Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-29062009 ( 22aadba1b4356ad7d8e9446b95baccb6b2c037b0 )

Changes in WebKit/qt since the last update:

2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>

        Fix the Qt build, add missing isSpeaking() implementation to
        ContextMenuClient.

        * WebCoreSupport/ContextMenuClientQt.cpp:
        (WebCore::ContextMenuClientQt::isSpeaking):
        * WebCoreSupport/ContextMenuClientQt.h:

2009-06-28  Sriram Yadavalli  <sriram.yadavalli@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Fix build break for Qt
        https://bugs.webkit.org/show_bug.cgi?id=26779

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-27  Simon Hausmann  <simon.hausmann@nokia.com>

        Build fix for Qt under Windows.

        * Api/qwebhistory.h: Use consistent export linkage for the datastream operators.

2009-06-26  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Simon Fraser.

        Changed call of scrollbarUnderMouse to scrollbarUnderPoint to match new API.

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for saving and loading of QWebHistory to and from a QByteArray.

        This includes streaming operators for QWebHistory. for convenience.

        New autotests that test QWebHistory and QWebHistoryItem serialization.

        * Api/qwebhistory.cpp:
        (QWebHistory::restoreState):
        (QWebHistory::saveState):
        (operator<<):
        (operator>>):
        * Api/qwebhistory.h:
        * Api/qwebhistory_p.h:
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::):
        (tst_QWebHistory::init):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::itemAt):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        (tst_QWebHistory::serialize_1):
        (tst_QWebHistory::serialize_2):
        (tst_QWebHistory::serialize_3):
        (tst_QWebHistory::saveAndRestore_1):
        (tst_QWebHistory::saveAndRestore_2):
        (tst_QWebHistory::saveAndRestore_3):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix the behaviour of QWebHistory::itemAt to interpret the specified index as absolute index.

        Returns an invalid QWebHistoryItem if the index is out of range.

        * Api/qwebhistory.cpp:
        (QWebHistory::itemAt):
        * tests/qwebhistory/tst_qwebhistory.cpp:
        (tst_QWebHistory::itemAt):

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Added a few autotest to QWebHistory.

        * tests/qwebhistory/data/page1.html: Added.
        * tests/qwebhistory/data/page2.html: Added.
        * tests/qwebhistory/data/page3.html: Added.
        * tests/qwebhistory/data/page4.html: Added.
        * tests/qwebhistory/data/page5.html: Added.
        * tests/qwebhistory/data/page6.html: Added.
        * tests/qwebhistory/qwebhistory.pro: Added.
        * tests/qwebhistory/tst_qwebhistory.cpp: Added.
        (tst_QWebHistory::):
        (tst_QWebHistory::tst_QWebHistory):
        (tst_QWebHistory::~tst_QWebHistory):
        (tst_QWebHistory::init):
        (tst_QWebHistory::cleanup):
        (tst_QWebHistory::title):
        (tst_QWebHistory::count):
        (tst_QWebHistory::back):
        (tst_QWebHistory::forward):
        (tst_QWebHistory::goToItem):
        (tst_QWebHistory::items):
        * tests/qwebhistory/tst_qwebhistory.qrc: Added.
        * tests/tests.pro:

2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Fix support for documenting functions prefixed with QWEBKIT_EXPORT

        Add QWEBKIT_EXPORT to the list of macros to ignore by qdoc.

        * docs/qtwebkit.qdocconf:

2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>

        Reviewed by Eric Seidel.

        Bug 20303: [Qt] Key events are not working in frames.

        Send scrolling events to current focused frame, bubble the event
        up to parent frame if it is not handled.  Use EventHandler's new
        shared scrolling code.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::keyPressEvent):
        (QWebPagePrivate::handleScrolling):
        * Api/qwebpage_p.h:

2009-06-25  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Adam Treat.

        Add highlight functionality to the QWebPage::findText() method. Introduced is
        new HighlightAllOccurrences flag which passed to the function will make it mark
        all existing occurrences of specified string in the page.

        * Api/qwebpage.cpp:
        (QWebPage::findText):
        * Api/qwebpage.h:
        * Api/qwebview.cpp:

232 files changed, 6414 insertions, 1619 deletions

diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 55518f5..c8bba0f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,3 +1,149 @@
+2009-06-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
+
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+
+2009-06-26  Eric Seidel  <eric@webkit.org>
+
+        No review, only rolling out r45259.
+
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
+
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to Vector.
+
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Make the opcode sampler work once again.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
+
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
+
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
+
+        * bytecode/CodeBlock.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26676
+
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
+
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26675
+
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
+
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
+
+        * wtf/HashMap.h:
+
+2009-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
+
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        * parser/Nodes.cpp:
+        (JSC::CommaNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
+
 2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Maciej Stachowiak.
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 94901f9..afd32f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -38,6 +38,7 @@
 #include "Nodes.h"
 #include "RegExp.h"
 #include "UString.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -214,7 +215,7 @@ namespace JSC {
     }
 #endif
 
-    class CodeBlock {
+    class CodeBlock : public WTF::FastAllocBase {
         friend class JIT;
     public:
         CodeBlock(ScopeNode* ownerNode);
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 21de281..d29a24d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -40,6 +40,7 @@
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
@@ -60,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator {
+    class BytecodeGenerator : public WTF::FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 0f7625a..8e80eca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -3811,17 +3811,17 @@ yyreduce:
 
   case 196:
 #line 781 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
@@ -3888,7 +3888,7 @@ yyreduce:
 #line 855 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3936,7 +3936,7 @@ yyreduce:
 #line 892 "../parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -5092,10 +5092,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index fa7ec0b..7b1e547 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1085,7 +1085,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
 
     StructureChain* protoChain = structure->prototypeChain(callFrame);
     if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
+        vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 7cab254..702c89c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -66,7 +66,7 @@ namespace JSC {
 
     enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter : public WTF::FastAllocBase {
+    class Interpreter : public FastAllocBase {
         friend class JIT;
         friend class CachedCall;
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index cceac74..31f0c8b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -31,6 +31,7 @@
 
 #include "JSValue.h"
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -47,7 +48,7 @@ namespace JSC {
 
     typedef ExecState CallFrame;
 
-    class Register {
+    class Register : public WTF::FastAllocBase {
     public:
         Register();
         Register(JSValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index bc006fc..db3f38a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -342,61 +342,40 @@ namespace JSC {
         static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, cachedOffset);
         }
         static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, cachedOffset, callFrame);
         }
         static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
 
         static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
         
         static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
         static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
@@ -407,9 +386,6 @@ namespace JSC {
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
-#if ENABLE(OPCODE_SAMPLING)
-            jit->m_bytecodeIndex = jit->m_codeBlock->getCallReturnOffset(returnAddress.value());
-#endif
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
index 2dc69c1..bc07178 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -108,8 +108,8 @@ namespace JSC {
         JIT::Call call()
         {
 #if ENABLE(OPCODE_SAMPLING)
-            ASSERT(m_jit->m_bytecodeIndex != (unsigned)-1);
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
 #endif
 
             m_jit->restoreArgumentReference();
@@ -117,7 +117,8 @@ namespace JSC {
             m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
 
 #if ENABLE(OPCODE_SAMPLING)
-            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
 #endif
 
             m_jit->killLastResultRegister();
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index 52dddde..c5ca425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -80,7 +80,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -778,17 +778,17 @@ AssignmentOperator:
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -854,7 +854,7 @@ VariableDeclarationList:
   | VariableDeclarationList ',' IDENT Initializer
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -891,7 +891,7 @@ VariableDeclarationListNoIn:
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
                                         { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -2071,10 +2071,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
index ea1579b..d17da69 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -659,9 +659,9 @@ namespace JSC {
 
     inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
         : ExpressionNode(globalData)
-        , m_expr1(expr1)
-        , m_expr2(expr2)
     {
+        m_expressions.append(expr1);
+        m_expressions.append(expr2);
     }
 
     inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 3cfd125..ba6e1e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -1186,8 +1186,10 @@ RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, Re
 
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1);
-    return generator.emitNode(dst, m_expr2);
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 7cdc19d..a9f88b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -169,7 +169,8 @@ namespace JSC {
         virtual bool isResolveNode() const { return false; }
         virtual bool isBracketAccessorNode() const { return false; }
         virtual bool isDotAccessorNode() const { return false; }
-        virtual bool isFuncExprNode() const { return false; } 
+        virtual bool isFuncExprNode() const { return false; }
+        virtual bool isCommaNode() const { return false; }
         virtual bool isSimpleArray() const { return false; }
         virtual bool isAdd() const { return false; }
 
@@ -1087,16 +1088,20 @@ namespace JSC {
         Operator m_operator;
         ExpressionNode* m_right;
     };
+    
+    typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
     class CommaNode : public ExpressionNode {
     public:
         CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
+        void append(ExpressionNode* expr) { m_expressions.append(expr); }
+
     private:
+        virtual bool isCommaNode() const { return true; }
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        ExpressionNode* m_expr1;
-        ExpressionNode* m_expr2;
+        ExpressionVector m_expressions;
     };
     
     class ConstDeclNode : public ExpressionNode {
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
index fdd7bbc..ba48c55 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-    struct CallIdentifier : public WTF::FastAllocBase {
+    struct CallIdentifier : public FastAllocBase {
         UString m_name;
         UString m_url;
         unsigned m_lineNumber;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 3b10d32..17aff24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -30,7 +30,7 @@ namespace JSC {
     class JSObject;
     class ScopeChainIterator;
     
-    class ScopeChainNode : public WTF::FastAllocBase {
+    class ScopeChainNode : public FastAllocBase {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
             : next(next)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
index 71e6bfa..1c81856 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -397,4 +397,7 @@ namespace WTF {
 
 } // namespace WTF
 
+// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
+using WTF::FastAllocBase;
+
 #endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index c5b75ff..3de5ee6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -29,7 +29,7 @@ namespace WTF {
 
     template<typename KeyArg, typename MappedArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
         typename KeyTraitsArg = HashTraits<KeyArg>, typename MappedTraitsArg = HashTraits<MappedArg> >
-    class HashMap {
+    class HashMap : public FastAllocBase {
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 050feb1..c378fd0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -28,6 +28,10 @@
 #include <limits>
 #include <utility>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 namespace WTF {
 
     using std::min;
@@ -563,6 +567,32 @@ namespace WTF {
         Buffer m_buffer;
     };
 
+#if PLATFORM(QT)
+    template<typename T>
+    QDataStream& operator<<(QDataStream& stream, const Vector<T>& data)
+    {
+        stream << qint64(data.size());
+        foreach (const T& i, data)
+            stream << i;
+        return stream;
+    }
+
+    template<typename T>
+    QDataStream& operator>>(QDataStream& stream, Vector<T>& data)
+    {
+        data.clear();
+        qint64 count;
+        T item;
+        stream >> count;
+        data.reserveCapacity(count);
+        for (qint64 i = 0; i < count; ++i) {
+            stream >> item;
+            data.append(item);
+        }
+        return stream;
+    }
+#endif
+
     template<typename T, size_t inlineCapacity>
     Vector<T, inlineCapacity>::Vector(const Vector& other)
         : m_size(other.size())
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 5e73fee..730c023 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        qtwebkit-4.6-snapshot-24062009 branch/tag
+        qtwebkit-4.6-snapshot-29062009 branch/tag
 
 and has the sha1 checksum
 
-        6d5a2a0472a6af0b7f781da018e76bb8522d57a5
+        22aadba1b4356ad7d8e9446b95baccb6b2c037b0
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 25427bc..8991528 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,2374 @@
+2009-06-26  John Sullivan  <sullivan@apple.com>
+
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
+
+        Reviewed by Tim Hatcher.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
+        
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
+        
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
+
+2009-06-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
+
+        Test: added a case to fast/dom/Element/scrollWidth.html
+
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
+        
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
+
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
+
+        Define these functions for Gtk as well.
+
+        * platform/PurgeableBuffer.h:
+
+2009-06-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26765
+
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
+
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
+
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
+
+        This can't be layout tested as it depends on the sandbox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15457
+
+        Test: plugins/netscape-plugin-map-data-to-src.html
+
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
+
+        * WebCore.pro:
+
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Don't use deprecated GTK+ symbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
+        
+        Remove a final use of Vector iterators.
+        
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
+
+2009-06-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
+
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
+
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26762
+
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
+
+        Added few utility functions to htmlediting.h/cpp
+
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
+
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
+
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
+
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix completion when iterating options using Tab.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26722
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
+
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2009-06-27  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
+
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
+
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
+
+        Test: media/video-canvas-source.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26695
+        
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
+        
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stamped by Dave Levin
+
+        Rename ioCompState to compositingState to better match WebCore coding style.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - revert unintentional project changes from r45277
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26766
+
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
+
+        Test: fast/dom/Element/scrollWidth.html
+
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
+
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-06-26  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26759
+
+        GIFImageDecoder is broken.
+
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
+
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26732
+
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
+
+2009-06-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26623
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
+
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26691
+
+        Cleanup: Move focusRingColor to RenderTheme.
+
+        Most of this CL involves deleting files and removing dead code.
+
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
+
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
+
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
+
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
+
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
+
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
+
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
+
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
+
+        Test: editing/selection/drag-start-event-client-x-y.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Tiger build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
+
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
+        
+        Improve the fix, make the test pass on Tiger.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
+
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
+
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Show the fullscreen button only if the backend has support for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26661
+
+        No test since this is not reachable via the DOM.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+
+        Update the time display when the movie time changes.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26659
+
+        Support hidding a control bar element from the Media element controller.
+
+        Update layout tests since the fullscreen button no longer has a renderer.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
+
+        - Now the numbers are reset when the profiles are.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
+2009-06-26  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
+
+        Test: editing/inserting/break-blockquote-after-delete.html
+
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
+
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * WebCore.pro:
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to String and IntPoint.
+
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+
+2009-06-26  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
+
+        * bindings/v8/custom/V8StorageCustom.cpp
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
+
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
+
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
+
+        Test: svg/custom/createImageElement.svg
+
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
+
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
+
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
+
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
+
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
+
+        http://code.google.com/p/chromium/issues/detail?id=10545
+
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
+
+        Test: fast/frames/viewsource-on-image-file.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
+
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
+
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
+
+        Based on Norbert Leser's work.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
+
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
+
+        * WebCore.pro:
+
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
+
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        <rdar://problem/6990481>
+        
+        Handle perspective computation on non-layer objects.
+
+        Test: transforms/3d/general/perspective-non-layer.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26653
+
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
+
+        Media tests results are affected by this changes.
+
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26724
+
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26733
+
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        Add missing include for r45199.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26736
+
+        r45199 added a reference to throwError without including V8Proxy.h
+
+        * bindings/v8/WorkerScriptController.cpp:
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        TBRed: fix for Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26735
+
+        Fix V8IsolatedWorld to point to the correct include file.
+
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
+
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
+
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26651
+        
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-06-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
+
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+
+2009-06-25  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8Index.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26495
+
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
+
+2009-06-25  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26529
+
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
+
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
+
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
+
+        http://codereview.chromium.org/132007
+
+        This should not affect any layout tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
+
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
+
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
+
+2009-06-25  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
+
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::removedFromDocument):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
+
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add FileList.h include to fix Chromium build.
+
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
+
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
+
+        Fixed a Typo in a Web Inspector error message.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing StorageAreaSync files to the build.
+
+        * WebCore.pro:
+
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
+
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
+
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
+
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
+
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
+
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
+
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
+
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
+
+        Test: http/tests/security/clipboard/clipboard-file-access.html
+
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, reverting r45144 only.
+
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
+
+        Test: fast/replaced/image-map-2.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
+
+2009-06-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26366
+
+        Refactor V8DOMMap to support isolated worlds.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
+
+        Seems like search was damaged in revision 42808.
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
+
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26658
+
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
+
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build.
+
+        * WebCore.pro:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26668: AX: need a way to retrieve the language for an element
+        
+        Provides a way to retrieve the language associated with a specific accessibility element.
+
+        Test: accessibility/language-attribute.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
+
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
+
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Add files that were added in r45093 and r45096
+
+        * GNUmakefile.am:
+
+2009-06-24  Brady Eidson  <beidson@apple.com>
+
+        Fix 64-bit SnowLeopard build.
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
+
+        React to href updates even when there is no renderer, i.e. display=none.
+
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2009-06-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26687
+
+        Add basic back-end column support to datagrid.
+
+        Added fast/dom/HTMLDataGridElement/ column tests.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
+        
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
+        
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
+
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
+
+2009-06-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
+
+        This change just adds a stub implementation for now to help fix the build.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
+
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+
+        Reviewed by Adam Roben.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
+
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include within last patch.
+
+        * manual-tests/wml/card-title-attr.wml: Added.
+
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
+
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
+        * wml/WMLCardElement.cpp:
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
 2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index a26a4de..3075a4b 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -54,6 +54,8 @@
 #include "JSCSSVariablesDeclaration.cpp"
 #include "JSCSSVariablesRule.cpp"
 #include "JSDatabase.cpp"
+#include "JSDataGridColumn.cpp"
+#include "JSDataGridColumnList.cpp"
 #include "JSDocument.cpp"
 #include "JSDocumentFragment.cpp"
 #include "JSDocumentType.cpp"
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
new file mode 100644
index 0000000..6e50bd8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_FastAllocBase_h
+#define WebCore_FWD_FastAllocBase_h
+#include <JavaScriptCore/FastAllocBase.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 3ccfb32..486c9d0 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -329,6 +329,8 @@ IDL_BINDINGS += \
     html/CanvasGradient.idl \
     html/CanvasPattern.idl \
     html/CanvasRenderingContext2D.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
     html/File.idl \
     html/FileList.idl \
     html/HTMLAudioElement.idl \
@@ -459,6 +461,7 @@ SOURCES += \
     bindings/js/JSCustomPositionErrorCallback.cpp \
     bindings/js/JSCustomVoidCallback.cpp \
     bindings/js/JSCustomXPathNSResolver.cpp \
+    bindings/js/JSDataGridColumnListCustom.cpp \
     bindings/js/JSDataGridDataSource.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
@@ -735,6 +738,7 @@ SOURCES += \
     history/CachedFrame.cpp \
     history/CachedPage.cpp \
     history/HistoryItem.cpp \
+    history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
     html/CanvasGradient.cpp \
     html/CanvasPattern.cpp \
@@ -742,6 +746,8 @@ SOURCES += \
     html/CanvasRenderingContext2D.cpp \
     html/CanvasStyle.cpp \
     html/CollectionCache.cpp \
+    html/DataGridColumn.cpp \
+    html/DataGridColumnList.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -1358,24 +1364,27 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
 
