
     if (environment.d.constData())
         envlist = qt_create_environment(environment.d.constData()->hash);
 #endif
+    if (!nativeArguments.isEmpty()) {
+        if (!args.isEmpty())
+             args += QLatin1Char(' ');
+        args += nativeArguments;
+    }
 
 #if defined QPROCESS_DEBUG
     qDebug("Creating process");
diff --git a/src/corelib/thread/qthread_unix.cpp b/src/corelib/thread/qthread_unix.cpp
index 6b34b5f..d193b2e 100644
--- a/src/corelib/thread/qthread_unix.cpp
+++ b/src/corelib/thread/qthread_unix.cpp
@@ -247,6 +247,14 @@ void *QThreadPrivate::start(void *arg)
     data->symbian_thread_handle = RThread();
     TThreadId threadId = data->symbian_thread_handle.Id();
     data->symbian_thread_handle.Open(threadId);
+    // On symbian, threads other than the main thread are non critical by default
+    // This means a worker thread can crash without crashing the application - to
+    // use this feature, we would need to use RThread::Logon in the main thread
+    // to catch abnormal thread exit and emit the finished signal.
+    // For the sake of cross platform consistency, we set the thread as process critical
+    // - advanced users who want the symbian behaviour can change the critical
+    // attribute of the thread again once the app gains control in run()
+    User::SetCritical(User::EProcessCritical);
 #endif
 
     pthread_once(&current_thread_data_once, create_current_thread_data_key);
diff --git a/src/corelib/tools/qsimd_p.h b/src/corelib/tools/qsimd_p.h
index 58d2dcb..0ed9d5d 100644
--- a/src/corelib/tools/qsimd_p.h
+++ b/src/corelib/tools/qsimd_p.h
@@ -58,8 +58,7 @@ QT_BEGIN_HEADER
 #endif
 
 // SSE intrinsics
-#if defined(QT_HAVE_SSE2) && !defined(QT_BOOTSTRAPPED) && (defined(__SSE2__) \
-    || (defined(Q_CC_MSVC) && (defined(_M_X64) || _M_IX86_FP == 2)))
+#if defined(QT_HAVE_SSE2) && (defined(__SSE2__) || defined(Q_CC_MSVC))
 #if defined(QT_LINUXBASE)
 /// this is an evil hack - the posix_memalign declaration in LSB
 /// is wrong - see http://bugs.linuxbase.org/show_bug.cgi?id=2431
@@ -73,8 +72,10 @@ QT_BEGIN_HEADER
 #  include <emmintrin.h>
 #endif
 
+#if !defined(QT_BOOTSTRAPPED) && (!defined(Q_CC_MSVC) || (defined(_M_X64) || _M_IX86_FP == 2))
 #define QT_ALWAYS_HAVE_SSE2
 #endif
+#endif // defined(QT_HAVE_SSE2) && (defined(__SSE2__) || defined(Q_CC_MSVC))
 
 // NEON intrinsics
 #if defined(QT_HAVE_NEON)
diff --git a/src/gui/graphicsview/qgraphicsitem.cpp b/src/gui/graphicsview/qgraphicsitem.cpp
index 51dc543..848de2c 100644
--- a/src/gui/graphicsview/qgraphicsitem.cpp
+++ b/src/gui/graphicsview/qgraphicsitem.cpp
@@ -5510,6 +5510,9 @@ void QGraphicsItemPrivate::setSubFocus(QGraphicsItem *rootItem)
     // Update focus child chain. Stop at panels, or if this item
     // is hidden, stop at the first item with a visible parent.
     QGraphicsItem *parent = rootItem ? rootItem : q_ptr;
+    if (parent->panel() != q_ptr->panel())
+        return;
+
     do {
         // Clear any existing ancestor's subFocusItem.
         if (parent != q_ptr && parent->d_ptr->subFocusItem) {
diff --git a/src/gui/gui.pro b/src/gui/gui.pro
index dede9d0..41f1904 100644
--- a/src/gui/gui.pro
+++ b/src/gui/gui.pro
@@ -77,3 +77,129 @@ symbian {
     DEPLOYMENT = partial_upgrade $$DEPLOYMENT
 }
 
+contains(QMAKE_MAC_XARCH, no) {
+    DEFINES += QT_NO_MAC_XARCH
+} else {
+    mmx:DEFINES += QT_HAVE_MMX
+    3dnow:DEFINES += QT_HAVE_3DNOW
+    sse:DEFINES += QT_HAVE_SSE QT_HAVE_MMXEXT
+    sse2:DEFINES += QT_HAVE_SSE2
+    iwmmxt:DEFINES += QT_HAVE_IWMMXT
+
+    win32-g++*|!win32:!*-icc* {
+        mmx {
+            mmx_compiler.commands = $$QMAKE_CXX -c -Winline
+
+            mac {
+                mmx_compiler.commands += -Xarch_i386 -mmmx
+                mmx_compiler.commands += -Xarch_x86_64 -mmmx
+            } else {
+                mmx_compiler.commands += -mmmx
+            }
+
+            mmx_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+            mmx_compiler.dependency_type = TYPE_C
+            mmx_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+            mmx_compiler.input = MMX_SOURCES
+            mmx_compiler.variable_out = OBJECTS
+            mmx_compiler.name = compiling[mmx] ${QMAKE_FILE_IN}
+            silent:mmx_compiler.commands = @echo compiling[mmx] ${QMAKE_FILE_IN} && $$mmx_compiler.commands
+            QMAKE_EXTRA_COMPILERS += mmx_compiler
+        }
+        3dnow {
+            mmx3dnow_compiler.commands = $$QMAKE_CXX -c -Winline
+
+            mac {
+                mmx3dnow_compiler.commands += -Xarch_i386 -m3dnow -Xarch_i386 -mmmx
+                mmx3dnow_compiler.commands += -Xarch_x86_64 -m3dnow -Xarch_x86_64 -mmmx
+            } else {
+                mmx3dnow_compiler.commands += -m3dnow -mmmx
+            }
+
+            mmx3dnow_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+            mmx3dnow_compiler.dependency_type = TYPE_C
+            mmx3dnow_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+            mmx3dnow_compiler.input = MMX3DNOW_SOURCES
+            mmx3dnow_compiler.variable_out = OBJECTS
+            mmx3dnow_compiler.name = compiling[mmx3dnow] ${QMAKE_FILE_IN}
+            silent:mmx3dnow_compiler.commands = @echo compiling[mmx3dnow] ${QMAKE_FILE_IN} && $$mmx3dnow_compiler.commands
+            QMAKE_EXTRA_COMPILERS += mmx3dnow_compiler
+            sse {
+                sse3dnow_compiler.commands = $$QMAKE_CXX -c -Winline
+
+                mac {
+                    sse3dnow_compiler.commands += -Xarch_i386 -m3dnow -Xarch_i386 -msse
+                    sse3dnow_compiler.commands += -Xarch_x86_64 -m3dnow -Xarch_x86_64 -msse
+                } else {
+                    sse3dnow_compiler.commands += -m3dnow -msse
+                }
+
+                sse3dnow_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+                sse3dnow_compiler.dependency_type = TYPE_C
+                sse3dnow_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+                sse3dnow_compiler.input = SSE3DNOW_SOURCES
+                sse3dnow_compiler.variable_out = OBJECTS
+                sse3dnow_compiler.name = compiling[sse3dnow] ${QMAKE_FILE_IN}
+                silent:sse3dnow_compiler.commands = @echo compiling[sse3dnow] ${QMAKE_FILE_IN} && $$sse3dnow_compiler.commands
+                QMAKE_EXTRA_COMPILERS += sse3dnow_compiler
+            }
+        }
+        sse {
+            sse_compiler.commands = $$QMAKE_CXX -c -Winline
+
+            mac {
+                sse_compiler.commands += -Xarch_i386 -msse
+                sse_compiler.commands += -Xarch_x86_64 -msse
+            } else {
+                sse_compiler.commands += -msse
+            }
+
+            sse_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+            sse_compiler.dependency_type = TYPE_C
+            sse_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+            sse_compiler.input = SSE_SOURCES
+            sse_compiler.variable_out = OBJECTS
+            sse_compiler.name = compiling[sse] ${QMAKE_FILE_IN}
+            silent:sse_compiler.commands = @echo compiling[sse] ${QMAKE_FILE_IN} && $$sse_compiler.commands
+            QMAKE_EXTRA_COMPILERS += sse_compiler
+        }
+        sse2 {
+            sse2_compiler.commands = $$QMAKE_CXX -c -Winline
+
+            mac {
+                sse2_compiler.commands += -Xarch_i386 -msse2
+                sse2_compiler.commands += -Xarch_x86_64 -msse2
+            } else {
+                sse2_compiler.commands += -msse2
+            }
+
+            sse2_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+            sse2_compiler.dependency_type = TYPE_C
+            sse2_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+            sse2_compiler.input = SSE2_SOURCES
+            sse2_compiler.variable_out = OBJECTS
+            sse2_compiler.name = compiling[sse2] ${QMAKE_FILE_IN}
+            silent:sse2_compiler.commands = @echo compiling[sse2] ${QMAKE_FILE_IN} && $$sse2_compiler.commands
+            QMAKE_EXTRA_COMPILERS += sse2_compiler
+        }
+        iwmmxt {
+            iwmmxt_compiler.commands = $$QMAKE_CXX -c -Winline
+            iwmmxt_compiler.commands += -mcpu=iwmmxt
+            iwmmxt_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+            iwmmxt_compiler.dependency_type = TYPE_C
+            iwmmxt_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+            iwmmxt_compiler.input = IWMMXT_SOURCES
+            iwmmxt_compiler.variable_out = OBJECTS
+            iwmmxt_compiler.name = compiling[iwmmxt] ${QMAKE_FILE_IN}
+            silent:iwmmxt_compiler.commands = @echo compiling[iwmmxt] ${QMAKE_FILE_IN} && $$iwmmxt_compiler.commands
+            QMAKE_EXTRA_COMPILERS += iwmmxt_compiler
+        }
+    } else {
+        mmx: SOURCES += $$MMX_SOURCES
+        3dnow: SOURCES += $$MMX3DNOW_SOURCES
+        3dnow:sse: SOURCES += $$SSE3DNOW_SOURCES
+        sse: SOURCES += $$SSE_SOURCES
+        sse2: SOURCES += $$SSE2_SOURCES
+        iwmmxt: SOURCES += $$IWMMXT_SOURCES
+    }
+}
diff --git a/src/gui/image/image.pri b/src/gui/image/image.pri
index 9f0c87e..3a02d56 100644
--- a/src/gui/image/image.pri
+++ b/src/gui/image/image.pri
@@ -92,3 +92,6 @@ contains(QT_CONFIG, jpeg):include($$PWD/qjpeghandler.pri)
 contains(QT_CONFIG, mng):include($$PWD/qmnghandler.pri)
 contains(QT_CONFIG, tiff):include($$PWD/qtiffhandler.pri)
 contains(QT_CONFIG, gif):include($$PWD/qgifhandler.pri)
+
+# SIMD
+SSE2_SOURCES += image/qimage_sse2.cpp
diff --git a/src/gui/image/qimage.cpp b/src/gui/image/qimage.cpp
index 79f266d..e5930ac 100644
--- a/src/gui/image/qimage.cpp
+++ b/src/gui/image/qimage.cpp
@@ -58,6 +58,7 @@
 #include <private/qmemrotate_p.h>
 #include <private/qpixmapdata_p.h>
 #include <private/qimagescale_p.h>
+#include <private/qsimd_p.h>
 
 #include <qhash.h>
 
@@ -209,7 +210,7 @@ QImageData * QImageData::create(const QSize &size, QImage::Format format, int nu
         break;
     }
 
-    const int bytes_per_line = ((width * depth + 31) >> 5) << 2; // bytes per scanline (must be multiple of 8)
+    const int bytes_per_line = ((width * depth + 31) >> 5) << 2; // bytes per scanline (must be multiple of 4)
 
     // sanity check for potential overflows
     if (INT_MAX/depth < width
@@ -3630,7 +3631,7 @@ static const Image_Converter converter_map[QImage::NImageFormats][QImage::NImage
     } // Format_ARGB4444_Premultiplied
 };
 
-static const InPlace_Image_Converter inplace_converter_map[QImage::NImageFormats][QImage::NImageFormats] =
+static InPlace_Image_Converter inplace_converter_map[QImage::NImageFormats][QImage::NImageFormats] =
 {
     {
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
@@ -3727,6 +3728,19 @@ static const InPlace_Image_Converter inplace_converter_map[QImage::NImageFormats
     } // Format_ARGB4444_Premultiplied
 };
 
+void qInitImageConversions()
+{
+    const uint features = qDetectCPUFeatures();
+    Q_UNUSED(features);
+
+#ifdef QT_HAVE_SSE2
+    if (features & SSE2) {
+        extern bool convert_ARGB_to_ARGB_PM_inplace_sse2(QImageData *data, Qt::ImageConversionFlags);
+        inplace_converter_map[QImage::Format_ARGB32][QImage::Format_ARGB32_Premultiplied] = convert_ARGB_to_ARGB_PM_inplace_sse2;
+    }
+#endif
+}
+
 /*!
     Returns a copy of the image in the given \a format.
 
diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h
index f1a0c47..c687448 100644
--- a/src/gui/image/qimage_p.h
+++ b/src/gui/image/qimage_p.h
@@ -63,6 +63,8 @@
 
 QT_BEGIN_NAMESPACE
 
+class QImageWriter;
+
 struct Q_GUI_EXPORT QImageData {        // internal image data
     QImageData();
     ~QImageData();
@@ -108,6 +110,8 @@ struct Q_GUI_EXPORT QImageData {        // internal image data
     QPaintEngine *paintEngine;
 };
 
+void qInitImageConversions();
+
 QT_END_NAMESPACE
 
 #endif
diff --git a/src/gui/image/qimage_sse2.cpp b/src/gui/image/qimage_sse2.cpp
new file mode 100644
index 0000000..82d49a6
--- /dev/null
+++ b/src/gui/image/qimage_sse2.cpp
@@ -0,0 +1,109 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtGui module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#include "qimage.h"
+#include <private/qimage_p.h>
+#include <private/qsimd_p.h>
+#include <private/qdrawhelper_p.h>
+#include <private/qdrawingprimitive_sse2_p.h>
+
+#ifdef QT_HAVE_SSE2
+
+QT_BEGIN_NAMESPACE
+
+bool convert_ARGB_to_ARGB_PM_inplace_sse2(QImageData *data, Qt::ImageConversionFlags)
+{
+    Q_ASSERT(data->format == QImage::Format_ARGB32);
+
+    // extra pixels on each line
+    const int spare = data->width & 3;
+    // width in pixels of the pad at the end of each line
+    const int pad = (data->bytes_per_line >> 2) - data->width;
+    const int iter = data->width >> 2;
+    int height = data->height;
+
+    const __m128i alphaMask = _mm_set1_epi32(0xff000000);
+    const __m128i nullVector = _mm_setzero_si128();
+    const __m128i half = _mm_set1_epi16(0x80);
+    const __m128i colorMask = _mm_set1_epi32(0x00ff00ff);
+
+    __m128i *d = reinterpret_cast<__m128i*>(data->data);
+    while (height--) {
+        const __m128i *end = d + iter;
+
+        for (; d != end; ++d) {
+            const __m128i srcVector = _mm_loadu_si128(d);
+            const __m128i srcVectorAlpha = _mm_and_si128(srcVector, alphaMask);
+            if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, alphaMask)) == 0xffff) {
+                // opaque, data is unchanged
+            } else if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, nullVector)) == 0xffff) {
+                // fully transparent
+                _mm_storeu_si128(d, nullVector);
+            } else {
+                __m128i alphaChannel = _mm_srli_epi32(srcVector, 24);
+                alphaChannel = _mm_or_si128(alphaChannel, _mm_slli_epi32(alphaChannel, 16));
+
+                __m128i result;
+                BYTE_MUL_SSE2(result, srcVector, alphaChannel, colorMask, half);
+                result = _mm_or_si128(_mm_andnot_si128(alphaMask, result), srcVectorAlpha);
+                _mm_storeu_si128(d, result);
+            }
+        }
+
+        QRgb *p = reinterpret_cast<QRgb*>(d);
+        QRgb *pe = p+spare;
+        for (; p != pe; ++p) {
+            if (*p < 0x00ffffff)
+                *p = 0;
+            else if (*p < 0xff000000)
+                *p = PREMUL(*p);
+        }
+
+        d = reinterpret_cast<__m128i*>(p+pad);
+    }
+
+    data->format = QImage::Format_ARGB32_Premultiplied;
+    return true;
+}
+
+QT_END_NAMESPACE
+
+#endif // QT_HAVE_SSE2
diff --git a/src/gui/kernel/qapplication.cpp b/src/gui/kernel/qapplication.cpp
index ccfe88c..94211fd 100644
--- a/src/gui/kernel/qapplication.cpp
+++ b/src/gui/kernel/qapplication.cpp
@@ -902,6 +902,7 @@ QApplication::QApplication(Display *dpy, int &argc, char **argv,
 #endif // Q_WS_X11
 
 extern void qInitDrawhelperAsm();
+extern void qInitImageConversions();
 extern int qRegisterGuiVariant();
 extern int qUnregisterGuiVariant();
 #ifndef QT_NO_STATEMACHINE
@@ -959,6 +960,8 @@ void QApplicationPrivate::initialize()
 
     // Set up which span functions should be used in raster engine...
     qInitDrawhelperAsm();
+    // and QImage conversion functions
+    qInitImageConversions();
 