     HEADERS += \
+        storage/LocalStorageTask.h \
+        storage/LocalStorageThread.h \
         storage/Storage.h \
+        storage/StorageArea.h \
+        storage/StorageAreaSync.h \
         storage/StorageEvent.h \
-        storage/SessionStorage.h \
-        storage/SessionStorageArea.h
+        storage/StorageMap.h \
+        storage/StorageNamespace.h \
+        storage/StorageSyncManager.h
 
     SOURCES += \
-        storage/LocalStorage.cpp \
-        storage/LocalStorageArea.cpp \
+        bindings/js/JSStorageCustom.cpp \
         storage/LocalStorageTask.cpp \
         storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
         storage/StorageArea.cpp \
-        storage/StorageMap.cpp \
+        storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
-        storage/SessionStorage.cpp \
-        storage/SessionStorageArea.cpp \
-        storage/StorageSyncManager.cpp \
-        bindings/js/JSStorageCustom.cpp
+        storage/StorageMap.cpp \
+        storage/StorageNamespace.cpp \
+        storage/StorageSyncManager.cpp
 
     IDL_BINDINGS += \
         storage/Storage.idl \
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index dccff82..a6cd62d 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -298,7 +298,22 @@ bool AccessibilityObject::press() const
     actionElem->accessKeyAction(true);
     return true;
 }
-
+    
+String AccessibilityObject::language() const
+{
+    AccessibilityObject* parent = parentObject();
+    
+    // as a last resort, fall back to the content language specified in the meta tag
+    if (!parent) {
+        Document* doc = document();
+        if (doc)
+            return doc->contentLanguage();
+        return String();
+    }
+    
+    return parent->language();
+}
+    
 AXObjectCache* AccessibilityObject::axObjectCache() const
 {
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index f71be99..8939092 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -311,7 +311,8 @@ public:
     virtual Document* document() const { return 0; }
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
-
+    virtual String language() const;
+    
     void setAXObjectID(unsigned);
     virtual void setFocused(bool);
     virtual void setSelectedText(const String&);
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index be16195..7d4cb39 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -656,6 +656,25 @@ String AccessibilityRenderObject::helpText() const
     
     return String();
 }
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    // Defer to parent if this element doesn't have a language set
+    Node* node = m_renderer->node();
+    if (!node)
+        return AccessibilityObject::language();
+    
+    if (!node->isElementNode())
+        return AccessibilityObject::language();
+    
+    String language = static_cast<Element*>(node)->getAttribute(langAttr);
+    if (language.isEmpty())
+        return AccessibilityObject::language();
+    return language;
+}
 
 String AccessibilityRenderObject::textUnderElement() const
 {
@@ -1167,12 +1186,31 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     return 0;   
 }
     
+bool AccessibilityRenderObject::ariaIsHidden() const
+{
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+        return true;
+    
+    // aria-hidden hides this object and any children
+    AccessibilityObject* object = parentObject();
+    while (object) {
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+            return true;
+        object = object->parentObject();
+    }
+
+    return false;
+}
+
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
     // ignore invisible element
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
         return true;
 
+    if (ariaIsHidden())
+        return true;
+    
     if (isPresentationalChildOfAriaRole())
         return true;
         
@@ -1512,6 +1550,10 @@ void AccessibilityRenderObject::setValue(const String& string)
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
+    
+    if (equalIgnoringCase(getAttribute(aria_disabledAttr).string(), "true"))
+        return false;
+    
     Node* node = m_renderer->node();
     if (!node || !node->isElementNode())
         return true;
@@ -2112,12 +2154,13 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
 typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
 
-struct RoleEntry {
-    String ariaRole;
-    AccessibilityRole webcoreRole;
-};
 static const ARIARoleMap& createARIARoleMap()
 {
+    struct RoleEntry {
+        String ariaRole;
+        AccessibilityRole webcoreRole;
+    };
+
     const RoleEntry roles[] = {
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
@@ -2322,6 +2365,9 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
+    if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
+        return false;
+
     if (isWebArea()) 
         return !isReadOnly();
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index 3fa88a2..4fa325f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -177,6 +177,7 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
+    virtual String language() const;
     
     virtual const AccessibilityChildrenVector& children();
     
@@ -226,6 +227,7 @@ protected:
 private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
+    bool ariaIsHidden() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const; 
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
index 99fc380..af49df4 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,45 +23,27 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SessionStorage_h
-#define SessionStorage_h
+#include "config.h"
+#include "JSDataGridColumnList.h"
 
-#if ENABLE(DOM_STORAGE)
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "JSDataGridColumn.h"
 
-#include "SecurityOriginHash.h"
-#include "SessionStorageArea.h"
-
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
+using namespace JSC;
 
 namespace WebCore {
 
-    class Page;
-
-    class SessionStorage : public RefCounted<SessionStorage> {
-    public:
-        static PassRefPtr<SessionStorage> create(Page*);
-        PassRefPtr<SessionStorage> copy(Page*);
-        
-        PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
-
-#ifndef NDEBUG
-        Page* page() { return m_page; }
-#endif
-
-    private:
-        SessionStorage(Page*);
+bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* impl, const Identifier& propertyName)
+{
+    return impl->itemWithName(propertyName);
+}
 
-        void dispatchStorageEvent(StorageArea*, const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
-        Page* m_page;
-        
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<SessionStorageArea>, SecurityOriginHash> SessionStorageAreaMap;
-        SessionStorageAreaMap m_storageAreaMap;
-    };
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->itemWithName(propertyName));
+}
 
 } // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
-#endif // SessionStorage_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 04bc929..088668e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -320,7 +320,7 @@ sub GenerateSetDOMException
     my $result = "";
 
     $result .= $indent . "if (ec) {\n";
-    $result .= $indent . "    V8Proxy::SetDOMException(ec);\n";
+    $result .= $indent . "    V8Proxy::setDOMException(ec);\n";
     $result .= $indent . "    return v8::Handle<v8::Value>();\n";
     $result .= $indent . "}\n";
 
@@ -346,12 +346,12 @@ sub HolderToNative
 
     if (IsNodeSubType($dataNode)) {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8Proxy::DOMWrapperToNode<$implClassName>(holder);
+    $implClassName* imp = V8Proxy::convertDOMWrapperToNode<$implClassName>(holder);
 END
 
     } else {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8Proxy::ToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
+    $implClassName* imp = V8Proxy::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
 END
 
   }
@@ -374,14 +374,14 @@ sub GenerateDomainSafeFunctionGetter
 
     my $newTemplateString = GenerateNewFunctionTemplate($function, $dataNode, $signature);
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls, <<END);
   static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
     INC_STATS(\"DOM.$implClassName.$funcName._get\");
     static v8::Persistent<v8::FunctionTemplate> private_template =
         v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) {
       // can only reach here by 'object.__proto__.func', and it should passed
       // domain security check already
@@ -393,7 +393,7 @@ END
   HolderToNative($dataNode, $implClassName, $classIndex);
 
     push(@implContentDecls, <<END);
-    if (!V8Proxy::CanAccessFrame(imp->frame(), false)) {
+    if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
       static v8::Persistent<v8::FunctionTemplate> shared_template =
         v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
       return shared_template->GetFunction();
@@ -421,13 +421,13 @@ END
 
     if ($classIndex eq "DOMWINDOW") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    DOMWindow* window = V8Proxy::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     Frame* frame = window->frame();
     if (frame) {
       // Get the proxy corresponding to the DOMWindow if possible to
       // make sure that the constructor function is constructed in the
       // context of the DOMWindow and not in the context of the caller.
-      return V8Proxy::retrieve(frame)->GetConstructor(type);
+      return V8Proxy::retrieve(frame)->getConstructor(type);
     }
 END
   }
@@ -458,7 +458,7 @@ sub GenerateNormalAttrGetter
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $attrName = $attribute->signature->name;
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     my $attrType = $codeGenerator->StripModule($attribute->signature->type);
     my $attrIsPodType = IsPodType($attrType);
@@ -500,7 +500,7 @@ END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -512,7 +512,7 @@ END
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
         HolderToNative($dataNode, $implClassName, $classIndex);
@@ -525,9 +525,9 @@ END
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::CheckNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::CheckNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -624,9 +624,9 @@ END
 
     if ($attrIsPodType) {
         my $classIndex = uc($attrType);
-        push(@implContentDecls, "    return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);n");
+        push(@implContentDecls, "    return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n");
     } else {
-        push(@implContentDecls, "    return ".NativeToJSValue($attribute - >signature, $result).";n");
+        push(@implContentDecls, "    return ".NativeToJSValue($attribute->signature, $result).";\n");
     }
 
     push(@implContentDecls, "  }\n\n");  # end of getter
@@ -637,7 +637,7 @@ sub GenerateReplaceableAttrSetter
 {
     my $implClassName = shift;
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls,
        "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
@@ -661,7 +661,7 @@ sub GenerateNormalAttrSetter
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls,
        "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
@@ -674,14 +674,14 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
         HolderToNative($dataNode, $implClassName, $classIndex);
@@ -724,11 +724,11 @@ END
     }
 
     if ($useExceptions) {
-        push(@implContentDecls, "    V8Proxy::SetDOMException(ec);\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
     }
 
     if ($isPodType) {
-        push(@implContentDecls, "    wrapper->commitChange(*imp, V8Proxy::GetSVGContext(wrapper));\n");
+        push(@implContentDecls, "    wrapper->commitChange(*imp, V8Proxy::svgContext(wrapper));\n");
     } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
         $implIncludes{"SVGElement.h"} = 1;
 
@@ -737,7 +737,7 @@ END
             $currentObject = "wrapper";
         }
 
-        push(@implContentDecls, "    if (SVGElement* context = V8Proxy::GetSVGContext($currentObject)) {\n");
+        push(@implContentDecls, "    if (SVGElement* context = V8Proxy::svgContext($currentObject)) {\n");
         push(@implContentDecls, "        context->svgAttributeChanged(imp->associatedAttributeName());\n");
         push(@implContentDecls, "    }\n");
     }
@@ -795,7 +795,7 @@ sub GenerateFunctionCallback
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
@@ -811,7 +811,7 @@ END
        && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
     # We have not find real use cases yet.
     push(@implContentDecls,
-"    if (!V8Proxy::CanAccessFrame(imp->frame(), true)) {\n".
+"    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
 "      return v8::Undefined();\n" .
 "    }\n");
     }
@@ -853,7 +853,7 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ") {\n" .
-"      V8Proxy::SetDOMException(TYPE_MISMATCH_ERR);\n" .
+"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
         }
@@ -862,7 +862,7 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if ($parameterName < 0) {\n" .
-"      V8Proxy::SetDOMException(INDEX_SIZE_ERR);\n" .
+"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
         }
@@ -945,7 +945,7 @@ sub GenerateBatchedAttributeData
         if ($interfaceName eq "DOMWindow") {
             $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
             $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-        } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "SVGElementInstance") {
+        } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
             $getter = "V8Custom::v8ElementEventHandlerAccessorGetter";
             $setter = "V8Custom::v8ElementEventHandlerAccessorSetter";
         } else {
@@ -1052,7 +1052,7 @@ sub GenerateImplementation
 
     push(@implFixedHeader,
          "#include \"config.h\"\n" .
-         "#include \"v8_proxy.h\"\n" .
+         "#include \"V8Proxy.h\"\n" .
          "#include \"v8_binding.h\"\n\n" .
          "#undef LOG\n\n");
 
@@ -1069,7 +1069,7 @@ sub GenerateImplementation
     $implIncludes{"${className}.h"} = 1;
 