 #ifndef QT_NO_WHEELEVENT
     QApplicationPrivate::wheel_scroll_lines = 3;
diff --git a/src/gui/kernel/qsoftkeymanager.cpp b/src/gui/kernel/qsoftkeymanager.cpp
index 04e4685..54e6317 100644
--- a/src/gui/kernel/qsoftkeymanager.cpp
+++ b/src/gui/kernel/qsoftkeymanager.cpp
@@ -162,6 +162,7 @@ void QSoftKeyManager::sendKeyEvent()
 
 void QSoftKeyManager::updateSoftKeys()
 {
+    QSoftKeyManager::instance()->d_func()->pendingUpdate = true;
     QEvent *event = new QEvent(QEvent::UpdateSoftKeys);
     QApplication::postEvent(QSoftKeyManager::instance(), event);
 }
@@ -250,6 +251,7 @@ bool QSoftKeyManager::handleUpdateSoftKeys()
     }
 
     d->updateSoftKeys_sys();
+    d->pendingUpdate = false;
     return true;
 }
 
@@ -275,6 +277,9 @@ bool QSoftKeyManager::event(QEvent *e)
 #ifdef Q_WS_S60
 bool QSoftKeyManager::handleCommand(int command)
 {
+    if (QSoftKeyManager::instance()->d_func()->pendingUpdate)
+        (void)QSoftKeyManager::instance()->handleUpdateSoftKeys();
+
     return static_cast<QSoftKeyManagerPrivateS60*>(QSoftKeyManager::instance()->d_func())->handleCommand(command);
 }
 #endif
diff --git a/src/gui/kernel/qsoftkeymanager_common_p.h b/src/gui/kernel/qsoftkeymanager_common_p.h
index 04ddf7d..1b364d4 100644
--- a/src/gui/kernel/qsoftkeymanager_common_p.h
+++ b/src/gui/kernel/qsoftkeymanager_common_p.h
@@ -71,7 +71,7 @@ protected:
     QHash<QAction*, Qt::Key> keyedActions;
     QMultiHash<int, QAction*> requestedSoftKeyActions;
     QWidget *initialSoftKeySource;
-
+    bool pendingUpdate;
 };
 
 QT_END_NAMESPACE
diff --git a/src/gui/kernel/qstandardgestures.cpp b/src/gui/kernel/qstandardgestures.cpp
index 8a3e89e..62d8a53 100644
--- a/src/gui/kernel/qstandardgestures.cpp
+++ b/src/gui/kernel/qstandardgestures.cpp
@@ -45,6 +45,7 @@
 #include "qevent.h"
 #include "qwidget.h"
 #include "qabstractscrollarea.h"
+#include <qgraphicssceneevent.h>
 #include "qdebug.h"
 
 #ifndef QT_NO_GESTURES
@@ -509,49 +510,65 @@ QTapAndHoldGestureRecognizer::recognize(QGesture *state, QObject *object,
     if (object == state && event->type() == QEvent::Timer) {
         q->killTimer(d->timerId);
         d->timerId = 0;
-        return QGestureRecognizer::Ignore | QGestureRecognizer::ConsumeEventHint;
+        return QGestureRecognizer::FinishGesture | QGestureRecognizer::ConsumeEventHint;
     }
 
     const QTouchEvent *ev = static_cast<const QTouchEvent *>(event);
-
-    QGestureRecognizer::Result result = QGestureRecognizer::CancelGesture;
+    const QMouseEvent *me = static_cast<const QMouseEvent *>(event);
+    const QGraphicsSceneMouseEvent *gsme = static_cast<const QGraphicsSceneMouseEvent *>(event);
 
     enum { TimerInterval = 2000 };
     enum { TapRadius = 40 };
 
     switch (event->type()) {
+    case QEvent::GraphicsSceneMousePress:
+        d->position = gsme->screenPos();
+        q->setHotSpot(d->position);
+        if (d->timerId)
+            q->killTimer(d->timerId);
+        d->timerId = q->startTimer(TimerInterval);
+        return QGestureRecognizer::MayBeGesture; // we don't show a sign of life until the timeout
+    case QEvent::MouseButtonPress:
+        d->position = me->globalPos();
+        q->setHotSpot(d->position);
+        if (d->timerId)
+            q->killTimer(d->timerId);
+        d->timerId = q->startTimer(TimerInterval);
+        return QGestureRecognizer::MayBeGesture; // we don't show a sign of life until the timeout
     case QEvent::TouchBegin:
-        d->position = ev->touchPoints().at(0).pos();
+        d->position = ev->touchPoints().at(0).startScreenPos();
+        q->setHotSpot(d->position);
         if (d->timerId)
             q->killTimer(d->timerId);
         d->timerId = q->startTimer(TimerInterval);
-        q->setHotSpot(ev->touchPoints().at(0).startScreenPos());
-        result = QGestureRecognizer::TriggerGesture;
-        break;
+        return QGestureRecognizer::MayBeGesture; // we don't show a sign of life until the timeout
+    case QEvent::GraphicsSceneMouseRelease:
+    case QEvent::MouseButtonRelease:
     case QEvent::TouchEnd:
-        if (d->timerId)
-            result = QGestureRecognizer::CancelGesture;
-        else
-            result = QGestureRecognizer::FinishGesture;
-        break;
+        return QGestureRecognizer::CancelGesture; // get out of the MayBeGesture state
     case QEvent::TouchUpdate:
-        if (q->state() != Qt::NoGesture && ev->touchPoints().size() == 1) {
+        if (d->timerId && ev->touchPoints().size() == 1) {
             QTouchEvent::TouchPoint p = ev->touchPoints().at(0);
             QPoint delta = p.pos().toPoint() - p.startPos().toPoint();
             if (delta.manhattanLength() <= TapRadius)
-                result = QGestureRecognizer::TriggerGesture;
+                return QGestureRecognizer::MayBeGesture;
         }
-        break;
-    case QEvent::MouseButtonPress:
-    case QEvent::MouseMove:
-    case QEvent::MouseButtonRelease:
-        result = QGestureRecognizer::Ignore;
-        break;
+        return QGestureRecognizer::CancelGesture;
+    case QEvent::MouseMove: {
+        QPoint delta = me->globalPos() - d->position.toPoint();
+        if (d->timerId && delta.manhattanLength() <= TapRadius)
+            return QGestureRecognizer::MayBeGesture;
+        return QGestureRecognizer::CancelGesture;
+    }
+    case QEvent::GraphicsSceneMouseMove: {
+        QPoint delta = gsme->screenPos() - d->position.toPoint();
+        if (d->timerId && delta.manhattanLength() <= TapRadius)
+            return QGestureRecognizer::MayBeGesture;
+        return QGestureRecognizer::CancelGesture;
+    }
     default:
-        result = QGestureRecognizer::Ignore;
-        break;
+        return QGestureRecognizer::Ignore;
     }
-    return result;
 }
 
 void QTapAndHoldGestureRecognizer::reset(QGesture *state)
diff --git a/src/gui/painting/painting.pri b/src/gui/painting/painting.pri
index 07aabc9..4023f65 100644
--- a/src/gui/painting/painting.pri
+++ b/src/gui/painting/painting.pri
@@ -202,154 +202,17 @@ x11|embedded {
         DEFINES += QT_NO_CUPS QT_NO_LPR
 }
 
-contains(QMAKE_MAC_XARCH, no) {
-    DEFINES += QT_NO_MAC_XARCH
-} else:if(mmx|3dnow|sse|sse2|iwmmxt) {
+if(mmx|3dnow|sse|sse2|iwmmxt) {
     HEADERS += painting/qdrawhelper_x86_p.h \
                painting/qdrawhelper_mmx_p.h \
-               painting/qdrawhelper_sse_p.h
-    mmx {
-        DEFINES += QT_HAVE_MMX
-        MMX_SOURCES += painting/qdrawhelper_mmx.cpp
-    }
-    3dnow {
-        DEFINES += QT_HAVE_3DNOW
-        MMX3DNOW_SOURCES += painting/qdrawhelper_mmx3dnow.cpp
-        sse {
-            SSE3DNOW_SOURCES += painting/qdrawhelper_sse3dnow.cpp
-        }
-    }
-    sse {
-        DEFINES += QT_HAVE_SSE
-        SSE_SOURCES += painting/qdrawhelper_sse.cpp
-
-        DEFINES += QT_HAVE_MMXEXT
-    }
-    sse2 {
-        DEFINES += QT_HAVE_SSE2
-        SSE2_SOURCES += painting/qdrawhelper_sse2.cpp
-    }
-    iwmmxt {
-        DEFINES += QT_HAVE_IWMMXT
-        IWMMXT_SOURCES += painting/qdrawhelper_iwmmxt.cpp
-    }
-
-    win32-g++*|!win32:!*-icc* {
-        mmx {
-            mmx_compiler.commands = $$QMAKE_CXX -c -Winline
-
-            mac {
-                mmx_compiler.commands += -Xarch_i386 -mmmx
-                mmx_compiler.commands += -Xarch_x86_64 -mmmx
-            } else {
-                mmx_compiler.commands += -mmmx
-            }
-
-            mmx_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            mmx_compiler.dependency_type = TYPE_C
-            mmx_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-            mmx_compiler.input = MMX_SOURCES
-            mmx_compiler.variable_out = OBJECTS
-            mmx_compiler.name = compiling[mmx] ${QMAKE_FILE_IN}
-            silent:mmx_compiler.commands = @echo compiling[mmx] ${QMAKE_FILE_IN} && $$mmx_compiler.commands
-            QMAKE_EXTRA_COMPILERS += mmx_compiler
-        }
-        3dnow {
-            mmx3dnow_compiler.commands = $$QMAKE_CXX -c -Winline
-
-            mac {
-                mmx3dnow_compiler.commands += -Xarch_i386 -m3dnow -Xarch_i386 -mmmx
-                mmx3dnow_compiler.commands += -Xarch_x86_64 -m3dnow -Xarch_x86_64 -mmmx
-            } else {
-                mmx3dnow_compiler.commands += -m3dnow -mmmx
-            }
-
-            mmx3dnow_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            mmx3dnow_compiler.dependency_type = TYPE_C
-            mmx3dnow_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-            mmx3dnow_compiler.input = MMX3DNOW_SOURCES
-            mmx3dnow_compiler.variable_out = OBJECTS
-            mmx3dnow_compiler.name = compiling[mmx3dnow] ${QMAKE_FILE_IN}
-            silent:mmx3dnow_compiler.commands = @echo compiling[mmx3dnow] ${QMAKE_FILE_IN} && $$mmx3dnow_compiler.commands
-            QMAKE_EXTRA_COMPILERS += mmx3dnow_compiler
-            sse {
-                sse3dnow_compiler.commands = $$QMAKE_CXX -c -Winline
-
-                mac {
-                    sse3dnow_compiler.commands += -Xarch_i386 -m3dnow -Xarch_i386 -msse
-                    sse3dnow_compiler.commands += -Xarch_x86_64 -m3dnow -Xarch_x86_64 -msse
-                } else {
-                    sse3dnow_compiler.commands += -m3dnow -msse
-                }
-
-                sse3dnow_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-                sse3dnow_compiler.dependency_type = TYPE_C
-                sse3dnow_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-                sse3dnow_compiler.input = SSE3DNOW_SOURCES
-                sse3dnow_compiler.variable_out = OBJECTS
-                sse3dnow_compiler.name = compiling[sse3dnow] ${QMAKE_FILE_IN}
-                silent:sse3dnow_compiler.commands = @echo compiling[sse3dnow] ${QMAKE_FILE_IN} && $$sse3dnow_compiler.commands
-                QMAKE_EXTRA_COMPILERS += sse3dnow_compiler
-            }
-        }
-        sse {
-            sse_compiler.commands = $$QMAKE_CXX -c -Winline
-
-            mac {
-                sse_compiler.commands += -Xarch_i386 -msse
-                sse_compiler.commands += -Xarch_x86_64 -msse
-            } else {
-                sse_compiler.commands += -msse
-            }
-
-            sse_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            sse_compiler.dependency_type = TYPE_C
-            sse_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-            sse_compiler.input = SSE_SOURCES
-            sse_compiler.variable_out = OBJECTS
-            sse_compiler.name = compiling[sse] ${QMAKE_FILE_IN}
-            silent:sse_compiler.commands = @echo compiling[sse] ${QMAKE_FILE_IN} && $$sse_compiler.commands
-            QMAKE_EXTRA_COMPILERS += sse_compiler
-        }
-        sse2 {
-            sse2_compiler.commands = $$QMAKE_CXX -c -Winline
-
-            mac {
-                sse2_compiler.commands += -Xarch_i386 -msse2
-                sse2_compiler.commands += -Xarch_x86_64 -msse2
-            } else {
-                sse2_compiler.commands += -msse2
-            }
-
-            sse2_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            sse2_compiler.dependency_type = TYPE_C
-            sse2_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-            sse2_compiler.input = SSE2_SOURCES
-            sse2_compiler.variable_out = OBJECTS
-            sse2_compiler.name = compiling[sse2] ${QMAKE_FILE_IN}
-            silent:sse2_compiler.commands = @echo compiling[sse2] ${QMAKE_FILE_IN} && $$sse2_compiler.commands
-            QMAKE_EXTRA_COMPILERS += sse2_compiler
-        }
-        iwmmxt {
-            iwmmxt_compiler.commands = $$QMAKE_CXX -c -Winline
-            iwmmxt_compiler.commands += -mcpu=iwmmxt
-            iwmmxt_compiler.commands += $(CXXFLAGS) $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            iwmmxt_compiler.dependency_type = TYPE_C
-            iwmmxt_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
-            iwmmxt_compiler.input = IWMMXT_SOURCES
-            iwmmxt_compiler.variable_out = OBJECTS
-            iwmmxt_compiler.name = compiling[iwmmxt] ${QMAKE_FILE_IN}
-            silent:iwmmxt_compiler.commands = @echo compiling[iwmmxt] ${QMAKE_FILE_IN} && $$iwmmxt_compiler.commands
-            QMAKE_EXTRA_COMPILERS += iwmmxt_compiler
-        }
-    } else {
-        mmx: SOURCES += $$MMX_SOURCES
-        3dnow: SOURCES += $$MMX3DNOW_SOURCES
-        3dnow:sse: SOURCES += $$SSE3DNOW_SOURCES
-        sse: SOURCES += $$SSE_SOURCES
-        sse2: SOURCES += $$SSE2_SOURCES
-        iwmmxt: SOURCES += $$IWMMXT_SOURCES
-    }
+               painting/qdrawhelper_sse_p.h \
+               painting/qdrawingprimitive_sse2_p.h
+    MMX_SOURCES += painting/qdrawhelper_mmx.cpp
+    MMX3DNOW_SOURCES += painting/qdrawhelper_mmx3dnow.cpp
+    SSE3DNOW_SOURCES += painting/qdrawhelper_sse3dnow.cpp
+    SSE_SOURCES += painting/qdrawhelper_sse.cpp
+    SSE2_SOURCES += painting/qdrawhelper_sse2.cpp
+    IWMMXT_SOURCES += painting/qdrawhelper_iwmmxt.cpp
 }
 
 x11 {
diff --git a/src/gui/painting/qdrawhelper_sse2.cpp b/src/gui/painting/qdrawhelper_sse2.cpp
index 6cd8688..346e177 100644
--- a/src/gui/painting/qdrawhelper_sse2.cpp
+++ b/src/gui/painting/qdrawhelper_sse2.cpp
@@ -43,176 +43,12 @@
 
 #ifdef QT_HAVE_SSE2
 
+#include <private/qsimd_p.h>
+#include <private/qdrawingprimitive_sse2_p.h>
 #include <private/qpaintengine_raster_p.h>
 
-#ifdef QT_LINUXBASE
-// this is an evil hack - the posix_memalign declaration in LSB
-// is wrong - see http://bugs.linuxbase.org/show_bug.cgi?id=2431
-#  define posix_memalign _lsb_hack_posix_memalign
-#  include <emmintrin.h>
-#  undef posix_memalign
-#else
-#  include <emmintrin.h>
-#endif
-
 QT_BEGIN_NAMESPACE
 