     AddIncludesForType($interfaceName);
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls, "namespace WebCore {\n");
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
@@ -1135,7 +1135,7 @@ sub GenerateImplementation
     foreach my $function (@{$dataNode->functions}) {
         # hack for addEventListener/RemoveEventListener
         # FIXME: avoid naming conflict
-        if ($function->signature->extendedAttributes->{"Custom"} || function->signature->extendedAttributes->{"V8Custom"}) {
+        if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"}) {
                 $implIncludes{"V8CustomBinding.h"} = 1;
         } else {
             GenerateFunctionCallback($function, $dataNode, $classIndex, $implClassName);
@@ -1211,7 +1211,7 @@ END
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
 static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ) {
-  BatchConfigureAttributes(templ,
+  batchConfigureAttributes(templ,
                            v8::Handle<v8::ObjectTemplate>(),
                            shadow_attrs,
                            sizeof(shadow_attrs)/sizeof(*shadow_attrs));
@@ -1234,7 +1234,7 @@ END
     # Set up our attributes if we have them
     if ($has_attributes) {
         push(@implContent, <<END);
-  BatchConfigureAttributes(instance, proto, attrs, sizeof(attrs)/sizeof(*attrs));
+  batchConfigureAttributes(instance, proto, attrs, sizeof(attrs)/sizeof(*attrs));
 END
     }
 
@@ -1319,7 +1319,7 @@ END
         if ($parent eq "EventTarget") { next; }
         $implIncludes{"V8${parent}.h"} = 1;
         my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8Proxy::GetTemplate(V8ClassIndex::${parentClassIndex}));\n");
+        push(@implContent, "  desc->Inherit(V8Proxy::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
         last;
     }
 
@@ -1328,7 +1328,7 @@ END
 
     if ($has_constants) {
         push(@implContent, <<END);
-  BatchConfigureConstants(desc, proto, consts, sizeof(consts)/sizeof(*consts));
+  batchConfigureConstants(desc, proto, consts, sizeof(consts)/sizeof(*consts));
 END
     }
 
@@ -1340,7 +1340,7 @@ v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
   static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
   if (${className}_raw_cache_.IsEmpty()) {
     v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::CheckNewLegal);
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
     ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
   }
   return ${className}_raw_cache_;
@@ -1482,7 +1482,7 @@ sub GenerateFunctionCallString()
         }
         $result .= $indent . "if (success)\n";
         $result .= $indent . "    " .
-            "return V8Proxy::NodeToV8Object($nodeToReturn);\n";
+            "return V8Proxy::convertNodeToV8Object($nodeToReturn);\n";
         $result .= $indent . "return v8::Null();\n";
         return $result;
     } elsif ($returnType eq "void") {
@@ -1547,7 +1547,7 @@ sub GenerateFunctionCallString()
 
     if ($returnsPodType) {
         my $classIndex = uc($returnType);
-        $result .= $indent . "return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);\n";
+        $result .= $indent . "return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n";
     } else {
         $result .= $indent . "return " . NativeToJSValue($function->signature, $return) . ";\n";
     }
@@ -1603,6 +1603,7 @@ sub IsRefPtrType
     return 1 if $type eq "Element";
     return 1 if $type eq "EntityReference";
     return 1 if $type eq "Event";
+    return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
     return 1 if $type eq "HTMLDocument";
     return 1 if $type eq "HTMLElement";
@@ -1706,6 +1707,7 @@ my %typeCanFailConversion = (
     "AtomicString" => 0,
     "Attr" => 1,
     "CompareHow" => 0,
+    "DataGridColumn" => 0,
     "DOMString" => 0,
     "DOMWindow" => 0,
     "DocumentType" => 0,
@@ -1809,7 +1811,7 @@ sub JSValueToNative
     }
 
     if ($type eq "NodeFilter") {
-        return "V8Proxy::ToNativeNodeFilter($value)";
+        return "V8Proxy::wrapNativeNodeFilter($value)";
     }
 
     if ($type eq "SVGRect") {
@@ -1821,12 +1823,12 @@ sub JSValueToNative
     }
 
     # Default, assume autogenerated type conversion routines
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
     if ($type eq "EventTarget") {
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8Proxy::DOMWrapperToNode<Node>($value) : 0";
+        return "V8Node::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<Node>($value) : 0";
     }
 
     AddIncludesForType($type);
@@ -1837,7 +1839,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8Proxy::DOMWrapperToNode<${type}>($value) : 0";
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<${type}>($value) : 0";
     } else {
         # TODO: Temporary to avoid Window name conflict.
         my $classIndex = uc($type);
@@ -1856,7 +1858,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8Proxy::ToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, $value) : 0";
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, $value) : 0";
     }
 }
 
@@ -2010,23 +2012,23 @@ sub NativeToJSValue
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        return "V8Proxy::NodeToV8Object($value)";
+        return "V8Proxy::convertNodeToV8Object($value)";
     }
 
     if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
-        return "V8Proxy::EventTargetToV8Object($value)";
+        return "V8Proxy::convertEventTargetToV8Object($value)";
     }
 
     if ($type eq "Event") {
-        return "V8Proxy::EventToV8Object($value)";
+        return "V8Proxy::convertEventToV8Object($value)";
     }
 
     if ($type eq "EventListener") {
-        return "V8Proxy::EventListenerToV8Object($value)";
+        return "V8Proxy::convertEventListenerToV8Object($value)";
     }
 
     if ($type eq "RGBColor") {
-        return "V8Proxy::ToV8Object(V8ClassIndex::RGBCOLOR, new RGBColor($value))";
+        return "V8Proxy::convertToV8Object(V8ClassIndex::RGBCOLOR, new RGBColor($value))";
     }
 
     if ($type eq "WorkerContext" or $type eq "WorkerLocation" or $type eq "WorkerNavigator") {
@@ -2045,7 +2047,7 @@ sub NativeToJSValue
             $value = GenerateSVGStaticPodTypeWrapper($type, $value);
         }
 
-        return "V8Proxy::ToV8Object(V8ClassIndex::$classIndex, $value)";
+        return "V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
     }
 }
 
@@ -2117,7 +2119,7 @@ sub GenerateSVGContextAssignment
     my $indent = shift;
 
     $result = GenerateSVGContextRetrieval($srcType, $indent);
-    $result .=   $indent . "V8Proxy::SetSVGContext($value, context);\n";
+    $result .=   $indent . "V8Proxy::setSVGContext($value, context);\n";
 
     return $result;
 }
@@ -2137,7 +2139,7 @@ sub GenerateSVGContextRetrieval
     my $contextDecl;
 
     if (IsSVGTypeNeedingContextParameter($srcType)) {
-        $contextDecl = "V8Proxy::GetSVGContext($srcObject)";
+        $contextDecl = "V8Proxy::svgContext($srcObject)";
     } else {
         $contextDecl = $srcObject;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 2aadeb9..ce4c343 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -5718,7 +5718,7 @@ Color CSSStyleSelector::getColorFromPrimitiveValue(CSSPrimitiveValue* primitiveV
         } else if (ident == CSSValueWebkitActivelink)
             col = m_element->document()->activeLinkColor();
         else if (ident == CSSValueWebkitFocusRingColor)
-            col = focusRingColor();
+            col = RenderTheme::defaultTheme()->focusRingColor();
         else if (ident == CSSValueCurrentcolor)
             col = m_style->color();
         else
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index b94abbf..668458c 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -30,12 +30,16 @@ audio {
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-user-select: none;
     position: absolute;
     bottom: 0;
     width: 100%;
-    height: 100%;
-    -webkit-user-select: none;
     z-index: 0;
+    overflow: hidden;
+    height: 16px;
+    text-align: right;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
@@ -44,32 +48,26 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
     -webkit-appearance: media-play-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: end;
+    -webkit-box-flex: 1;
     -webkit-user-select: none;
-    position: absolute;
-    padding: 0px 16px 0px 0px;
-    top: auto;
-    bottom: 0;
-    left: 32px;
-    right: 32px;
     height: 16px;
 }
 
@@ -83,35 +81,27 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0px;
-    right: 0px;
+    display: -webkit-box;
+    -webkit-box-flex: 1;
     height: 16px;
     padding: 0px 2px;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     -webkit-appearance: media-seek-forward-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
     display: none;
 }
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
index 3a49816..900dcf2 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
@@ -22,7 +22,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-/* alternate media controls */
+/* alternate media controls - Extend mediaControls.css */
 
 audio {
     width: 200px;
@@ -30,47 +30,26 @@ audio {
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
-    -webkit-user-select: none;
-    position: absolute;
-    bottom: 0;
-    width: 100%;
-    height: 100%;
-    z-index: 0;
+    /* In mediaControls.css */
+    height: 25px;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
-    bottom: -16px;
+    bottom: -25px;
 }
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
-    -webkit-appearance: media-mute-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 0;
-    left: auto;
+    -webkit-box-ordinal-group: 2; /* At the end of the controller bar */
     width: 30px;
     height: 25px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
-    -webkit-appearance: media-play-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0px;
     width: 30px;
     height: 25px;
 }
 
 audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
-    -webkit-appearance: media-timeline-container;
-    -webkit-user-select: none;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 30px;
-    right: 30px;
     height: 25px;
 }
 
@@ -78,16 +57,12 @@ audio::-webkit-media-controls-current-time-display, video::-webkit-media-control
     -webkit-appearance: media-current-time-display;
     -webkit-user-select: none;
     display: inline-block;
-    position: absolute;
     cursor: default;
     font: -webkit-small-control;
     font-size: .09em;
     text-align: center;
     overflow: hidden;
     line-height: 13px;
-    top: auto;
-    bottom: 6px;
-    left: 0px;
     height: 14px;
     width: 45px;
 }
@@ -96,36 +71,28 @@ audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-contr
     -webkit-appearance: media-time-remaining-display;
     -webkit-user-select: none;
     display: inline-block;
-    position: absolute;
     cursor: default;
     font: -webkit-small-control;
     font-size: .09em;
     text-align: center;
     overflow: hidden;
     line-height: 13px;
-    top: auto;
-    bottom: 6px;
-    right: 0px;
     height: 14px;
     width: 45px;
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
-    -webkit-appearance: media-slider;
-    position: absolute;
-    top: auto;
-    bottom: 6px;
-    left: 45px;
-    right: 45px;
     height: 13px;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     display: none;
+    width: 0px;
 }
 
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     display: none;
+    width: 0px;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index 59ae026..0fea604 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -33,6 +33,8 @@
 
 namespace WebCore {
 
+    class FileList;
+
     // State available during IE's events for drag and drop and copy/paste
     class Clipboard : public RefCounted<Clipboard> {
     public:
@@ -53,11 +55,12 @@ namespace WebCore {
     
         // extensions beyond IE's API
         virtual HashSet<String> types() const = 0;
-    
+        virtual PassRefPtr<FileList> files() const = 0;
+
         IntPoint dragLocation() const { return m_dragLoc; }
         CachedImage* dragImage() const { return m_dragImage.get(); }
         virtual void setDragImage(CachedImage*, const IntPoint&) = 0;
-        Node* dragImageElement() { return m_dragImageElement.get(); }
+        Node* dragImageElement() const { return m_dragImageElement.get(); }
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
index 6fe83f7..dc8677e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
@@ -34,6 +34,7 @@ module core {
                  attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
                  attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
         readonly attribute [CustomGetter] Array types;
+        readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 783c629..065f708 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -314,14 +314,8 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 
 PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame* frame, bool inViewSourceMode)
 {
-    if (inViewSourceMode) {
-        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type)
-#if ENABLE(XHTMLMP)
-            || type == "application/vnd.wap.xhtml+xml"
-#endif
-           )
-            return HTMLViewSourceDocument::create(frame, type);
-    }
+    if (inViewSourceMode)
+        return HTMLViewSourceDocument::create(frame, type);
 
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index abf7a35..3d01c80 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -2540,7 +2540,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent);
+        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0);
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2570,7 +2570,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent);
+        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0);
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index b68785f..3ddf4c0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2633,7 +2633,7 @@ bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicStrin
     return dispatchMouseEvent(eventType, button, detail,
         contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget);
+        false, relatedTarget, 0);
 }
 
 void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 501df67..ab743f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -531,7 +531,7 @@ public:
     void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
 
     void dispatchSubtreeModifiedEvent();
-    void dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
+    void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
@@ -539,8 +539,8 @@ public:
     bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
         int pageX, int pageY, int screenX, int screenY,
         bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
+        bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
+    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
     void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
     void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 906902a..879bf62 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -258,8 +258,7 @@ void ProcessingInstruction::removedFromDocument()
 {
     ContainerNode::removedFromDocument();
 
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
 
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
     if (m_cachedSheet)
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
index ff8f1c3..1831f3a 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -198,8 +198,9 @@ void SelectElement::menuListOnChange(SelectElementData& data, Element* element)
     ASSERT(data.usesMenuList());
 
     int selected = selectedIndex(data, element);
-    if (data.lastOnChangeIndex() != selected) {
+    if (data.lastOnChangeIndex() != selected && data.userDrivenChange()) {
         data.setLastOnChangeIndex(selected);
+        data.setUserDrivenChange(false);
         element->dispatchFormControlChangeEvent();
     }
 }
@@ -309,7 +310,7 @@ int SelectElement::selectedIndex(const SelectElementData& data, const Element* e
     return -1;
 }
 
-void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChange)
+void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChangeNow, bool userDrivenChange)
 {
     const Vector<Element*>& items = data.listItems(element);
     int listIndex = optionToListIndex(data, element, optionIndex);
@@ -335,9 +336,12 @@ void SelectElement::setSelectedIndex(SelectElementData& data, Element* element,
 
     scrollToSelection(data, element);
 
-    // This only gets called with fireOnChange for menu lists. 
-    if (fireOnChange && data.usesMenuList())
-        menuListOnChange(data, element);
+    // This only gets called with fireOnChangeNow for menu lists. 
+    if (data.usesMenuList()) {
+        data.setUserDrivenChange(userDrivenChange);
+        if (fireOnChangeNow)
+            menuListOnChange(data, element);
+    }
 
     if (Frame* frame = element->document()->frame())
         frame->page()->chrome()->client()->formStateDidChange(element);
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
index bad9b79..29187ae 100644
--- a/src/3rdparty/webkit/WebCore/dom/SelectElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -57,7 +57,8 @@ public:
     virtual int optionToListIndex(int optionIndex) const = 0;
 
     virtual int selectedIndex() const = 0;
-    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false) = 0;
+    virtual void setSelectedIndex(int index, bool deselect = true) = 0;
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false) = 0;
 
 protected:
     virtual ~SelectElement() { }
@@ -78,7 +79,7 @@ protected:
     static void setRecalcListItems(SelectElementData&, Element*);
     static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
     static int selectedIndex(const SelectElementData&, const Element*);
-    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChange = false);
+    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChangeNow = false, bool userDrivenChange = true);
     static int optionToListIndex(const SelectElementData&, const Element*, int optionIndex);
     static int listToOptionIndex(const SelectElementData&, const Element*, int listIndex);
     static void dispatchFocusEvent(SelectElementData&, Element*);
@@ -117,6 +118,9 @@ public:
     int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
     void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
 
+    bool userDrivenChange() const { return m_userDrivenChange; }
+    void setUserDrivenChange(bool value) { m_userDrivenChange = value; }
+
     Vector<bool>& lastOnChangeSelection() { return m_lastOnChangeSelection; }
 
     bool activeSelectionState() const { return m_activeSelectionState; }
@@ -154,6 +158,7 @@ private:
 
     int m_lastOnChangeIndex;
     Vector<bool> m_lastOnChangeSelection;
+    bool m_userDrivenChange;
 
     bool m_activeSelectionState;
     int m_activeSelectionAnchorIndex;
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index ab62c09..5a189d4 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -1247,9 +1247,10 @@ static String valueForeColor(Frame* frame, Event*)
 
 // Map of functions
 
-struct CommandEntry { const char* name; EditorInternalCommand command; };
 static const CommandMap& createCommandMap()
 {
+    struct CommandEntry { const char* name; EditorInternalCommand command; };
+    
     static const CommandEntry commands[] = {
         { "AlignCenter", { executeJustifyCenter, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "AlignJustified", { executeJustifyFull, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 0f9b106..3922367 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -78,7 +78,7 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 
 // This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
 // correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
-PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
+PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
 {
     int currentBlockquoteLevel = 0;
     int lastBlockquoteLevel = 0;
@@ -107,6 +107,62 @@ PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(Vis
     return placeholder.release();
 }
 
+bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
+{
+    // If our selection is not inside a list, bail out.
+    Node* lastNodeInSelectedParagraph = endOfCurrentParagraph.deepEquivalent().node();
+    RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph);
+    if (!listNode)
+        return false;
+
+    HTMLElement* selectedListItem = enclosingListChild(lastNodeInSelectedParagraph);
+
+    // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
+    Element* previousList = selectedListItem->previousElementSibling();
+    Element* nextList = selectedListItem->nextElementSibling();
+
+    RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
+    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
+    RefPtr<Element> placeholder = createBreakElement(document());
+    insertNodeBefore(newList, selectedListItem);
+    appendNode(newListItem, newList);
+    appendNode(placeholder, newListItem);
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
+
+    if (canMergeLists(previousList, newList.get()))
+        mergeIdenticalElements(previousList, newList);
+    if (canMergeLists(newList.get(), nextList))
+        mergeIdenticalElements(newList, nextList);
+
+    return true;
+}
+    
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
+{
+    Node* enclosingCell = 0;
+
+    if (!targetBlockquote) {
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
+        // this by splitting all parents of the current paragraph up to that point.
+        targetBlockquote = createIndentBlockquoteElement(document());
+        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+        enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
+        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+        insertNodeBefore(targetBlockquote, startOfNewBlock);
+    }
+
+    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
+
+    // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
+    // the next paragraph is in the same cell.
+    if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
+        targetBlockquote = 0;
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
+}
+
 void IndentOutdentCommand::indentRegion()
 {
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
@@ -117,7 +173,7 @@ void IndentOutdentCommand::indentRegion()
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    
+
     // Special case empty root editable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -129,58 +185,21 @@ void IndentOutdentCommand::indentRegion()
         setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
         return;
     }
-    
-    RefPtr<Element> previousListNode;
-    RefPtr<Element> newListNode;
-    RefPtr<Element> newBlockquote;
+
+    RefPtr<Element> blockquoteForNextIndent;
     VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
     while (endOfCurrentParagraph != endAfterSelection) {
         // Iterate across the selected paragraphs...
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-        RefPtr<Element> listNode = enclosingList(endOfCurrentParagraph.deepEquivalent().node());
-        RefPtr<Element> insertionPoint;
-        if (listNode) {
-            RefPtr<Element> placeholder = createBreakElement(document());
-            insertionPoint = placeholder;
-            newBlockquote = 0;
-            RefPtr<Element> listItem = createListItemElement(document());
-            if (listNode == previousListNode) {
-                // The previous paragraph was inside the same list, so add this list item to the list we already created
-                appendNode(listItem, newListNode);
-                appendNode(placeholder, listItem);
-            } else {
-                // Clone the list element, insert it before the current paragraph, and move the paragraph into it.
-                RefPtr<Element> clonedList = listNode->cloneElementWithoutChildren();
-                insertNodeBefore(clonedList, enclosingListChild(endOfCurrentParagraph.deepEquivalent().node()));
-                appendNode(listItem, clonedList);
-                appendNode(placeholder, listItem);
-                newListNode = clonedList;
-                previousListNode = listNode;
-            }
-        } else if (newBlockquote)
-            // The previous paragraph was put into a new blockquote, so move this paragraph there as well
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-        else {
-            // Create a new blockquote and insert it as a child of the root editable element. We accomplish
-            // this by splitting all parents of the current paragraph up to that point.
-            RefPtr<Element> blockquote = createIndentBlockquoteElement(document());
-            Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-            
-            Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
-            Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
-            RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
-            insertNodeBefore(blockquote, startOfNewBlock);
-            newBlockquote = blockquote;
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-            // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
-            // the next paragraph is in the same cell.
-            if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
-                newBlockquote = 0;
-        }
-        moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
-        // moveParagraph should not destroy content that contains endOfNextParagraph, but if it does, return here
-        // to avoid a crash.
+        if (tryIndentingAsListItem(endOfCurrentParagraph))
+            blockquoteForNextIndent = 0;
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+            // blockquoteForNextIndent maybe updated
+            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
+        // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
+        // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
             ASSERT_NOT_REACHED();
             return;
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index bb1a1d2..419f832f 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -49,7 +49,9 @@ private:
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
-    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(VisiblePosition&, RefPtr<Element>&);
+    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
+    bool tryIndentingAsListItem(const VisiblePosition&);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index 5ce4e56..f5901d7 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -58,6 +58,7 @@ TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, con
       m_killRing(killRing),
       m_openedByBackwardDelete(false)
 {
+    updatePreservesTypingStyle(m_commandType);
 }
 
 void TypingCommand::deleteSelection(Document* document, bool smartDelete)
@@ -309,8 +310,10 @@ void TypingCommand::markMisspellingsAfterTyping()
     }
 }
 
-void TypingCommand::typingAddedToOpenCommand()
+void TypingCommand::typingAddedToOpenCommand(ETypingCommand commandTypeForAddedTyping)
 {
+    updatePreservesTypingStyle(commandTypeForAddedTyping);
+    
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     document()->frame()->editor()->appliedEditing(this);
     // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
@@ -360,19 +363,19 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
         applyCommandToComposite(command);
     }
     command->input(text, selectInsertedText);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertText);
 }
 
 void TypingCommand::insertLineBreak()
 {
     applyCommandToComposite(InsertLineBreakCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertLineBreak);
 }
 
 void TypingCommand::insertParagraphSeparator()
 {
     applyCommandToComposite(InsertParagraphSeparatorCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparator);
 }
 
 void TypingCommand::insertParagraphSeparatorInQuotedContent()
@@ -385,7 +388,7 @@ void TypingCommand::insertParagraphSeparatorInQuotedContent()
     }
         
     applyCommandToComposite(BreakBlockquoteCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparatorInQuotedContent);
 }
 
 bool TypingCommand::makeEditableRootEmpty()
@@ -423,7 +426,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             // After breaking out of an empty mail blockquote, we still want continue with the deletion
             // so actual content will get deleted, and not just the quote style.
             if (breakOutOfEmptyMailBlockquotedParagraph())
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(DeleteKey);
         
             m_smartDelete = false;
 
@@ -436,12 +439,12 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             if (endingSelection().visibleStart().previous(true).isNull()) {
                 // When the caret is at the start of the editable area in an empty list item, break out of the list item.
                 if (breakOutOfEmptyListItem()) {
-                    typingAddedToOpenCommand();
+                    typingAddedToOpenCommand(DeleteKey);
                     return;
                 }
                 // When there are no visible positions in the editing root, delete its entire contents.
                 if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
-                    typingAddedToOpenCommand();
+                    typingAddedToOpenCommand(DeleteKey);
                     return;
                 }
             }
@@ -457,7 +460,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             // If the caret is just after a table, select the table and don't delete anything.
             } else if (Node* table = isFirstPositionAfterTable(visibleStart)) {
                 setEndingSelection(VisibleSelection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(DeleteKey);
                 return;
             }
 
@@ -498,7 +501,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
         setStartingSelection(selectionAfterUndo);
     CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
     setSmartDelete(false);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(DeleteKey);
 }
 
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool killRing)
@@ -530,7 +533,7 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
             // When deleting tables: Select the table first, then perform the deletion
             if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.deprecatedEditingOffset() == 0) {
                 setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.node()), DOWNSTREAM));
-                typingAddedToOpenCommand();
+                typingAddedToOpenCommand(ForwardDeleteKey);
                 return;
             }
 
@@ -578,30 +581,32 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
     setStartingSelection(selectionAfterUndo);
     CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
     setSmartDelete(false);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(ForwardDeleteKey);
 }
 
 void TypingCommand::deleteSelection(bool smartDelete)
 {
     CompositeEditCommand::deleteSelection(smartDelete);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(DeleteSelection);
 }
 
-bool TypingCommand::preservesTypingStyle() const
+void TypingCommand::updatePreservesTypingStyle(ETypingCommand commandType)
 {
-    switch (m_commandType) {
+    switch (commandType) {
         case DeleteSelection:
         case DeleteKey:
         case ForwardDeleteKey:
         case InsertParagraphSeparator:
         case InsertLineBreak:
-            return true;
+            m_preservesTypingStyle = true;
+            return;
         case InsertParagraphSeparatorInQuotedContent:
         case InsertText:
-            return false;
+            m_preservesTypingStyle = false;
+            return;
     }
     ASSERT_NOT_REACHED();
-    return false;
+    m_preservesTypingStyle = false;
 }
 
 bool TypingCommand::isTypingCommand() const
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
index 2c52447..7c89a7c 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
@@ -79,10 +79,11 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const;
     virtual bool isTypingCommand() const;
-    virtual bool preservesTypingStyle() const;
+    virtual bool preservesTypingStyle() const { return m_preservesTypingStyle; }
 
+    void updatePreservesTypingStyle(ETypingCommand);
     void markMisspellingsAfterTyping();
-    void typingAddedToOpenCommand();
+    void typingAddedToOpenCommand(ETypingCommand);
     bool makeEditableRootEmpty();
     
     ETypingCommand m_commandType;
@@ -92,6 +93,7 @@ private:
     bool m_smartDelete;
     TextGranularity m_granularity;
     bool m_killRing;
+    bool m_preservesTypingStyle;
     
     // Undoing a series of backward deletes will restore a selection around all of the
     // characters that were deleted, but only if the typing command being undone
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index a4c1f83..c0bf009 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -665,7 +665,7 @@ HTMLElement* enclosingList(Node* node)
     return 0;
 }
 
-Node* enclosingListChild(Node *node)
+HTMLElement* enclosingListChild(Node *node)
 {
     if (!node)
         return 0;
@@ -676,7 +676,7 @@ Node* enclosingListChild(Node *node)
     // FIXME: This function is inappropriately named if it starts with node instead of node->parentNode()
     for (Node* n = node; n && n->parentNode(); n = n->parentNode()) {
         if (n->hasTagName(liTag) || isListElement(n->parentNode()))
-            return n;
+            return static_cast<HTMLElement*>(n);
         if (n == root || isTableCell(n))
             return 0;
     }
@@ -738,6 +738,18 @@ HTMLElement* outermostEnclosingList(Node* node)
     return list;
 }
 
+bool canMergeLists(Element* firstList, Element* secondList)
+{
+    if (!firstList || !secondList)
+        return false;
+
+    return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
+    && isContentEditable(firstList) && isContentEditable(secondList)// both lists are editable
+    && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
+    && isVisibilyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    // Make sure there is no visible content between this li and the previous list
+}
+
 Node* highestAncestor(Node* node)
 {
     ASSERT(node);
@@ -971,6 +983,11 @@ int indexForVisiblePosition(VisiblePosition& visiblePosition)
     return TextIterator::rangeLength(range.get(), true);
 }
 
+bool isVisibilyAdjacent(const Position& first, const Position& second)
+{
+    return VisiblePosition(first) == VisiblePosition(second.upstream());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index 374b512..25ff847 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -123,7 +123,8 @@ Node* enclosingAnchorElement(const Position&);
 bool isListElement(Node*);
 HTMLElement* enclosingList(Node*);
 HTMLElement* outermostEnclosingList(Node*);
-Node* enclosingListChild(Node*);
+HTMLElement* enclosingListChild(Node*);
+bool canMergeLists(Element* firstList, Element* secondList);
 Node* highestAncestor(Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
@@ -134,7 +135,7 @@ bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
 
 int indexForVisiblePosition(VisiblePosition&);
-
+bool isVisibilyAdjacent(const Position& first, const Position& second);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 9df81d8..4ad3078 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -3811,17 +3811,17 @@ yyreduce:
 
   case 196:
 #line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
@@ -3888,7 +3888,7 @@ yyreduce:
 #line 855 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3936,7 +3936,7 @@ yyreduce:
 #line 892 "../../JavaScriptCore/parser/Grammar.y"
     { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -5092,10 +5092,14 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
     return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 7e8c9f7..4e23159 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -290,10 +290,13 @@ DEFINE_GLOBAL(QualifiedName, archiveAttr, nullAtom, "archive", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, aria_activedescendantAttr, nullAtom, "aria_activedescendant", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_checkedAttr, nullAtom, "aria_checked", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_describedbyAttr, nullAtom, "aria_describedby", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_disabledAttr, nullAtom, "aria_disabled", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_hiddenAttr, nullAtom, "aria_hidden", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labeledbyAttr, nullAtom, "aria_labeledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
@@ -524,10 +527,13 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&aria_activedescendantAttr,
         (WebCore::QualifiedName*)&aria_checkedAttr,
         (WebCore::QualifiedName*)&aria_describedbyAttr,
+        (WebCore::QualifiedName*)&aria_disabledAttr,
+        (WebCore::QualifiedName*)&aria_hiddenAttr,
         (WebCore::QualifiedName*)&aria_labeledbyAttr,
         (WebCore::QualifiedName*)&aria_labelledbyAttr,
         (WebCore::QualifiedName*)&aria_levelAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
+        (WebCore::QualifiedName*)&aria_readonlyAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
@@ -742,7 +748,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 229;
+    *size = 232;
     return HTMLAttr;
 }
 
@@ -1002,10 +1008,13 @@ void init()
     const char *aria_activedescendantAttrString = "aria-activedescendant";
     const char *aria_checkedAttrString = "aria-checked";
     const char *aria_describedbyAttrString = "aria-describedby";
+    const char *aria_disabledAttrString = "aria-disabled";
+    const char *aria_hiddenAttrString = "aria-hidden";
     const char *aria_labeledbyAttrString = "aria-labeledby";
     const char *aria_labelledbyAttrString = "aria-labelledby";
     const char *aria_levelAttrString = "aria-level";
     const char *aria_pressedAttrString = "aria-pressed";
+    const char *aria_readonlyAttrString = "aria-readonly";
     const char *aria_valuemaxAttrString = "aria-valuemax";
     const char *aria_valueminAttrString = "aria-valuemin";
     const char *aria_valuenowAttrString = "aria-valuenow";
@@ -1230,10 +1239,13 @@ void init()
     new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, aria_activedescendantAttrString, nullAtom);
     new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, aria_checkedAttrString, nullAtom);
     new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, aria_describedbyAttrString, nullAtom);
+    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, aria_disabledAttrString, nullAtom);
+    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, aria_hiddenAttrString, nullAtom);
     new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, aria_labeledbyAttrString, nullAtom);
     new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, aria_labelledbyAttrString, nullAtom);
     new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
     new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
+    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
     new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
     new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
     new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index ad0bd4f..fba6088 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -165,10 +165,13 @@ extern const WebCore::QualifiedName archiveAttr;
 extern const WebCore::QualifiedName aria_activedescendantAttr;
 extern const WebCore::QualifiedName aria_checkedAttr;
 extern const WebCore::QualifiedName aria_describedbyAttr;
+extern const WebCore::QualifiedName aria_disabledAttr;
+extern const WebCore::QualifiedName aria_hiddenAttr;
 extern const WebCore::QualifiedName aria_labeledbyAttr;
 extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
+extern const WebCore::QualifiedName aria_readonlyAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index 4aedc14..19c40b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -22,6 +22,8 @@
 #include "JSClipboard.h"
 