-/*
- * Multiply the components of pixelVector by alphaChannel
- * Each 32bits components of alphaChannel must be in the form 0x00AA00AA
- * colorMask must have 0x00ff00ff on each 32 bits component
- * half must have the value 128 (0x80) for each 32 bits compnent
- */
-#define BYTE_MUL_SSE2(result, pixelVector, alphaChannel, colorMask, half) \
-{ \
-    /* 1. separate the colors in 2 vectors so each color is on 16 bits \
-       (in order to be multiplied by the alpha \
-       each 32 bit of dstVectorAG are in the form 0x00AA00GG \
-       each 32 bit of dstVectorRB are in the form 0x00RR00BB */\
-    __m128i pixelVectorAG = _mm_srli_epi16(pixelVector, 8); \
-    __m128i pixelVectorRB = _mm_and_si128(pixelVector, colorMask); \
- \
-    /* 2. multiply the vectors by the alpha channel */\
-    pixelVectorAG = _mm_mullo_epi16(pixelVectorAG, alphaChannel); \
-    pixelVectorRB = _mm_mullo_epi16(pixelVectorRB, alphaChannel); \
- \
-    /* 3. devide by 255, that's the tricky part. \
-       we do it like for BYTE_MUL(), with bit shift: X/255 ~= (X + X/256 + rounding)/256 */ \
-    /** so first (X + X/256 + rounding) */\
-    pixelVectorRB = _mm_add_epi16(pixelVectorRB, _mm_srli_epi16(pixelVectorRB, 8)); \
-    pixelVectorRB = _mm_add_epi16(pixelVectorRB, half); \
-    pixelVectorAG = _mm_add_epi16(pixelVectorAG, _mm_srli_epi16(pixelVectorAG, 8)); \
-    pixelVectorAG = _mm_add_epi16(pixelVectorAG, half); \
- \
-    /** second devide by 256 */\
-    pixelVectorRB = _mm_srli_epi16(pixelVectorRB, 8); \
-    /** for AG, we could >> 8 to divide followed by << 8 to put the \
-        bytes in the correct position. By masking instead, we execute \
-        only one instruction */\
-    pixelVectorAG = _mm_andnot_si128(colorMask, pixelVectorAG); \
- \
-    /* 4. combine the 2 pairs of colors */ \
-    result = _mm_or_si128(pixelVectorAG, pixelVectorRB); \
-}
-
-/*
- * Each 32bits components of alphaChannel must be in the form 0x00AA00AA
- * oneMinusAlphaChannel must be 255 - alpha for each 32 bits component
- * colorMask must have 0x00ff00ff on each 32 bits component
- * half must have the value 128 (0x80) for each 32 bits compnent
- */
-#define INTERPOLATE_PIXEL_255_SSE2(result, srcVector, dstVector, alphaChannel, oneMinusAlphaChannel, colorMask, half) { \
-    /* interpolate AG */\
-    __m128i srcVectorAG = _mm_srli_epi16(srcVector, 8); \
-    __m128i dstVectorAG = _mm_srli_epi16(dstVector, 8); \
-    __m128i srcVectorAGalpha = _mm_mullo_epi16(srcVectorAG, alphaChannel); \
-    __m128i dstVectorAGoneMinusAlphalpha = _mm_mullo_epi16(dstVectorAG, oneMinusAlphaChannel); \
-    __m128i finalAG = _mm_add_epi16(srcVectorAGalpha, dstVectorAGoneMinusAlphalpha); \
-    finalAG = _mm_add_epi16(finalAG, _mm_srli_epi16(finalAG, 8)); \
-    finalAG = _mm_add_epi16(finalAG, half); \
-    finalAG = _mm_andnot_si128(colorMask, finalAG); \
- \
-    /* interpolate RB */\
-    __m128i srcVectorRB = _mm_and_si128(srcVector, colorMask); \
-    __m128i dstVectorRB = _mm_and_si128(dstVector, colorMask); \
-    __m128i srcVectorRBalpha = _mm_mullo_epi16(srcVectorRB, alphaChannel); \
-    __m128i dstVectorRBoneMinusAlphalpha = _mm_mullo_epi16(dstVectorRB, oneMinusAlphaChannel); \
-    __m128i finalRB = _mm_add_epi16(srcVectorRBalpha, dstVectorRBoneMinusAlphalpha); \
-    finalRB = _mm_add_epi16(finalRB, _mm_srli_epi16(finalRB, 8)); \
-    finalRB = _mm_add_epi16(finalRB, half); \
-    finalRB = _mm_srli_epi16(finalRB, 8); \
- \
-    /* combine */\
-    result = _mm_or_si128(finalAG, finalRB); \
-}
-
-// Basically blend src over dst with the const alpha defined as constAlphaVector.
-// nullVector, half, one, colorMask are constant accross the whole image/texture, and should be defined as:
-//const __m128i nullVector = _mm_set1_epi32(0);
-//const __m128i half = _mm_set1_epi16(0x80);
-//const __m128i one = _mm_set1_epi16(0xff);
-//const __m128i colorMask = _mm_set1_epi32(0x00ff00ff);
-//const __m128i alphaMask = _mm_set1_epi32(0xff000000);
-//
-// The computation being done is:
-// result = s + d * (1-alpha)
-// with shortcuts if fully opaque or fully transparent.
-#define BLEND_SOURCE_OVER_ARGB32_SSE2(dst, src, length, nullVector, half, one, colorMask, alphaMask) { \
-    int x = 0; \
-    for (; x < length-3; x += 4) { \
-        const __m128i srcVector = _mm_loadu_si128((__m128i *)&src[x]); \
-        const __m128i srcVectorAlpha = _mm_and_si128(srcVector, alphaMask); \
-        if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, alphaMask)) == 0xffff) { \
-            /* all opaque */ \
-            _mm_storeu_si128((__m128i *)&dst[x], srcVector); \
-        } else if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, nullVector)) != 0xffff) { \
-            /* not fully transparent */ \
-            /* extract the alpha channel on 2 x 16 bits */ \
-            /* so we have room for the multiplication */ \
-            /* each 32 bits will be in the form 0x00AA00AA */ \
-            /* with A being the 1 - alpha */ \
-            __m128i alphaChannel = _mm_srli_epi32(srcVector, 24); \
-            alphaChannel = _mm_or_si128(alphaChannel, _mm_slli_epi32(alphaChannel, 16)); \
-            alphaChannel = _mm_sub_epi16(one, alphaChannel); \
- \
-            const __m128i dstVector = _mm_loadu_si128((__m128i *)&dst[x]); \
-            __m128i destMultipliedByOneMinusAlpha; \
-            BYTE_MUL_SSE2(destMultipliedByOneMinusAlpha, dstVector, alphaChannel, colorMask, half); \
- \
-            /* result = s + d * (1-alpha) */\
-            const __m128i result = _mm_add_epi8(srcVector, destMultipliedByOneMinusAlpha); \
-            _mm_storeu_si128((__m128i *)&dst[x], result); \
-        } \
-    } \
-    for (; x < length; ++x) { \
-        uint s = src[x]; \
-        if (s >= 0xff000000) \
-            dst[x] = s; \
-        else if (s != 0) \
-            dst[x] = s + BYTE_MUL(dst[x], qAlpha(~s)); \
-    } \
-}
-
-// Basically blend src over dst with the const alpha defined as constAlphaVector.
-// nullVector, half, one, colorMask are constant accross the whole image/texture, and should be defined as:
-//const __m128i nullVector = _mm_set1_epi32(0);
-//const __m128i half = _mm_set1_epi16(0x80);
-//const __m128i one = _mm_set1_epi16(0xff);
-//const __m128i colorMask = _mm_set1_epi32(0x00ff00ff);
-//
-// The computation being done is:
-// dest = (s + d * sia) * ca + d * cia
-//      = s * ca + d * (sia * ca + cia)
-//      = s * ca + d * (1 - sa*ca)
-#define BLEND_SOURCE_OVER_ARGB32_WITH_CONST_ALPHA_SSE2(dst, src, length, nullVector, half, one, colorMask, constAlphaVector) \
-{ \
-    int x = 0; \
-    for (; x < length-3; x += 4) { \
-        __m128i srcVector = _mm_loadu_si128((__m128i *)&src[x]); \
-        if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVector, nullVector)) != 0xffff) { \
-            BYTE_MUL_SSE2(srcVector, srcVector, constAlphaVector, colorMask, half); \
-\
-            __m128i alphaChannel = _mm_srli_epi32(srcVector, 24); \
-            alphaChannel = _mm_or_si128(alphaChannel, _mm_slli_epi32(alphaChannel, 16)); \
-            alphaChannel = _mm_sub_epi16(one, alphaChannel); \
- \
-            const __m128i dstVector = _mm_loadu_si128((__m128i *)&dst[x]); \
-            __m128i destMultipliedByOneMinusAlpha; \
-            BYTE_MUL_SSE2(destMultipliedByOneMinusAlpha, dstVector, alphaChannel, colorMask, half); \
- \
-            const __m128i result = _mm_add_epi8(srcVector, destMultipliedByOneMinusAlpha); \
-            _mm_storeu_si128((__m128i *)&dst[x], result); \
-        } \
-    } \
-    for (; x < length; ++x) { \
-        quint32 s = src[x]; \
-        if (s != 0) { \
-            s = BYTE_MUL(s, const_alpha); \
-            dst[x] = s + BYTE_MUL(dst[x], qAlpha(~s)); \
-        } \
-    } \
-}
-
 void qt_blend_argb32_on_argb32_sse2(uchar *destPixels, int dbpl,
                                     const uchar *srcPixels, int sbpl,
                                     int w, int h,
diff --git a/src/gui/painting/qdrawingprimitive_sse2_p.h b/src/gui/painting/qdrawingprimitive_sse2_p.h
new file mode 100644
index 0000000..3c96946
--- /dev/null
+++ b/src/gui/painting/qdrawingprimitive_sse2_p.h
@@ -0,0 +1,222 @@
+/****************************************************************************
+**
+** Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
+** All rights reserved.
+** Contact: Nokia Corporation (qt-info@nokia.com)
+**
+** This file is part of the QtGui module of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:LGPL$
+** No Commercial Usage
+** This file contains pre-release code and may not be distributed.
+** You may use this file in accordance with the terms and conditions
+** contained in the Technology Preview License Agreement accompanying
+** this package.
+**
+** GNU Lesser General Public License Usage
+** Alternatively, this file may be used under the terms of the GNU Lesser
+** General Public License version 2.1 as published by the Free Software
+** Foundation and appearing in the file LICENSE.LGPL included in the
+** packaging of this file.  Please review the following information to
+** ensure the GNU Lesser General Public License version 2.1 requirements
+** will be met: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
+**
+** In addition, as a special exception, Nokia gives you certain additional
+** rights.  These rights are described in the Nokia Qt LGPL Exception
+** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
+**
+** If you have questions regarding the use of this file, please contact
+** Nokia at qt-info@nokia.com.
+**
+**
+**
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+
+#ifndef QDRAWINGPRIMITIVE_SSE2_P_H
+#define QDRAWINGPRIMITIVE_SSE2_P_H
+
+#include <private/qsimd_p.h>
+
+#ifdef QT_HAVE_SSE2
+
+//
+//  W A R N I N G
+//  -------------
+//
+// This file is not part of the Qt API.  It exists purely as an
+// implementation detail.  This header file may change from version to
+// version without notice, or even be removed.
+//
+// We mean it.
+//
+
+QT_BEGIN_NAMESPACE
+
+/*
+ * Multiply the components of pixelVector by alphaChannel
+ * Each 32bits components of alphaChannel must be in the form 0x00AA00AA
+ * colorMask must have 0x00ff00ff on each 32 bits component
+ * half must have the value 128 (0x80) for each 32 bits compnent
+ */
+#define BYTE_MUL_SSE2(result, pixelVector, alphaChannel, colorMask, half) \
+{ \
+    /* 1. separate the colors in 2 vectors so each color is on 16 bits \
+       (in order to be multiplied by the alpha \
+       each 32 bit of dstVectorAG are in the form 0x00AA00GG \
+       each 32 bit of dstVectorRB are in the form 0x00RR00BB */\
+    __m128i pixelVectorAG = _mm_srli_epi16(pixelVector, 8); \
+    __m128i pixelVectorRB = _mm_and_si128(pixelVector, colorMask); \
+ \
+    /* 2. multiply the vectors by the alpha channel */\
+    pixelVectorAG = _mm_mullo_epi16(pixelVectorAG, alphaChannel); \
+    pixelVectorRB = _mm_mullo_epi16(pixelVectorRB, alphaChannel); \
+ \
+    /* 3. devide by 255, that's the tricky part. \
+       we do it like for BYTE_MUL(), with bit shift: X/255 ~= (X + X/256 + rounding)/256 */ \
+    /** so first (X + X/256 + rounding) */\
+    pixelVectorRB = _mm_add_epi16(pixelVectorRB, _mm_srli_epi16(pixelVectorRB, 8)); \
+    pixelVectorRB = _mm_add_epi16(pixelVectorRB, half); \
+    pixelVectorAG = _mm_add_epi16(pixelVectorAG, _mm_srli_epi16(pixelVectorAG, 8)); \
+    pixelVectorAG = _mm_add_epi16(pixelVectorAG, half); \
+ \
+    /** second devide by 256 */\
+    pixelVectorRB = _mm_srli_epi16(pixelVectorRB, 8); \
+    /** for AG, we could >> 8 to divide followed by << 8 to put the \
+        bytes in the correct position. By masking instead, we execute \
+        only one instruction */\
+    pixelVectorAG = _mm_andnot_si128(colorMask, pixelVectorAG); \
+ \
+    /* 4. combine the 2 pairs of colors */ \
+    result = _mm_or_si128(pixelVectorAG, pixelVectorRB); \
+}
+
+/*
+ * Each 32bits components of alphaChannel must be in the form 0x00AA00AA
+ * oneMinusAlphaChannel must be 255 - alpha for each 32 bits component
+ * colorMask must have 0x00ff00ff on each 32 bits component
+ * half must have the value 128 (0x80) for each 32 bits compnent
+ */
+#define INTERPOLATE_PIXEL_255_SSE2(result, srcVector, dstVector, alphaChannel, oneMinusAlphaChannel, colorMask, half) { \
+    /* interpolate AG */\
+    __m128i srcVectorAG = _mm_srli_epi16(srcVector, 8); \
+    __m128i dstVectorAG = _mm_srli_epi16(dstVector, 8); \
+    __m128i srcVectorAGalpha = _mm_mullo_epi16(srcVectorAG, alphaChannel); \
+    __m128i dstVectorAGoneMinusAlphalpha = _mm_mullo_epi16(dstVectorAG, oneMinusAlphaChannel); \
+    __m128i finalAG = _mm_add_epi16(srcVectorAGalpha, dstVectorAGoneMinusAlphalpha); \
+    finalAG = _mm_add_epi16(finalAG, _mm_srli_epi16(finalAG, 8)); \
+    finalAG = _mm_add_epi16(finalAG, half); \
+    finalAG = _mm_andnot_si128(colorMask, finalAG); \
+ \
+    /* interpolate RB */\
+    __m128i srcVectorRB = _mm_and_si128(srcVector, colorMask); \
+    __m128i dstVectorRB = _mm_and_si128(dstVector, colorMask); \
+    __m128i srcVectorRBalpha = _mm_mullo_epi16(srcVectorRB, alphaChannel); \
+    __m128i dstVectorRBoneMinusAlphalpha = _mm_mullo_epi16(dstVectorRB, oneMinusAlphaChannel); \
+    __m128i finalRB = _mm_add_epi16(srcVectorRBalpha, dstVectorRBoneMinusAlphalpha); \
+    finalRB = _mm_add_epi16(finalRB, _mm_srli_epi16(finalRB, 8)); \
+    finalRB = _mm_add_epi16(finalRB, half); \
+    finalRB = _mm_srli_epi16(finalRB, 8); \
+ \
+    /* combine */\
+    result = _mm_or_si128(finalAG, finalRB); \
+}
+
+// Basically blend src over dst with the const alpha defined as constAlphaVector.
+// nullVector, half, one, colorMask are constant accross the whole image/texture, and should be defined as:
+//const __m128i nullVector = _mm_set1_epi32(0);
+//const __m128i half = _mm_set1_epi16(0x80);
+//const __m128i one = _mm_set1_epi16(0xff);
+//const __m128i colorMask = _mm_set1_epi32(0x00ff00ff);
+//const __m128i alphaMask = _mm_set1_epi32(0xff000000);
+//
+// The computation being done is:
+// result = s + d * (1-alpha)
+// with shortcuts if fully opaque or fully transparent.
+#define BLEND_SOURCE_OVER_ARGB32_SSE2(dst, src, length, nullVector, half, one, colorMask, alphaMask) { \
+    int x = 0; \
+    for (; x < length-3; x += 4) { \
+        const __m128i srcVector = _mm_loadu_si128((__m128i *)&src[x]); \
+        const __m128i srcVectorAlpha = _mm_and_si128(srcVector, alphaMask); \
+        if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, alphaMask)) == 0xffff) { \
+            /* all opaque */ \
+            _mm_storeu_si128((__m128i *)&dst[x], srcVector); \
+        } else if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVectorAlpha, nullVector)) != 0xffff) { \
+            /* not fully transparent */ \
+            /* extract the alpha channel on 2 x 16 bits */ \
+            /* so we have room for the multiplication */ \
+            /* each 32 bits will be in the form 0x00AA00AA */ \
+            /* with A being the 1 - alpha */ \
+            __m128i alphaChannel = _mm_srli_epi32(srcVector, 24); \
+            alphaChannel = _mm_or_si128(alphaChannel, _mm_slli_epi32(alphaChannel, 16)); \
+            alphaChannel = _mm_sub_epi16(one, alphaChannel); \
+ \
+            const __m128i dstVector = _mm_loadu_si128((__m128i *)&dst[x]); \
+            __m128i destMultipliedByOneMinusAlpha; \
+            BYTE_MUL_SSE2(destMultipliedByOneMinusAlpha, dstVector, alphaChannel, colorMask, half); \
+ \
+            /* result = s + d * (1-alpha) */\
+            const __m128i result = _mm_add_epi8(srcVector, destMultipliedByOneMinusAlpha); \
+            _mm_storeu_si128((__m128i *)&dst[x], result); \
+        } \
+    } \
+    for (; x < length; ++x) { \
+        uint s = src[x]; \
+        if (s >= 0xff000000) \
+            dst[x] = s; \
+        else if (s != 0) \
+            dst[x] = s + BYTE_MUL(dst[x], qAlpha(~s)); \
+    } \
+}
+
+// Basically blend src over dst with the const alpha defined as constAlphaVector.
+// nullVector, half, one, colorMask are constant accross the whole image/texture, and should be defined as:
+//const __m128i nullVector = _mm_set1_epi32(0);
+//const __m128i half = _mm_set1_epi16(0x80);
+//const __m128i one = _mm_set1_epi16(0xff);
+//const __m128i colorMask = _mm_set1_epi32(0x00ff00ff);
+//
+// The computation being done is:
+// dest = (s + d * sia) * ca + d * cia
+//      = s * ca + d * (sia * ca + cia)
+//      = s * ca + d * (1 - sa*ca)
+#define BLEND_SOURCE_OVER_ARGB32_WITH_CONST_ALPHA_SSE2(dst, src, length, nullVector, half, one, colorMask, constAlphaVector) \
+{ \
+    int x = 0; \
+    for (; x < length-3; x += 4) { \
+        __m128i srcVector = _mm_loadu_si128((__m128i *)&src[x]); \
+        if (_mm_movemask_epi8(_mm_cmpeq_epi32(srcVector, nullVector)) != 0xffff) { \
+            BYTE_MUL_SSE2(srcVector, srcVector, constAlphaVector, colorMask, half); \
+\
+            __m128i alphaChannel = _mm_srli_epi32(srcVector, 24); \
+            alphaChannel = _mm_or_si128(alphaChannel, _mm_slli_epi32(alphaChannel, 16)); \
+            alphaChannel = _mm_sub_epi16(one, alphaChannel); \
+ \
+            const __m128i dstVector = _mm_loadu_si128((__m128i *)&dst[x]); \
+            __m128i destMultipliedByOneMinusAlpha; \
+            BYTE_MUL_SSE2(destMultipliedByOneMinusAlpha, dstVector, alphaChannel, colorMask, half); \
+ \
+            const __m128i result = _mm_add_epi8(srcVector, destMultipliedByOneMinusAlpha); \
+            _mm_storeu_si128((__m128i *)&dst[x], result); \
+        } \
+    } \
+    for (; x < length; ++x) { \
+        quint32 s = src[x]; \
+        if (s != 0) { \
+            s = BYTE_MUL(s, const_alpha); \
+            dst[x] = s + BYTE_MUL(dst[x], qAlpha(~s)); \
+        } \
+    } \
+}
+
+QT_END_NAMESPACE
+
+#endif // QT_HAVE_SSE2
+
+#endif // QDRAWINGPRIMITIVE_SSE2_P_H
diff --git a/src/gui/text/qfont.cpp b/src/gui/text/qfont.cpp
index c229242..3fe98e1 100644
--- a/src/gui/text/qfont.cpp
+++ b/src/gui/text/qfont.cpp
@@ -1266,6 +1266,15 @@ QFont::StyleHint QFont::styleHint() const
     \value OldEnglish the font matcher prefers decorative fonts.
     \value Decorative is a synonym for \c OldEnglish.
 