 #include "Clipboard.h"
+#include "FileList.h"
+#include "JSFileList.h"
 #include "KURL.h"
 #include <runtime/Error.h>
 #include <wtf/GetPtr.h>
@@ -34,20 +36,21 @@ ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 /* Hash table */
 
-static const HashTableValue JSClipboardTableValues[5] =
+static const HashTableValue JSClipboardTableValues[6] =
 {
     { "dropEffect", DontDelete, (intptr_t)jsClipboardDropEffect, (intptr_t)setJSClipboardDropEffect },
     { "effectAllowed", DontDelete, (intptr_t)jsClipboardEffectAllowed, (intptr_t)setJSClipboardEffectAllowed },
     { "types", DontDelete|ReadOnly, (intptr_t)jsClipboardTypes, (intptr_t)0 },
+    { "files", DontDelete|ReadOnly, (intptr_t)jsClipboardFiles, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsClipboardConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSClipboardTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSClipboardTableValues, 0 };
+    { 63, JSClipboardTableValues, 0 };
 #else
-    { 10, 7, JSClipboardTableValues, 0 };
+    { 17, 15, JSClipboardTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -160,6 +163,13 @@ JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot&
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->types(exec);
 }
 
+JSValue jsClipboardFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->files()));
+}
+
 JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->getConstructor(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index a9d51ab..a6fbe3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -91,6 +91,7 @@ void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
new file mode 100644
index 0000000..105b916
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -0,0 +1,289 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumn.h"
+
+#include "DataGridColumn.h"
+#include "KURL.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumn);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnTableValues[8] =
+{
+    { "id", DontDelete, (intptr_t)jsDataGridColumnId, (intptr_t)setJSDataGridColumnId },
+    { "label", DontDelete, (intptr_t)jsDataGridColumnLabel, (intptr_t)setJSDataGridColumnLabel },
+    { "type", DontDelete, (intptr_t)jsDataGridColumnType, (intptr_t)setJSDataGridColumnType },
+    { "sortable", DontDelete, (intptr_t)jsDataGridColumnSortable, (intptr_t)setJSDataGridColumnSortable },
+    { "sortDirection", DontDelete, (intptr_t)jsDataGridColumnSortDirection, (intptr_t)setJSDataGridColumnSortDirection },
+    { "primary", DontDelete, (intptr_t)jsDataGridColumnPrimary, (intptr_t)setJSDataGridColumnPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSDataGridColumnTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnConstructorTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnConstructorTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnConstructor : public DOMObject {
+public:
+    JSDataGridColumnConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnConstructor::s_info = { "DataGridColumnConstructor", 0, &JSDataGridColumnConstructorTable, 0 };
+
+bool JSDataGridColumnConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnConstructor, DOMObject>(exec, &JSDataGridColumnConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnPrototype::s_info = { "DataGridColumnPrototype", 0, &JSDataGridColumnPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumn>(exec, globalObject);
+}
+
+bool JSDataGridColumnPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnPrototype, JSObject>(exec, &JSDataGridColumnPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumn::s_info = { "DataGridColumn", 0, &JSDataGridColumnTable, 0 };
+
+JSDataGridColumn::JSDataGridColumn(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumn> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumn::~JSDataGridColumn()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumn::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnPrototype(JSDataGridColumnPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumn::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, slot);
+}
+
+JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->id());
+}
+
+JSValue jsDataGridColumnLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->label());
+}
+
+JSValue jsDataGridColumnType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->type());
+}
+
+JSValue jsDataGridColumnSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortable());
+}
+
+JSValue jsDataGridColumnSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortDirection());
+}
+
+JSValue jsDataGridColumnPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->primary());
+}
+
+JSValue jsDataGridColumnConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSDataGridColumn, Base>(exec, propertyName, value, &JSDataGridColumnTable, this, slot);
+}
+
+void setJSDataGridColumnId(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setId(value.toString(exec));
+}
+
+void setJSDataGridColumnLabel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setLabel(value.toString(exec));
+}
+
+void setJSDataGridColumnType(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setType(value.toString(exec));
+}
+
+void setJSDataGridColumnSortable(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortable(value.toInt32(exec));
+}
+
+void setJSDataGridColumnSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortDirection(value.toInt32(exec));
+}
+
+void setJSDataGridColumnPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setPrimary(value.toBoolean(exec));
+}
+
+JSValue JSDataGridColumn::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnConstructor>(exec);
+}
+
+// Constant getters
+
+JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumn* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumn>(exec, object);
+}
+DataGridColumn* toDataGridColumn(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumn::s_info) ? static_cast<JSDataGridColumn*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
new file mode 100644
index 0000000..331ad9d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -0,0 +1,98 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumn_h
+#define JSDataGridColumn_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumn;
+
+class JSDataGridColumn : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumn(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumn>);
+    virtual ~JSDataGridColumn();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumn* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumn> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumn*);
+DataGridColumn* toDataGridColumn(JSC::JSValue);
+
+class JSDataGridColumnPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsDataGridColumnId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
new file mode 100644
index 0000000..276878e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -0,0 +1,301 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "ExceptionCode.h"
+#include "JSDataGridColumn.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumnList);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnListTableValues[5] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListLength, (intptr_t)0 },
+    { "sortColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListSortColumn, (intptr_t)0 },
+    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListPrimaryColumn, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnListConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSDataGridColumnListTableValues, 0 };
+#else
+    { 10, 7, JSDataGridColumnListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDataGridColumnListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSDataGridColumnListConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnListConstructor : public DOMObject {
+public:
+    JSDataGridColumnListConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnListPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnListConstructor::s_info = { "DataGridColumnListConstructor", 0, &JSDataGridColumnListConstructorTable, 0 };
+
+bool JSDataGridColumnListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnListConstructor, DOMObject>(exec, &JSDataGridColumnListConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionItem, (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionAdd, (intptr_t)5 },
+    { "remove", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionRemove, (intptr_t)1 },
+    { "move", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionMove, (intptr_t)2 },
+    { "clear", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionClear, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnListPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnListPrototype::s_info = { "DataGridColumnListPrototype", 0, &JSDataGridColumnListPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumnList>(exec, globalObject);
+}
+
+bool JSDataGridColumnListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSDataGridColumnListPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumnList::s_info = { "DataGridColumnList", 0, &JSDataGridColumnListTable, 0 };
+
+JSDataGridColumnList::JSDataGridColumnList(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumnList> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumnList::~JSDataGridColumnList()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumnList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnListPrototype(JSDataGridColumnListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSDataGridColumnListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<DataGridColumnList*>(impl()), propertyName)) {
+        slot.setCustom(this, nameGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSDataGridColumnList, Base>(exec, &JSDataGridColumnListTable, this, propertyName, slot);
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsDataGridColumnListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsDataGridColumnListSortColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->sortColumn()));
+}
+
+JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->primaryColumn()));
+}
+
+JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumnList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getPropertyNames(exec, propertyNames);
+}
+
+JSValue JSDataGridColumnList::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnListConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    int index = args.at(0).toInt32(exec);
+    if (index < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    const UString& id = args.at(0).toString(exec);
+    const UString& label = args.at(1).toString(exec);
+    const UString& type = args.at(2).toString(exec);
+    bool primary = args.at(3).toBoolean(exec);
+    unsigned short sortable = args.at(4).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->add(id, label, type, primary, sortable)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+
+    imp->remove(column);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+    imp->move(column, index);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+
+    imp->clear();
+    return jsUndefined();
+}
+
+
+JSValue JSDataGridColumnList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, static_cast<DataGridColumnList*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumnList* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumnList>(exec, object);
+}
+DataGridColumnList* toDataGridColumnList(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumnList::s_info) ? static_cast<JSDataGridColumnList*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
new file mode 100644
index 0000000..879daf9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -0,0 +1,93 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumnList_h
+#define JSDataGridColumnList_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class JSDataGridColumnList : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumnList(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumnList>);
+    virtual ~JSDataGridColumnList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumnList* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumnList> m_impl;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+private:
+    static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumnList*);
+DataGridColumnList* toDataGridColumnList(JSC::JSValue);
+
+class JSDataGridColumnListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
index fe6f6dd..a608a1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -23,6 +23,7 @@
 
 #include "HTMLDataGridColElement.h"
 #include "KURL.h"
+#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
 #include <wtf/GetPtr.h>
 
@@ -146,14 +147,14 @@ JSValue jsHTMLDataGridColElementSortable(ExecState* exec, const Identifier&, con
 {
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->sortable());
+    return jsNumber(exec, imp->sortable());
 }
 
 JSValue jsHTMLDataGridColElementSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(exec);
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->sortDirection());
+    return jsNumber(exec, imp->sortDirection());
 }
 
 JSValue jsHTMLDataGridColElementPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
@@ -187,13 +188,13 @@ void setJSHTMLDataGridColElementType(ExecState* exec, JSObject* thisObject, JSVa
 void setJSHTMLDataGridColElementSortable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
-    imp->setSortable(value.toBoolean(exec));
+    imp->setSortable(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
-    imp->setSortDirection(value.toString(exec));
+    imp->setSortDirection(value.toInt32(exec));
 }
 
 void setJSHTMLDataGridColElementPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
index c827a4b..ea4237c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -21,7 +21,9 @@
 #include "config.h"
 #include "JSHTMLDataGridElement.h"
 
+#include "DataGridColumnList.h"
 #include "HTMLDataGridElement.h"
+#include "JSDataGridColumnList.h"
 #include <wtf/GetPtr.h>
 
 using namespace JSC;
@@ -32,9 +34,10 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLDataGridElementTableValues[6] =
+static const HashTableValue JSHTMLDataGridElementTableValues[7] =
 {
     { "dataSource", DontDelete, (intptr_t)jsHTMLDataGridElementDataSource, (intptr_t)setJSHTMLDataGridElementDataSource },
+    { "columns", DontDelete|ReadOnly, (intptr_t)jsHTMLDataGridElementColumns, (intptr_t)0 },
     { "autofocus", DontDelete, (intptr_t)jsHTMLDataGridElementAutofocus, (intptr_t)setJSHTMLDataGridElementAutofocus },
     { "disabled", DontDelete, (intptr_t)jsHTMLDataGridElementDisabled, (intptr_t)setJSHTMLDataGridElementDisabled },
     { "multiple", DontDelete, (intptr_t)jsHTMLDataGridElementMultiple, (intptr_t)setJSHTMLDataGridElementMultiple },
@@ -44,9 +47,9 @@ static const HashTableValue JSHTMLDataGridElementTableValues[6] =
 
 static const HashTable JSHTMLDataGridElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 31, JSHTMLDataGridElementTableValues, 0 };
+    { 63, JSHTMLDataGridElementTableValues, 0 };
 #else
-    { 17, 15, JSHTMLDataGridElementTableValues, 0 };
+    { 18, 15, JSHTMLDataGridElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -130,6 +133,13 @@ JSValue jsHTMLDataGridElementDataSource(ExecState* exec, const Identifier&, cons
     return static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->dataSource(exec);
 }
 
+JSValue jsHTMLDataGridElementColumns(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->columns()));
+}
+
 JSValue jsHTMLDataGridElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
index 302e4dd..ee6c8d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -63,6 +63,7 @@ public:
 
 JSC::JSValue jsHTMLDataGridElementDataSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLDataGridElementDataSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementColumns(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 JSC::JSValue jsHTMLDataGridElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 void setJSHTMLDataGridElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLDataGridElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index 8bde6be..6c53189 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -4,5 +4,5 @@ extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
 extern const char sourceUserAgentStyleSheet[2004];
 extern const char wmlUserAgentStyleSheet[2956];
-extern const char mediaControlsUserAgentStyleSheet[1977];
+extern const char mediaControlsUserAgentStyleSheet[1999];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index 2beb068..efc6b9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -903,7 +903,7 @@ extern const char wmlUserAgentStyleSheet[2956] = {
     32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
     97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[1977] = {
+extern const char mediaControlsUserAgentStyleSheet[1999] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -911,122 +911,123 @@ extern const char mediaControlsUserAgentStyleSheet[1977] = {
     111, 108, 115, 45, 112, 97, 110, 101, 108, 44, 32, 118, 105, 100, 101, 111,
     58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
     99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123,
-    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
-    117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32,
-    119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 104, 101, 105,
-    103, 104, 116, 58, 32, 49, 48, 48, 37, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
-    110, 111, 110, 101, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 48,
-    59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105,
-    97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32,
-    123, 32, 98, 111, 116, 116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59,
-    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
-    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
-    45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
-    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
-    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
-    100, 105, 97, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59,
-    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
-    117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32,
-    98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58,
-    32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59,
-    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125,
-    32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112,
-    108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
-    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98,
-    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105,
-    97, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112,
-    111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116,
-    101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111,
-    116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 49,
-    54, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120,
-    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32,
-    125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
-    101, 114, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
-    115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97,
-    105, 110, 101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114, 105, 122,
+    111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
     115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101,
     59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111,
-    108, 117, 116, 101, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48,
-    112, 120, 32, 49, 54, 112, 120, 32, 48, 112, 120, 32, 48, 112, 120, 59,
-    32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116,
-    111, 109, 58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 51, 50, 112,
-    120, 59, 32, 114, 105, 103, 104, 116, 58, 32, 51, 50, 112, 120, 59, 32,
-    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
-    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117,
-    114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108,
-    97, 121, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108,
-    115, 45, 99, 117, 114, 114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100,
-    105, 115, 112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58,
-    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
-    111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109,
-    97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115,
-    112, 108, 97, 121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 108, 105, 110, 101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100,
-    105, 97, 45, 115, 108, 105, 100, 101, 114, 59, 32, 112, 111, 115, 105, 116,
-    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
-    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
-    58, 32, 48, 59, 32, 108, 101, 102, 116, 58, 32, 48, 112, 120, 59, 32,
-    114, 105, 103, 104, 116, 58, 32, 48, 112, 120, 59, 32, 104, 101, 105, 103,
-    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110,
-    103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59, 32, 125, 32, 97, 117,
+    108, 117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59,
+    32, 119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 122, 45,
+    105, 110, 100, 101, 120, 58, 32, 48, 59, 32, 111, 118, 101, 114, 102, 108,
+    111, 119, 58, 32, 104, 105, 100, 100, 101, 110, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 116, 101, 120, 116, 45, 97,
+    108, 105, 103, 110, 58, 32, 114, 105, 103, 104, 116, 59, 32, 125, 32, 118,
+    105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 117, 108,
+    108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105, 97, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
+    114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123, 32, 98, 111, 116,
+    116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117,
     100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
-    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105,
-    100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
-    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107,
-    45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99,
-    101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 98, 97,
-    99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112, 111, 115, 105, 116,
-    105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116, 101, 59, 32, 116,
-    111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111, 116, 116, 111, 109,
-    58, 32, 48, 59, 32, 114, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120,
-    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59, 32, 104,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 109,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104,
     101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97,
     117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
-    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101,
-    107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97,
+    121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116,
     116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
     112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45,
-    115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
-    116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 114,
-    105, 103, 104, 116, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32,
-    49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32,
+    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
+    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
+    109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114,
+    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
+    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 116,
+    105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101,
+    114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114,
+    105, 122, 111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
+    101, 114, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
+    112, 97, 99, 107, 58, 32, 101, 110, 100, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108,
+    101, 99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 104, 101, 105, 103, 104,
+    116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114, 114, 101, 110, 116,
+    45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114,
+    114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97,
+    121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
+    107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
+    108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110,
+    103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
+    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110,
+    101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 108,
+    105, 100, 101, 114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101,
+    101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112,
+    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101,
     98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99, 114, 101, 101, 110, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121,
-    58, 32, 110, 111, 110, 101, 59, 32, 125
+    111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
+    100, 105, 97, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119,
+    105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
+    111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99,
+    114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115,
+    99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.h b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
index 48d7e9d..ac7d124 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.h
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
@@ -38,6 +38,8 @@ typedef struct objc_object* id;
 