+    \value Monospace the font matcher prefers fonts that map to the
+    CSS generic font-family 'monospace'.
+
+    \value Fantasy the font matcher prefers fonts that map to the
+    CSS generic font-family 'fantasy'.
+
+    \value Cursive the font matcher prefers fonts that map to the
+    CSS generic font-family 'cursive'.
+
     \value System the font matcher prefers system fonts.
 */
 
diff --git a/src/gui/text/qfont.h b/src/gui/text/qfont.h
index 6f62424..2cc41e1 100644
--- a/src/gui/text/qfont.h
+++ b/src/gui/text/qfont.h
@@ -72,7 +72,10 @@ public:
         Courier,    TypeWriter = Courier,
         OldEnglish, Decorative = OldEnglish,
         System,
-        AnyStyle
+        AnyStyle,
+        Cursive,
+        Monospace,
+        Fantasy
     };
 
     enum StyleStrategy {
diff --git a/src/gui/text/qfont_mac.cpp b/src/gui/text/qfont_mac.cpp
index 93985ab..0bc8ca2 100644
--- a/src/gui/text/qfont_mac.cpp
+++ b/src/gui/text/qfont_mac.cpp
@@ -136,8 +136,14 @@ QString QFont::defaultFamily() const
             return QString::fromLatin1("Times New Roman");
         case QFont::Courier:
             return QString::fromLatin1("Courier New");
+        case QFont::Monospace:
+            return QString::fromLatin1("Courier");
         case QFont::Decorative:
             return QString::fromLatin1("Bookman Old Style");
+        case QFont::Cursive:
+            return QString::fromLatin1("Apple Chancery");
+        case QFont::Fantasy:
+            return QString::fromLatin1("Papyrus");
         case QFont::Helvetica:
         case QFont::System:
         default:
diff --git a/src/gui/text/qfont_qws.cpp b/src/gui/text/qfont_qws.cpp
index 51af1e1..72f8c37 100644
--- a/src/gui/text/qfont_qws.cpp
+++ b/src/gui/text/qfont_qws.cpp
@@ -108,6 +108,7 @@ QString QFont::defaultFamily() const
         case QFont::Times:
             return QString::fromLatin1("times");
         case QFont::Courier:
+        case QFont::Monospace:
             return QString::fromLatin1("courier");
         case QFont::Decorative:
             return QString::fromLatin1("old english");
diff --git a/src/gui/text/qfont_win.cpp b/src/gui/text/qfont_win.cpp
index a9610f7..fa45ae1 100644
--- a/src/gui/text/qfont_win.cpp
+++ b/src/gui/text/qfont_win.cpp
@@ -148,9 +148,14 @@ QString QFont::defaultFamily() const
         case QFont::Times:
             return QString::fromLatin1("Times New Roman");
         case QFont::Courier:
+        case QFont::Monospace:
             return QString::fromLatin1("Courier New");
         case QFont::Decorative:
             return QString::fromLatin1("Bookman Old Style");
+        case QFont::Cursive:
+            return QString::fromLatin1("Comic Sans MS");
+        case QFont::Fantasy:
+            return QString::fromLatin1("Impact");
         case QFont::Helvetica:
             return QString::fromLatin1("Arial");
         case QFont::System:
diff --git a/src/gui/text/qfont_x11.cpp b/src/gui/text/qfont_x11.cpp
index 39127dc..92e2326 100644
--- a/src/gui/text/qfont_x11.cpp
+++ b/src/gui/text/qfont_x11.cpp
@@ -281,6 +281,15 @@ QString QFont::defaultFamily() const
     case QFont::Courier:
         return QString::fromLatin1("Courier");
 
+    case QFont::Monospace:
+        return QString::fromLatin1("Courier New");
+
+    case QFont::Cursive:
+        return QString::fromLatin1("Comic Sans MS");
+
+    case QFont::Fantasy:
+        return QString::fromLatin1("Impact");
+
     case QFont::Decorative:
         return QString::fromLatin1("Old English");
 
diff --git a/src/network/access/qnetworkrequest.cpp b/src/network/access/qnetworkrequest.cpp
index 911eadc..bccfec1 100644
--- a/src/network/access/qnetworkrequest.cpp
+++ b/src/network/access/qnetworkrequest.cpp
@@ -215,7 +215,7 @@ QT_BEGIN_NAMESPACE
 
         \since 4.7
 
-     \value AuthenticationReuseControlAttribute
+     \value AuthenticationReuseAttribute
         Requests only, type: QVariant::Int (default: QNetworkRequest::Automatic)
         Indicates whether to use cached authorization credentials in the request,
         if available. If this is set to QNetworkRequest::Manual and the authentication
diff --git a/src/network/network.pro b/src/network/network.pro
index 8582d8a..5e33080 100644
--- a/src/network/network.pro
+++ b/src/network/network.pro
@@ -27,5 +27,20 @@ QMAKE_LIBS += $$QMAKE_LIBS_NETWORK
 
 symbian {
    TARGET.UID3=0x2001B2DE
-   LIBS += -lesock -linsock
+   LIBS += -lesock -linsock -lcertstore -lefsrv -lctframework
+
+    # Partial upgrade SIS file
+    vendorinfo = \
+        "; Localised Vendor name" \
+        "%{\"Nokia, Qt\"}" \
+        " " \
+        "; Unique Vendor name" \
+        ":\"Nokia, Qt\"" \
+        " "
+    pu_header = "; Partial upgrade package for testing QtGui changes without reinstalling everything" \
+                "$${LITERAL_HASH}{\"Qt network\"}, (0x2001E61C), $${QT_MAJOR_VERSION},$${QT_MINOR_VERSION},$${QT_PATCH_VERSION}, TYPE=PU"
+    partial_upgrade.pkg_prerules = pu_header vendorinfo
+    partial_upgrade.sources = $$QMAKE_LIBDIR_QT/QtNetwork.dll
+    partial_upgrade.path = c:/sys/bin
+    DEPLOYMENT = partial_upgrade $$DEPLOYMENT
 }
diff --git a/src/network/ssl/qsslsocket_openssl.cpp b/src/network/ssl/qsslsocket_openssl.cpp
index cad8ca7..1d794ae 100644
--- a/src/network/ssl/qsslsocket_openssl.cpp
+++ b/src/network/ssl/qsslsocket_openssl.cpp
@@ -68,6 +68,8 @@
     PtrCertOpenSystemStoreW QSslSocketPrivate::ptrCertOpenSystemStoreW = 0;
     PtrCertFindCertificateInStore QSslSocketPrivate::ptrCertFindCertificateInStore = 0;
     PtrCertCloseStore QSslSocketPrivate::ptrCertCloseStore = 0;
+#elif defined(Q_OS_SYMBIAN)
+#include <QtCore/private/qcore_symbian_p.h>
 #endif
 
 QT_BEGIN_NAMESPACE
@@ -197,7 +199,7 @@ QSslCipher QSslSocketBackendPrivate::QSslCipher_from_SSL_CIPHER(SSL_CIPHER *ciph
             ciph.d->protocol = QSsl::SslV2;
         else if (protoString == QLatin1String("TLSv1"))
             ciph.d->protocol = QSsl::TlsV1;
-        
+
         if (descriptionList.at(2).startsWith(QLatin1String("Kx=")))
             ciph.d->keyExchangeMethod = descriptionList.at(2).mid(3);
         if (descriptionList.at(3).startsWith(QLatin1String("Au=")))
@@ -365,7 +367,7 @@ init_context:
     // Set verification depth.
     if (configuration.peerVerifyDepth != 0)
         q_SSL_CTX_set_verify_depth(ctx, configuration.peerVerifyDepth);
-    
+
     // Create and initialize SSL session
     if (!(ssl = q_SSL_new(ctx))) {
         // ### Bad error code
@@ -565,6 +567,124 @@ void QSslSocketPrivate::resetDefaultCiphers()
     setDefaultCiphers(ciphers);
 }
 