 #if PLATFORM(QT)
 #include <QVariant>
+#include <QByteArray>
+#include <QDataStream>
 #endif
 
 namespace WebCore {
@@ -163,6 +165,9 @@ public:
 #if PLATFORM(QT)
     QVariant userData() const { return m_userData; }
     void setUserData(const QVariant& userData) { m_userData = userData; }
+
+    bool restoreState(QDataStream& buffer, int version);
+    QDataStream& saveState(QDataStream& out, int version) const;
 #endif
 
 #ifndef NDEBUG
@@ -171,8 +176,8 @@ public:
 #endif
 
     void adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts);
-    const Vector<int>& dailyVisitCounts() { return m_dailyVisitCounts; }
-    const Vector<int>& weeklyVisitCounts() { return m_weeklyVisitCounts; }
+    const Vector<int>& dailyVisitCounts() const { return m_dailyVisitCounts; }
+    const Vector<int>& weeklyVisitCounts() const { return m_weeklyVisitCounts; }
 
 private:
     HistoryItem();
@@ -188,6 +193,10 @@ private:
 
     HistoryItem* findTargetItem();
 
+    /* When adding new member variables to this class, please notify the Qt team.
+     * qt/HistoryItemQt.cpp contains code to serialize history items.
+     */
+
     String m_urlString;
     String m_originalURLString;
     String m_referrer;
diff --git a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
new file mode 100644
index 0000000..68fee87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
@@ -0,0 +1,114 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "HistoryItem.h"
+
+#include "CString.h"
+#include "FormData.h"
+
+bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
+{
+    // there is no different version right now
+    // switch  (version) {
+    WebCore::String url;
+    WebCore::String title;
+    WebCore::String altTitle;
+    WebCore::String orginalUrl;
+    WebCore::String referrer;
+    WebCore::String target;
+    WebCore::String parrent;
+    double lastVisitedTime;
+    bool validUserData;
+    WebCore::String parent;
+    bool lastVisitWasHTTPNonGet;
+    bool lastVisitWasFailure;
+    bool isTargetItem;
+    int visitCount;
+    WTF::Vector<WebCore::String> documentState;
+    WebCore::IntPoint scrollPoint;
+    WTF::Vector<int> weeklyVisitCounts;
+    WTF::Vector<int> dailyVisitCounts;
+    bool loadFormdata;
+    // WebCore::String formContentType;
+    // WTF::Vector<char> formData;
+
+    in >> url >> title >> altTitle >> lastVisitedTime >> orginalUrl >> referrer >> target >> parent;
+    in >> lastVisitWasHTTPNonGet >> lastVisitWasFailure >> isTargetItem >> visitCount >> documentState;
+    in >> scrollPoint >> dailyVisitCounts >> weeklyVisitCounts;
+    /*in >> loadFormdata;
+    if (loadFormdata) {
+        in >> formContentType >> formData;
+        // direct assigned (!)
+        m_formContentType = formContentType;
+        m_formData = FormData::create(CString(formData));
+    }*/
+    // use setters
+    adoptVisitCounts(dailyVisitCounts, weeklyVisitCounts);
+    setScrollPoint(scrollPoint);
+    setDocumentState(documentState);
+    setVisitCount(visitCount);
+    setIsTargetItem(isTargetItem);
+    setLastVisitWasFailure(lastVisitWasFailure);
+    setLastVisitWasHTTPNonGet(lastVisitWasHTTPNonGet);
+    setParent(parent);
+    setTarget(target);
+    setReferrer(referrer);
+    setOriginalURLString(orginalUrl);
+    setURLString(url);
+    setLastVisitedTime(lastVisitedTime);
+    setTitle(title);
+    setAlternateTitle(altTitle);
+
+    // at the end load userData
+    in >> validUserData;
+    if (validUserData) {
+        QVariant tmp;
+        in >> tmp;
+        setUserData(tmp);
+    }
+
+    return in.status() == QDataStream::Ok;
+}
+
+QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int /*version*/) const
+{
+    // there is no different version right now
+    // switch  (version) {
+    out << urlString() << title() << alternateTitle() << lastVisitedTime();
+    out << originalURLString() << referrer() << target() << parent();
+    out << lastVisitWasHTTPNonGet() << lastVisitWasFailure() << isTargetItem();
+    out << visitCount() << documentState() << scrollPoint();
+    out << dailyVisitCounts() << weeklyVisitCounts();
+    /*if (m_formData) {
+        out << true;
+        out << formContentType();
+        out << m_formData->flatten();
+    } else {
+        out << false;
+    }*/
+    // save user data
+    if (userData().isValid())
+        out << true << userData();
+    else
+        out << false;
+
+    return out;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
index 7ab0da5..37f4799 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
@@ -937,6 +937,13 @@ void CanvasRenderingContext2D::checkOrigin(const KURL& url)
         m_canvas->setOriginTainted();
 }
 
+void CanvasRenderingContext2D::checkOrigin(const String& url)
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
+    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+        m_canvas->setOriginTainted();
+}
+
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y)
 {
     ASSERT(image);
@@ -1082,7 +1089,7 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
         return;
 
     if (m_canvas->originClean())
-        checkOrigin(video->src());
+        checkOrigin(video->currentSrc());
 
     if (m_canvas->originClean() && !video->hasSingleSecurityOrigin())
         m_canvas->setOriginTainted();
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
index 0b000a3..f6baa70 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
@@ -260,6 +260,7 @@ namespace WebCore {
         
         void prepareGradientForDashboard(CanvasGradient* gradient) const;
         void checkOrigin(const KURL&);
+        void checkOrigin(const String&);
 
         HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
index 95f425e..136c08e 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -23,39 +23,20 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SessionStorageArea_h
-#define SessionStorageArea_h
+#include "config.h"
+#include "DataGridColumn.h"
 
-#if ENABLE(DOM_STORAGE)
-
-#include "StorageArea.h"
+#include "DataGridColumnList.h"
 
 namespace WebCore {
 
-    class Page;
-    
-    class SessionStorageArea : public StorageArea {
-    public:
-        static PassRefPtr<SessionStorageArea> create(SecurityOrigin* origin, Page* page) { return adoptRef(new SessionStorageArea(origin, page)); }
-        PassRefPtr<SessionStorageArea> copy(SecurityOrigin*, Page*);
-                
-        Page* page() { return m_page; }
-
-    private:
-        SessionStorageArea(SecurityOrigin*, Page*);
-        SessionStorageArea(SecurityOrigin*, Page*, SessionStorageArea*);
-
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame);
-        virtual void areaCleared(Frame* sourceFrame);
-
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        
-        Page* m_page;
-    };
+void DataGridColumn::setPrimary(bool primary)
+{
+    if (m_primary != primary) {
+        m_primary = primary;
+        if (m_columns)
+            m_columns->primaryColumnChanged(this);
+    }
+}
 
 } // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
-#endif // SessionStorageArea_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.h b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
new file mode 100644
index 0000000..8e63cd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DataGridColumn_h
+#define DataGridColumn_h
+
+#include "AtomicString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class DataGridColumn : public RefCounted<DataGridColumn> {
+public:
+    static PassRefPtr<DataGridColumn> create(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+    {
+        return new DataGridColumn(columns, columnID, label, type, primary, sortable);
+    }
+
+    const AtomicString& id() const { return m_id; }
+    void setId(const AtomicString& id) { m_id = id; }
+
+    const AtomicString& label() const { return m_label; }
+    void setLabel(const AtomicString& label) { m_label = label; }
+    
+    const AtomicString& type() const { return m_type; }
+    void setType(const AtomicString& type) { m_type = type; }
+    
+    unsigned short sortable() const { return m_sortable; }
+    void setSortable(unsigned short sortable) { m_sortable = sortable; }
+    
+    unsigned short sortDirection() const { return m_sortDirection; }
+    void setSortDirection(unsigned short sortDirection) { m_sortDirection = sortDirection; }
+    
+    bool primary() const { return m_primary; }
+    void setPrimary(bool);
+
+    void detachFromColumnList() { m_columns = 0; }
+
+private:
+    DataGridColumn(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+        : m_columns(columns)
+        , m_id(columnID)
+        , m_label(label)
+        , m_type(type)
+        , m_primary(primary)
+        , m_sortable(sortable)
+        , m_sortDirection(0)
+    {
+    }
+
+    DataGridColumnList* m_columns; // Not refcounted.  The columns list will null out our reference when it goes away.
+
+    AtomicString m_id;
+    AtomicString m_label;
+    AtomicString m_type;
+
+    bool m_primary;
+
+    unsigned short m_sortable;
+    unsigned short m_sortDirection;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumn_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
new file mode 100644
index 0000000..04418a1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] DataGridColumn {
+        attribute DOMString id; // The identifier for the column.
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
+
+        const unsigned short NEVER_SORTED = 0;
+        const unsigned short ALWAYS_SORTED = 1;
+        const unsigned short SOMETIMES_SORTED = 2;
+        attribute unsigned short sortable; // Whether or not the column can be sorted.
+
+        const unsigned short NATURAL_SORT = 0;
+        const unsigned short SORT_ASCENDING = 1;
+        const unsigned short SORC_DESCENDING = 2;
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+    
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
new file mode 100644
index 0000000..48f7d60
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+DataGridColumnList::~DataGridColumnList()
+{
+    clear();
+}
+
+DataGridColumn* DataGridColumnList::itemWithName(const AtomicString& name) const
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_columns[i]->id() == name)
+            return m_columns[i].get();
+    }
+    return 0;
+}
+
+DataGridColumn* DataGridColumnList::add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable)
+{
+    RefPtr<DataGridColumn> column = DataGridColumn::create(this, id, label, type, primary, sortable);
+    if (primary)
+        m_primaryColumn = column;
+    m_columns.append(column);
+    return column.get();
+}
+
+void DataGridColumnList::remove(DataGridColumn* col)
+{
+    size_t index = m_columns.find(col);
+    if (index == notFound)
+        return;
+    m_columns.remove(index);
+    if (col == m_primaryColumn)
+        m_primaryColumn = 0;
+    if (col == m_sortColumn)
+        m_sortColumn = 0;
+}
+
+void DataGridColumnList::move(DataGridColumn* col, unsigned long index)
+{
+    size_t colIndex = m_columns.find(col);
+    if (colIndex == notFound)
+        return;
+    m_columns.insert(index, col);
+}
+
+void DataGridColumnList::clear()
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i)
+        m_columns[i]->detachFromColumnList();
+    m_columns.clear();
+    m_primaryColumn = 0;
+    m_sortColumn = 0;
+}
+
+void DataGridColumnList::primaryColumnChanged(DataGridColumn* col)
+{
+    if (col->primary())
+        m_primaryColumn = col;
+    else if (m_primaryColumn = col)
+        m_primaryColumn = 0;
+    
+    // FIXME: Invalidate the tree.
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
new file mode 100644
index 0000000..d0caebe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
@@ -0,0 +1,48 @@
+#ifndef DataGridColumnList_h
+#define DataGridColumnList_h
+
+#include "DataGridColumn.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicString;
+
+class DataGridColumnList : public RefCounted<DataGridColumnList> {
+    friend class DataGridColumn;
+public:
+    static PassRefPtr<DataGridColumnList> create()
+    {
+        return new DataGridColumnList();
+    }
+
+    ~DataGridColumnList();
+
+    unsigned length() const { return m_columns.size(); }
+
+    DataGridColumn* item(unsigned index) const { return m_columns[index].get(); }
+    DataGridColumn* itemWithName(const AtomicString&) const;
+
+    DataGridColumn* primaryColumn() const { return m_primaryColumn.get(); }
+
+    DataGridColumn* sortColumn() const { return m_sortColumn.get(); }
+
+    DataGridColumn* add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable);
+    void remove(DataGridColumn*);
+    void move(DataGridColumn*, unsigned long index);
+    void clear();
+
+private:
+    void primaryColumnChanged(DataGridColumn* col);
+
+    Vector<RefPtr<DataGridColumn> > m_columns;
+    RefPtr<DataGridColumn> m_primaryColumn;
+    RefPtr<DataGridColumn> m_sortColumn;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumnList_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
new file mode 100644
index 0000000..cab4339
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter,
+        HasNameGetter
+    ] DataGridColumnList {
+        DataGridColumn item(in [IsIndex] unsigned long index);
+        readonly attribute unsigned long length;
+
+        readonly attribute DataGridColumn sortColumn;
+        readonly attribute DataGridColumn primaryColumn;
+
+        DataGridColumn add(in DOMString id, in DOMString label, in DOMString type, in boolean primary, in unsigned short sortable);
+        void remove(in DataGridColumn column);
+        void move(in DataGridColumn column, in unsigned long index);
+        void clear();
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index d148998..a29d6d2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -15,10 +15,13 @@ archive
 aria-activedescendant
 aria-checked
 aria-describedby
+aria-disabled
+aria-hidden
 aria-labeledby
 aria-labelledby
 aria-level
 aria-pressed
+aria-readonly
 aria-valuemax
 aria-valuemin
 aria-valuenow
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
index 64a9d10..d06ad82 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
@@ -88,5 +88,4 @@ void HTMLDataGridCellElement::setProgress(float progress)
     setAttribute(progressAttr, String::number(progress));
 }
 
-}
-
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
index b17634b..9de6e40 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridCellElement : public HTMLElement
-{
+class HTMLDataGridCellElement : public HTMLElement {
 public:
     HTMLDataGridCellElement(const QualifiedName&, Document*);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
index 32d820c..4d15f6f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
@@ -25,15 +25,17 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridCellElement : HTMLElement {
-    attribute DOMString label; // The text to display in the column, assuming the type supports text.
-    
-    attribute boolean focused; // Whether or not this cell is currently focused.
-    
-    attribute boolean checked; // The checked state of the column, assuming the type of the column is checkbox.
-    attribute boolean indeterminate; // If the checked state is indeterminate.
-    
-    attribute float progress; // For progress cells, a value from 0-1.0 indicating the state of progress.
-};
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridCellElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column, assuming the type supports text.
+
+        attribute boolean focused; // Whether or not this cell is currently focused.
+
+        attribute boolean checked; // The checked state of the column, assuming the type of the column is checkbox.
+        attribute boolean indeterminate; // If the checked state is indeterminate.
+
+        attribute float progress; // For progress cells, a value from 0-1.0 indicating the state of progress.
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
index b5c8714..b209447 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
@@ -58,24 +58,35 @@ void HTMLDataGridColElement::setType(const String& type)
     setAttribute(typeAttr, type);
 }
 
-bool HTMLDataGridColElement::sortable() const
+unsigned short HTMLDataGridColElement::sortable() const
 {
     return hasAttribute(sortableAttr);
 }
 
-void HTMLDataGridColElement::setSortable(bool sortable)
+void HTMLDataGridColElement::setSortable(unsigned short sortable)
 {
     setAttribute(sortableAttr, sortable ? "" : 0);
 }
 
-String HTMLDataGridColElement::sortDirection() const
+unsigned short HTMLDataGridColElement::sortDirection() const
 {
-    return getAttribute(sortdirectionAttr);
+    String sortDirection = getAttribute(sortdirectionAttr);
+    if (equalIgnoringCase(sortDirection, "ascending"))
+        return 1;
+    if (equalIgnoringCase(sortDirection, "descending"))
+        return 2;
+    return 0;
 }
 
-void HTMLDataGridColElement::setSortDirection(const String& sortDirection)
+void HTMLDataGridColElement::setSortDirection(unsigned short sortDirection)
 {
-    setAttribute(sortdirectionAttr, sortDirection);
+    // FIXME: Check sortable rules.
+    if (sortDirection == 0)
+        setAttribute(sortdirectionAttr, "natural");
+    else if (sortDirection == 1)
+        setAttribute(sortdirectionAttr, "ascending");
+    else if (sortDirection == 2)
+        setAttribute(sortdirectionAttr, "descending");
 }
 
 bool HTMLDataGridColElement::primary() const
@@ -88,5 +99,4 @@ void HTMLDataGridColElement::setPrimary(bool primary)
     setAttribute(primaryAttr, primary ? "" : 0);
 }
 
-}
-
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
index 6d599b1..87133cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridColElement : public HTMLElement
-{
+class HTMLDataGridColElement : public HTMLElement {
 public:
     HTMLDataGridColElement(const QualifiedName&, Document*);
 
@@ -44,16 +43,16 @@ public:
     String type() const;
     void setType(const String&);
     
-    bool sortable() const;
-    void setSortable(bool);
+    unsigned short sortable() const;
+    void setSortable(unsigned short);
     
-    String sortDirection() const;
-    void setSortDirection(const String&);
+    unsigned short sortDirection() const;
+    void setSortDirection(unsigned short);
     
     bool primary() const;
     void setPrimary(bool);
 };
 
-} //namespace
+} // namespace WebCore
 
-#endif
+#endif // HTMLDataGridColElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
index 59c3be0..c72751c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
@@ -25,14 +25,16 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridColElement : HTMLElement {
-    attribute DOMString label; // The text to display in the column.
-    attribute DOMString type; // The type of data displayed in this column.
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridColElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
 
-    attribute boolean sortable; // Whether or not the column can be sorted.
-    attribute DOMString sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+        attribute unsigned short sortable; // Whether or not the column can be sorted.  Values are none, ascending/descending, and ascending/descending/na
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
     
-    attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
-};
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
index a9e2f3d..2d9f852 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
@@ -38,6 +38,7 @@ HTMLDataGridElement::HTMLDataGridElement(const QualifiedName& tagName, Document*
     : HTMLElement(tagName, document)
     , m_initializationTimer(this, &HTMLDataGridElement::initializationTimerFired)
 {
+    m_columns = DataGridColumnList::create();
 }
 
 HTMLDataGridElement::~HTMLDataGridElement()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
index 2dad4d0..646c97e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
@@ -26,6 +26,7 @@
 #ifndef HTMLDataGridElement_h
 #define HTMLDataGridElement_h
 
+#include "DataGridColumnList.h"
 #include "DataGridDataSource.h"
 #include "HTMLElement.h"
 #include "Timer.h"
@@ -39,26 +40,30 @@ public:
 
     virtual int tagPriority() const { return 6; } // Same as <select>s
     virtual bool checkDTD(const Node*);
-    
+
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     bool autofocus() const;
     void setAutofocus(bool);
-    
+
     bool disabled() const;
     void setDisabled(bool);
-    
+
     bool multiple() const;
     void setMultiple(bool);
 
     void setDataSource(PassRefPtr<DataGridDataSource>);
     DataGridDataSource* dataSource() const { return m_dataSource.get(); }
 
+    DataGridColumnList* columns() const { return m_columns.get(); }
+
 private:
     void initializationTimerFired(Timer<HTMLDataGridElement>*);
 
     Timer<HTMLDataGridElement> m_initializationTimer;
     RefPtr<DataGridDataSource> m_dataSource;
+
+    RefPtr<DataGridColumnList> m_columns;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
index f777a9c..b4b0897 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
@@ -30,6 +30,8 @@ module html {
     ] HTMLDataGridElement : HTMLElement {
         attribute [Custom] DataGridDataSource dataSource;
 
+        readonly attribute DataGridColumnList columns;
+
         attribute boolean autofocus; // Whether or not the datagrid should autofocus.
         attribute boolean disabled; // Whether or not the datagrid can be interacted with.
         attribute boolean multiple; // Whether or not the datagrid supports multiple selection.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
index 87fb31d..e671806 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
@@ -75,4 +75,4 @@ void HTMLDataGridRowElement::setExpanded(bool expanded)
     setAttribute(expandedAttr, expanded ? "" : 0);
 }
 
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
index 9774baa..d911db2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLDataGridRowElement : public HTMLElement
-{
+class HTMLDataGridRowElement : public HTMLElement {
 public:
     HTMLDataGridRowElement(const QualifiedName&, Document*);
 
@@ -51,4 +50,3 @@ public:
 } // namespace WebCore
 
 #endif // HTMLDataGridRowElement_h
-
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
index 825bec6..4aeb4d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
@@ -25,11 +25,13 @@
 
 module html {
 
-interface [GenerateConstructor] HTMLDataGridRowElement : HTMLElement {
-    attribute boolean selected; // Whether or not the row is currently selected.
-    attribute boolean focused; // Whether or not the row is the current object in the tree for keyboard navigation (or as the principal item of a multiple selection).
-    
-    attribute boolean expanded; // Whether or not the row is open (if it is, child rows will be shown).
-};
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridRowElement : HTMLElement {
+        attribute boolean selected; // Whether or not the row is currently selected.
+        attribute boolean focused; // Whether or not the row is the current object in the tree for keyboard navigation (or as the principal item of a multiple selection).
+        
+        attribute boolean expanded; // Whether or not the row is open (if it is, child rows will be shown).
+    };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 76a9703..cb8f36c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -225,11 +225,11 @@ void HTMLLinkElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
 
+    document()->removeStyleSheetCandidateNode(this);
+
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
-    if (document()->renderer()) {
-        document()->removeStyleSheetCandidateNode(this);
+    if (document()->renderer())
         document()->updateStyleSelector();
-    }
 }
 
 void HTMLLinkElement::finishParsingChildren()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index 9789a82..3d48b82 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -1610,8 +1610,7 @@ bool HTMLMediaElement::processingUserGesture() const
 void HTMLMediaElement::deliverNotification(MediaPlayerProxyNotificationType notification)
 {
     if (notification == MediaPlayerNotificationPlayPauseButtonPressed) {
-        ExceptionCode ec;
-        togglePlayState(ec);
+        togglePlayState();
         return;
     }
 
@@ -1630,7 +1629,7 @@ String HTMLMediaElement::initialURL()
     KURL initialSrc = document()->completeURL(getAttribute(srcAttr));
     
     if (!initialSrc.isValid())
-        initialSrc = selectNextSourceChild(0, DoNothing).string();
+        initialSrc = selectNextSourceChild(0, DoNothing);
 
     m_currentSrc = initialSrc.string();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index f85700c..8d238d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -65,7 +65,9 @@ public:
     
     virtual bool isVideo() const { return false; }
     virtual bool hasVideo() const { return false; }
-    
+
+    virtual bool supportsFullscreen() const { return false; }
+
     void scheduleLoad();
     
     virtual void defaultEventHandler(Event*);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
index 95038e6..c47bb70 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
@@ -80,9 +80,14 @@ void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
     SelectElement::deselectItems(m_data, this, excludeElement);
 }
 
-void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect, bool fireOnChange)
+void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect)
 {
-    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChange);
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, false, false);
+}
+
+void HTMLSelectElement::setSelectedIndexByUser(int optionIndex, bool deselect, bool fireOnChangeNow)
+{
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChangeNow, true);
 }
 
 int HTMLSelectElement::activeSelectionStartListIndex() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
index b00d68f..e523641 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
@@ -39,7 +39,8 @@ public:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual int selectedIndex() const;
-    virtual void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
+    virtual void setSelectedIndex(int index, bool deselect = true);
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false);
 
     unsigned length() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
index f6b5924..206aec4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
@@ -71,8 +71,7 @@ void HTMLStyleElement::insertedIntoDocument()
 void HTMLStyleElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
     StyleElement::removedFromDocument(document());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 0fd503c..6966351 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -437,14 +437,11 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
                 if (!m_doc->ownerElement())
                     printf("Requesting script at time %d\n", m_doc->elapsedTime());
 #endif
-                if (m_XSSAuditor && m_XSSAuditor->canLoadExternalScriptFromSrc(m_scriptTagSrcAttrValue)) {
-                    // The parser might have been stopped by for example a window.close call in an earlier script.
-                    // If so, we don't want to load scripts.
-                    if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
-                        m_pendingScripts.append(cs);
-                    else
-                        m_scriptNode = 0;
-                } else
+                // The parser might have been stopped by for example a window.close call in an earlier script.
+                // If so, we don't want to load scripts.
+                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                    m_pendingScripts.append(cs);
+                else
                     m_scriptNode = 0;
             } else
                 m_scriptNode = 0;
@@ -1476,8 +1473,11 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                 m_scriptTagCharsetAttrValue = String();
                 if (m_currentToken.attrs && !m_fragment) {
                     if (m_doc->frame() && m_doc->frame()->script()->isEnabled()) {
-                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr)))
+                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr))) {
                             m_scriptTagSrcAttrValue = m_doc->completeURL(parseURL(a->value())).string();
+                            if (m_XSSAuditor && !m_XSSAuditor->canLoadExternalScriptFromSrc(a->value()))
+                                m_scriptTagSrcAttrValue = String();
+                        }
                     }
                 }
             }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index 5b59edb..830e72e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -50,6 +50,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
+    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index d4d6df7..13404cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -56,9 +56,16 @@ HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeT
 
 Tokenizer* HTMLViewSourceDocument::createTokenizer()
 {
-    if (implementation()->isTextMIMEType(m_type))
-        return createTextTokenizer(this);
-    return new HTMLTokenizer(this);
+    // Use HTMLTokenizer if applicable, otherwise use TextTokenizer.
+    if (m_type == "text/html" || m_type == "application/xhtml+xml" || m_type == "image/svg+xml" || implementation()->isXMLMIMEType(m_type)
+#if ENABLE(XHTMLMP)
+        || m_type == "application/vnd.wap.xhtml+xml"
+#endif
+        ) {
+        return new HTMLTokenizer(this);
+    }
+
+    return createTextTokenizer(this);
 }
 
 void HTMLViewSourceDocument::createContainingTable()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
index 4e725c7..57a8f21 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
@@ -38,9 +38,10 @@ public:
     {
         return new HTMLViewSourceDocument(frame, mimeType);
     }
-    
+
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
     virtual Tokenizer* createTokenizer();
-    
+
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 7617020..7e0cf31 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -729,6 +729,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_counts.clear();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         m_profiles.clear();
+        m_currentUserInitiatedProfileNumber = 1;
+        m_nextUserInitiatedProfileNumber = 1;
 #endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
@@ -1116,6 +1118,18 @@ void InspectorController::addScriptProfile(Profile* profile)
     m_frontend->addProfile(toJS(m_scriptState, profile));
 }
 
+UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
+{
+    if (incrementProfileNumber)
+        m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;        
+
+    UString title = UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+    
+    return title;
+}
+
 void InspectorController::startUserInitiatedProfilingSoon()
 {
     m_startProfiling.startOneShot(0);
@@ -1132,11 +1146,8 @@ void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>
     }
 
     m_recordingUserInitiatedProfile = true;
-    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
 
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
+    UString title = getCurrentUserInitiatedProfileName(true);
 
     ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
     Profiler::profiler()->startProfiling(scriptState, title);
@@ -1153,9 +1164,7 @@ void InspectorController::stopUserInitiatedProfiling()
 
     m_recordingUserInitiatedProfile = false;
 
-    UString title =  UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
+    UString title = getCurrentUserInitiatedProfileName();
 
     ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
     RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 0cb2093..8ba8669 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -249,6 +249,7 @@ public:
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
+    JSC::UString getCurrentUserInitiatedProfileName(bool incrementProfileNumber);
     void startUserInitiatedProfilingSoon();
     void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
     void stopUserInitiatedProfiling();
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index f85b731..429c2c3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -157,7 +157,7 @@ WebInspector.DatabaseQueryView.prototype = {
         else if (error.code == 2)
             var message = WebInspector.UIString("Database no longer has expected version.");
         else
-            var message = WebInspector.UIString("An unexpected error %s occured.", error.code);
+            var message = WebInspector.UIString("An unexpected error %s occurred.", error.code);
 
         this._appendQueryResult(query, message, "error");
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index d00733c..bc78fc8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -166,8 +166,8 @@ WebInspector.ProfileView.prototype = {
         for (var index = 0; index < count; ++index)
             this.dataGrid.appendChild(children[index]);
 
-        if (selectedProfileNode && selectedProfileNode._dataGridNode)
-            selectedProfileNode._dataGridNode.selected = true;
+        if (selectedProfileNode)
+            selectedProfileNode.selected = true;
     },
 
     refreshVisibleData: function()
@@ -196,8 +196,7 @@ WebInspector.ProfileView.prototype = {
                 delete profileNode._searchMatchedCallsColumn;
                 delete profileNode._searchMatchedFunctionColumn;
 
-                if (profileNode._dataGridNode)
-                    profileNode._dataGridNode.refresh();
+                profileNode.refresh();
             }
         }
 
@@ -313,7 +312,7 @@ WebInspector.ProfileView.prototype = {
                 profileDataGridNode._searchMatchedTotalColumn ||
                 profileDataGridNode._searchMatchedAverageColumn ||
                 profileDataGridNode._searchMatchedCallsColumn ||
-                profileDataGridNode._searchMatchedFunctionColumn);
+                profileDataGridNode._searchMatchedFunctionColumn)
             {
                 profileDataGridNode.refresh();
                 return true;
@@ -322,48 +321,14 @@ WebInspector.ProfileView.prototype = {
             return false;
         }
 
-        var current = this.dataGrid;
-        var ancestors = [];
-        var nextIndexes = [];
-        var startIndex = 0;
+        var current = this.profileDataGridTree.children[0];
 
         while (current) {
-            var children = current.children;
-            var childrenLength = children.length;
-
-            if (startIndex >= childrenLength) {
-                current = ancestors.pop();
-                startIndex = nextIndexes.pop();
-                continue;
+            if (matchesQuery(current)) {
+                this._searchResults.push({ profileNode: current });
             }
 