+#if defined(Q_OS_SYMBIAN)
+
+QCertificateRetriever::QCertificateRetriever(QCertificateConsumer* parent)
+    : CActive(EPriorityStandard)
+    , certStore(0)
+    , certFilter(0)
+    , consumer(parent)
+    , currentCertificateIndex(0)
+    , certDescriptor(0, 0)
+{
+    CActiveScheduler::Add(this);
+    QT_TRAP_THROWING(certStore = CUnifiedCertStore::NewL(qt_s60GetRFs(), EFalse));
+    QT_TRAP_THROWING(certFilter = CCertAttributeFilter::NewL());
+    certFilter->SetFormat(EX509Certificate);
+}
+
+QCertificateRetriever::~QCertificateRetriever()
+{
+    delete certFilter;
+    delete certStore;
+    Cancel();
+}
+
+void QCertificateRetriever::fetch()
+{
+    certStore->Initialize(iStatus);
+    state = Initializing;
+    SetActive();
+}
+
+void QCertificateRetriever::list()
+{
+    certStore->List(certs, *certFilter, iStatus);
+    state = Listing;
+    SetActive();
+}
+
+void QCertificateRetriever::retrieveNextCertificate()
+{
+    CCTCertInfo* cert = certs[currentCertificateIndex];
+    currentCertificate.resize(cert->Size());
+    certDescriptor.Set((TUint8*)currentCertificate.data(), 0, currentCertificate.size());
+    certStore->Retrieve(*cert, certDescriptor, iStatus);
+    state = RetrievingCertificates;
+    SetActive();
+}
+
+void QCertificateRetriever::RunL()
+{
+    QT_TRYCATCH_LEAVING(run());
+}
+
+void QCertificateRetriever::run()
+{
+    switch (state) {
+    case Initializing:
+        list();
+        break;
+    case Listing:
+        currentCertificateIndex = 0;
+        retrieveNextCertificate();
+        break;
+    case RetrievingCertificates:
+        consumer->addEncodedCertificate(currentCertificate);
+        currentCertificate = QByteArray();
+
+        currentCertificateIndex++;
+
+        if (currentCertificateIndex < certs.Count())
+            retrieveNextCertificate();
+        else
+            consumer->finish();
+        break;
+    }
+}
+
+void QCertificateRetriever::DoCancel()
+{
+    switch (state) {
+    case Initializing:
+        certStore->CancelInitialize();
+        break;
+    case Listing:
+        certStore->CancelList();
+        break;
+    case RetrievingCertificates:
+        certStore->CancelRetrieve();
+        break;
+    }
+}
+
+QCertificateConsumer::QCertificateConsumer(QObject* parent)
+    : QObject(parent)
+    , retriever(0)
+{
+}
+
+QCertificateConsumer::~QCertificateConsumer()
+{
+    delete retriever;
+}
+
+void QCertificateConsumer::finish()
+{
+    delete retriever;
+    retriever = 0;
+    emit finished();
+}
+
+void QCertificateConsumer::start()
+{
+    retriever = new QCertificateRetriever(this);
+    Q_CHECK_PTR(retriever);
+    retriever->fetch();
+}
+
+#endif // defined(Q_OS_SYMBIAN)
+
 QList<QSslCertificate> QSslSocketPrivate::systemCaCertificates()
 {
     ensureInitialized();
@@ -638,7 +758,26 @@ QList<QSslCertificate> QSslSocketPrivate::systemCaCertificates()
     systemCerts.append(QSslCertificate::fromPath(QLatin1String("/usr/lib/ssl/certs/*.pem"), QSsl::Pem, QRegExp::Wildcard)); // Gentoo, Mandrake
     systemCerts.append(QSslCertificate::fromPath(QLatin1String("/usr/share/ssl/*.pem"), QSsl::Pem, QRegExp::Wildcard)); // Centos, Redhat, SuSE
     systemCerts.append(QSslCertificate::fromPath(QLatin1String("/usr/local/ssl/*.pem"), QSsl::Pem, QRegExp::Wildcard)); // Normal OpenSSL Tarball
+#elif defined(Q_OS_SYMBIAN)
+    QThread* certThread = new QThread;
+
+    QCertificateConsumer *consumer = new QCertificateConsumer();
+    consumer->moveToThread(certThread);
+    QObject::connect(certThread, SIGNAL(started()), consumer, SLOT(start()));
+    QObject::connect(consumer, SIGNAL(finished()), certThread, SLOT(quit()), Qt::DirectConnection);
+
+    certThread->start();
+    certThread->wait();
+    foreach (const QByteArray &encodedCert, consumer->encodedCertificates()) {
+        QSslCertificate cert(encodedCert, QSsl::Der);
+        if (!cert.isNull())
+            systemCerts.append(cert);
+    }
+
+    delete consumer;
+    delete certThread;
 #endif
+
     return systemCerts;
 }
 
@@ -684,7 +823,7 @@ void QSslSocketBackendPrivate::transmit()
     bool transmitting;
     do {
         transmitting = false;
-        
+
         // If the connection is secure, we can transfer data from the write
         // buffer (in plain text) to the write BIO through SSL_write.
         if (connectionEncrypted && !writeBuffer.isEmpty()) {
diff --git a/src/network/ssl/qsslsocket_openssl_p.h b/src/network/ssl/qsslsocket_openssl_p.h
index 3c08757..987dfae 100644
--- a/src/network/ssl/qsslsocket_openssl_p.h
+++ b/src/network/ssl/qsslsocket_openssl_p.h
@@ -118,6 +118,71 @@ public:
     static QList<QSslCertificate> STACKOFX509_to_QSslCertificates(STACK_OF(X509) *x509);
 };
 
+#if defined(Q_OS_SYMBIAN)
+#include <unifiedcertstore.h>     // link against certstore.lib
+#include <ccertattributefilter.h> // link against ctframework.lib
+
+class QCertificateRetriever;
+
+class QCertificateConsumer : public QObject
+{
+    Q_OBJECT
+public:
+    QCertificateConsumer(QObject* parent = 0);
+    ~QCertificateConsumer();
+
+    void finish();
+
+    void addEncodedCertificate(const QByteArray& certificate)
+    { certificates.append(certificate); }
+    QList<QByteArray> encodedCertificates() const { return certificates; }
+
+public slots:
+    void start();
+
+signals:
+    void finished();
+
+private:
+    QList<QByteArray> certificates;
+    QCertificateRetriever *retriever;
+};
+
+
+class QCertificateRetriever : public CActive
+{
+public:
+    QCertificateRetriever(QCertificateConsumer* consumer);
+    ~QCertificateRetriever();
+
+    void fetch();
+
+private:
+    virtual void RunL();
+    virtual void DoCancel();
+
+    void run();
+    void list();
+    void retrieveNextCertificate();
+
+    enum {
+        Initializing,
+        Listing,
+        RetrievingCertificates
+    } state;
+
+    CUnifiedCertStore* certStore;
+    RMPointerArray<CCTCertInfo> certs;
+    CCertAttributeFilter* certFilter;
+    QCertificateConsumer* consumer;
+    int currentCertificateIndex;
+    QByteArray currentCertificate;
+    TPtr8 certDescriptor;
+};
+
+#endif
+
+
 QT_END_NAMESPACE
 
 #endif
diff --git a/src/opengl/gl2paintengineex/qtextureglyphcache_gl.cpp b/src/opengl/gl2paintengineex/qtextureglyphcache_gl.cpp
index 5371c5e..410cf21 100644
--- a/src/opengl/gl2paintengineex/qtextureglyphcache_gl.cpp
+++ b/src/opengl/gl2paintengineex/qtextureglyphcache_gl.cpp
@@ -276,11 +276,6 @@ void QGLTextureGlyphCache::fillTexture(const Coord &c, glyph_t glyph)
     }
 }
 
-int QGLTextureGlyphCache::glyphMargin() const
-{
-    return 1;
-}
-
 int QGLTextureGlyphCache::glyphPadding() const
 {
     return 1;
diff --git a/src/opengl/gl2paintengineex/qtextureglyphcache_gl_p.h b/src/opengl/gl2paintengineex/qtextureglyphcache_gl_p.h
index 84e9021..6bcd655 100644
--- a/src/opengl/gl2paintengineex/qtextureglyphcache_gl_p.h
+++ b/src/opengl/gl2paintengineex/qtextureglyphcache_gl_p.h
@@ -72,7 +72,6 @@ public:
     virtual void createTextureData(int width, int height);
     virtual void resizeTextureData(int width, int height);
     virtual void fillTexture(const Coord &c, glyph_t glyph);
-    virtual int glyphMargin() const;
     virtual int glyphPadding() const;
 
     inline GLuint texture() const { return m_texture; }
diff --git a/src/s60installs/bwins/QtCoreu.def b/src/s60installs/bwins/QtCoreu.def
index 101c6a8..94be1bb 100644
--- a/src/s60installs/bwins/QtCoreu.def
+++ b/src/s60installs/bwins/QtCoreu.def
@@ -4482,4 +4482,6 @@ EXPORTS
 	?textDirection@QLocale@@QBE?AW4LayoutDirection@Qt@@XZ @ 4481 NONAME ; enum Qt::LayoutDirection QLocale::textDirection(void) const
 	?peek@QIODevicePrivate@@UAE_JPAD_J@Z @ 4482 NONAME ; long long QIODevicePrivate::peek(char *, long long)
 	?peek@QIODevicePrivate@@UAE?AVQByteArray@@_J@Z @ 4483 NONAME ; class QByteArray QIODevicePrivate::peek(long long)
+	?nativeArguments@QProcess@@QBE?AVQString@@XZ @ 4484 NONAME ; class QString QProcess::nativeArguments(void) const
+	?setNativeArguments@QProcess@@QAEXABVQString@@@Z @ 4485 NONAME ; void QProcess::setNativeArguments(class QString const &)
 
diff --git a/src/s60installs/eabi/QtCoreu.def b/src/s60installs/eabi/QtCoreu.def
index 7b9e777..46c4885 100644
--- a/src/s60installs/eabi/QtCoreu.def
+++ b/src/s60installs/eabi/QtCoreu.def
@@ -3709,4 +3709,6 @@ EXPORTS
 	_ZNK7QString13isRightToLeftEv @ 3708 NONAME
 	_ZN16QIODevicePrivate4peekEPcx @ 3709 NONAME
 	_ZN16QIODevicePrivate4peekEx @ 3710 NONAME
+	_ZN8QProcess18setNativeArgumentsERK7QString @ 3711 NONAME
+	_ZNK8QProcess15nativeArgumentsEv @ 3712 NONAME