-            for (var i = startIndex; i < childrenLength; ++i) {
-                var child = children[i];
-
-                if (matchesQuery(child)) {
-                    if (child._dataGridNode) {
-                        // The child has a data grid node already, no need to remember the ancestors.
-                        this._searchResults.push({ profileNode: child });
-                    } else {
-                        var ancestorsCopy = [].concat(ancestors);
-                        ancestorsCopy.push(current);
-                        this._searchResults.push({ profileNode: child, ancestors: ancestorsCopy });
-                    }
-                }
-
-                if (child.children.length) {
-                    ancestors.push(current);
-                    nextIndexes.push(i + 1);
-                    current = child;
-                    startIndex = 0;
-                    break;
-                }
-
-                if (i === (childrenLength - 1)) {
-                    current = ancestors.pop();
-                    startIndex = nextIndexes.pop();
-                }
-            }
+            current = current.traverseNextNode(false, null, false);
         }
 
         finishedCallback(this, this._searchResults.length);
@@ -419,26 +384,9 @@ WebInspector.ProfileView.prototype = {
         if (!searchResult)
             return;
 
-        var profileNode = this._searchResults[index].profileNode;
-        if (!profileNode._dataGridNode && searchResult.ancestors) {
-            var ancestors = searchResult.ancestors;
-            for (var i = 0; i < ancestors.length; ++i) {
-                var ancestorProfileNode = ancestors[i];
-                var gridNode = ancestorProfileNode._dataGridNode;
-                if (gridNode)
-                    gridNode.expand();
-            }
-
-            // No need to keep the ancestors around.
-            delete searchResult.ancestors;
-        }
-
-        gridNode = profileNode._dataGridNode;
-        if (!gridNode)
-            return;
-
-        gridNode.reveal();
-        gridNode.select();
+        var profileNode = searchResult.profileNode;
+        profileNode.reveal();
+        profileNode.select();
     },
 
     _changeView: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
index 46502a6..e6413a9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
@@ -31,6 +31,19 @@ WebInspector.Script = function(sourceID, sourceURL, source, startingLine, errorL
     this.startingLine = startingLine;
     this.errorLine = errorLine;
     this.errorMessage = errorMessage;
+
+    // if no URL, look for "//@ sourceURL=" decorator
+    // note that this sourceURL comment decorator is behavior that FireBug added
+    // in it's 1.1 release as noted in the release notes:
+    // http://fbug.googlecode.com/svn/branches/firebug1.1/docs/ReleaseNotes_1.1.txt
+    if (!sourceURL) {
+        // use of [ \t] rather than \s is to prevent \n from matching
+        var pattern = /^\s*\/\/[ \t]*@[ \t]*sourceURL[ \t]*=[ \t]*(\S+).*$/m;
+        var match = pattern.exec(source);
+
+        if (match)
+            this.sourceURL = WebInspector.UIString("(program): %s", match[1]);
+    }
 }
 
 WebInspector.Script.prototype = {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index c58cf64..30772f7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -165,7 +165,7 @@ WebInspector.TextPrompt.prototype = {
         fullWordRange.setStart(wordPrefixRange.startContainer, wordPrefixRange.startOffset);
         fullWordRange.setEnd(selectionRange.endContainer, selectionRange.endOffset);
 
-        if (originalWordPrefixRange.toString() != fullWordRange.toString())
+        if (originalWordPrefixRange.toString() + selectionRange.toString() != fullWordRange.toString())
             return;
 
         if (completions.length === 1 || selection.isCollapsed || auto) {
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 81ebf1f..2abd54f 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -283,6 +283,11 @@ public:
 
     virtual void registerForIconNotification(bool) { }
 
+#if USE(V8)
+    virtual void didCreateScriptContext() { }
+    virtual void didDestroyScriptContext() { }
+#endif
+
 #if PLATFORM(MAC)
     virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long, NSCachedURLResponse* response) const { return response; }
 #endif
@@ -408,6 +413,7 @@ public:
     virtual void copyImageToClipboard(const HitTestResult&) { }
     virtual void searchWithGoogle(const Frame*) { }
     virtual void lookUpInDictionary(Frame*) { }
+    virtual bool isSpeaking() { return false; }
     virtual void speak(const String&) { }
     virtual void stopSpeaking() { }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index b862002..8c050f0 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -211,7 +211,12 @@ namespace WebCore {
         virtual void windowObjectCleared() = 0;
         virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
-        
+
+#if USE(V8)
+        virtual void didCreateScriptContext() = 0;
+        virtual void didDestroyScriptContext() = 0;
+#endif
+
         virtual void registerForIconNotification(bool listen = true) = 0;
         
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 6ba8f7b..642ec61 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -451,6 +451,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
             m_currentHandle->cancel();
             m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
             // Load the next resource, if any.
             startLoadingEntry();
             return;
@@ -478,6 +479,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
             m_currentHandle->cancel();
             m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
             // Load the next resource, if any.
             startLoadingEntry();
         }
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 86de82e..2170723 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -46,7 +46,7 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(DOM_STORAGE)
-#include "SessionStorage.h"
+#include "StorageNamespace.h"
 #endif
 
 namespace WebCore {
@@ -147,8 +147,8 @@ Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const
 
 #if ENABLE(DOM_STORAGE)
     if (newPage) {
-        if (SessionStorage* oldSessionStorage = m_page->sessionStorage(false))
-            newPage->setSessionStorage(oldSessionStorage->copy(newPage));
+        if (StorageNamespace* oldSessionStorage = m_page->sessionStorage(false))
+            newPage->setSessionStorage(oldSessionStorage->copy());
     }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 1384236..1a654ab 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -277,19 +277,19 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    // FIXME: log a console message when profiling is disabled.
-    if (!page->inspectorController()->profilerEnabled())
+    InspectorController* controller = page->inspectorController();
+    // FIXME: log a console message when profiling is disabled. 
+    if (!controller->profilerEnabled())
         return;
 
-    if (title.isNull()) {   // no title so give it the next user initiated profile title.
-        page->inspectorController()->startUserInitiatedProfiling(0);
-        return;
-    }
+    JSC::UString resolvedTitle = title;
+    if (title.isNull())   // no title so give it the next user initiated profile title.
+        resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
 
-    JSC::Profiler::profiler()->startProfiling(callStack->state(), title);
+    JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
-    page->inspectorController()->addStartProfilingMessageToConsole(title, lastCaller.lineNumber(), lastCaller.sourceURL());
+    controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -298,7 +298,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    if (!page->inspectorController()->profilerEnabled())
+    if (!this->page())
+        return;
+
+    InspectorController* controller = page->inspectorController();
+    if (!controller->profilerEnabled())
         return;
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
@@ -307,10 +311,8 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
-    if (Page* page = this->page()) {
-        const ScriptCallFrame& lastCaller = callStack->at(0);
-        page->inspectorController()->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
-    }
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
index 775adc5..1997cd0 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
@@ -47,6 +47,7 @@ namespace WebCore {
         virtual void downloadURL(const KURL& url) = 0;
         virtual void searchWithGoogle(const Frame*) = 0;
         virtual void lookUpInDictionary(Frame*) = 0;
+        virtual bool isSpeaking() = 0;
         virtual void speak(const String&) = 0;
         virtual void stopSpeaking() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 9c3bfce..eb1981c 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -70,10 +70,9 @@
 #endif
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "SessionStorage.h"
 #include "Storage.h"
 #include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -578,7 +577,7 @@ Storage* DOMWindow::localStorage() const
     if (!settings || !settings->localStorageEnabled())
         return 0;
 
-    LocalStorage* localStorage = page->group().localStorage();
+    StorageNamespace* localStorage = page->group().localStorage();
     RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
     if (storageArea) {
         page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index 6862cdc..eac936f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -61,7 +61,6 @@ namespace WebCore {
     class WebKitPoint;
 
 #if ENABLE(DOM_STORAGE)
-    class SessionStorage;
     class Storage;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index e412939..8f0b420 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -354,6 +354,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     m_mouseDownWasSingleClickInSelection = false;
 
+    m_mouseDown = event.event();
+
     if (event.isOverWidget() && passWidgetMouseDownEventToWidget(event))
         return true;
 
@@ -735,7 +737,7 @@ void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
     
-HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping)
+HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
     HitTestResult result(point);
     if (!m_frame->contentRenderer())
@@ -762,6 +764,12 @@ HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool all
         HitTestResult widgetHitTestResult(widgetPoint);
         frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), widgetHitTestResult);
         result = widgetHitTestResult;
+
+        if (testScrollbars == ShouldHitTestScrollbars) {
+            Scrollbar* eventScrollbar = view->scrollbarUnderPoint(point);
+            if (eventScrollbar)
+                result.setScrollbar(eventScrollbar);
+        }
     }
     
     // If our HitTestResult is not visible, then we started hit testing too far down the frame chain. 
@@ -856,6 +864,21 @@ bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity g
     return false;
 }
 
+bool EventHandler::scrollRecursively(ScrollDirection direction, ScrollGranularity granularity)
+{
+    bool handled = scrollOverflow(direction, granularity);
+    if (!handled) {
+        Frame* frame = m_frame;
+        do {
+            FrameView* view = frame->view();
+            handled = view ? view->scroll(direction, granularity) : false;
+            frame = frame->tree()->parent();
+        } while (!handled && frame);
+     }
+
+    return handled;
+}
+
 IntPoint EventHandler::currentMousePosition() const
 {
     return m_currentMousePosition;
@@ -1182,7 +1205,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         }
 
         FrameView* view = m_frame->view();
-        Scrollbar* scrollbar = view ? view->scrollbarUnderMouse(mouseEvent) : 0;
+        Scrollbar* scrollbar = view ? view->scrollbarUnderPoint(mouseEvent.pos()) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1296,7 +1319,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
         if (FrameView* view = m_frame->view())
-            scrollbar = view->scrollbarUnderMouse(mouseEvent);
+            scrollbar = view->scrollbarUnderPoint(mouseEvent.pos());
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 06ed956..f76716e 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -67,6 +67,8 @@ extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
 
+enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
+
 class EventHandler : Noncopyable {
 public:
     EventHandler(Frame*);
@@ -86,7 +88,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
-    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false);
+    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false, HitTestScrollbars scrollbars = DontHitTestScrollbars);
 
     bool mousePressed() const { return m_mousePressed; }
     void setMousePressed(bool pressed) { m_mousePressed = pressed; }
@@ -109,6 +111,8 @@ public:
 
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
+    bool scrollRecursively(ScrollDirection, ScrollGranularity);
+
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
 
     bool tabsToLinks(KeyboardEvent*) const;
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 9ce3c82..41f2c5c 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -420,6 +420,11 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
 void FrameView::updateCompositingLayers(CompositingUpdate updateType)
 {
     RenderView* view = m_frame->contentRenderer();
+    if (view && view->compositor()) {
+        // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
+        view->compositor()->cacheAcceleratedCompositingEnabledFlag();
+    }
+    
     if (!view || !view->usesCompositing())
         return;
 
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index a49ee4a..6494707 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -58,9 +58,8 @@
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "SessionStorage.h"
 #include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -550,17 +549,16 @@ void Page::setDebugger(JSC::Debugger* debugger)
 }
 
 #if ENABLE(DOM_STORAGE)
-SessionStorage* Page::sessionStorage(bool optionalCreate)
+StorageNamespace* Page::sessionStorage(bool optionalCreate)
 {
     if (!m_sessionStorage && optionalCreate)
-        m_sessionStorage = SessionStorage::create(this);
+        m_sessionStorage = StorageNamespace::sessionStorageNamespace();
 
     return m_sessionStorage.get();
 }
 
-void Page::setSessionStorage(PassRefPtr<SessionStorage> newStorage)
+void Page::setSessionStorage(PassRefPtr<StorageNamespace> newStorage)
 {
-    ASSERT(newStorage->page() == this);
     m_sessionStorage = newStorage;
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index 32adcac..b5d6f4b 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -63,10 +63,10 @@ namespace WebCore {
     class RenderTheme;
     class VisibleSelection;
     class SelectionController;
+    class Settings;
 #if ENABLE(DOM_STORAGE)
-    class SessionStorage;
+    class StorageNamespace;
 #endif
-    class Settings;
 #if ENABLE(WML)
     class WMLPageState;
 #endif
@@ -179,8 +179,8 @@ namespace WebCore {
         static void visitedStateChanged(PageGroup*, LinkHash visitedHash);
 
 #if ENABLE(DOM_STORAGE)
-        SessionStorage* sessionStorage(bool optionalCreate = true);
-        void setSessionStorage(PassRefPtr<SessionStorage>);
+        StorageNamespace* sessionStorage(bool optionalCreate = true);
+        void setSessionStorage(PassRefPtr<StorageNamespace>);
 #endif
 
 #if ENABLE(WML)
@@ -253,7 +253,7 @@ namespace WebCore {
         int m_customHTMLTokenizerChunkSize;
 
 #if ENABLE(DOM_STORAGE)
-        RefPtr<SessionStorage> m_sessionStorage;
+        RefPtr<StorageNamespace> m_sessionStorage;
 #endif
 
 #if PLATFORM(WIN) || (PLATFORM(WX) && defined(__WXMSW__)) || (PLATFORM(QT) && defined(Q_WS_WIN))
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index f098211..5155be1 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -32,8 +32,7 @@
 #include "Settings.h"
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if PLATFORM(CHROMIUM)
@@ -181,13 +180,13 @@ void PageGroup::setShouldTrackVisitedLinks(bool shouldTrack)
 }
 
 #if ENABLE(DOM_STORAGE)
-LocalStorage* PageGroup::localStorage()
+StorageNamespace* PageGroup::localStorage()
 {
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
         ASSERT(page);
-        m_localStorage = LocalStorage::localStorage(page->settings()->localStorageDatabasePath());
+        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
     }
 
     return m_localStorage.get();
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index 4da2251..cbde1c3 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -34,8 +34,8 @@
 namespace WebCore {
 
     class KURL;
-    class LocalStorage;
     class Page;
+    class StorageNamespace;
 
     class PageGroup : Noncopyable {
     public:
@@ -63,7 +63,7 @@ namespace WebCore {
         unsigned identifier() { return m_identifier; }
 
 #if ENABLE(DOM_STORAGE)
-        LocalStorage* localStorage();
+        StorageNamespace* localStorage();
 #endif
 
     private:
@@ -80,7 +80,7 @@ namespace WebCore {
 
         unsigned m_identifier;
 #if ENABLE(DOM_STORAGE)
-        RefPtr<LocalStorage> m_localStorage;
+        RefPtr<StorageNamespace> m_localStorage;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 3a00b8e..7a15163 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -28,6 +28,7 @@
 
 #include "Frame.h"
 #include "FrameTree.h"
+#include "FrameView.h"
 #include "HistoryItem.h"
 #include "Page.h"
 #include "PageCache.h"
@@ -104,6 +105,7 @@ Settings::Settings(Page* page)
     // they can't use by. Leaving enabled for now to not change existing behavior.
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
+    , m_acceleratedCompositingEnabled(true)
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -464,4 +466,13 @@ void Settings::setXSSAuditorEnabled(bool xssAuditorEnabled)
     m_xssAuditorEnabled = xssAuditorEnabled;
 }
 
+void Settings::setAcceleratedCompositingEnabled(bool enabled)
+{
+    if (m_acceleratedCompositingEnabled == enabled)
+        return;
+        
+    m_acceleratedCompositingEnabled = enabled;
+    setNeedsReapplyStylesInAllFrames(m_page);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 9d4e422..4b9b40a 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -241,6 +241,9 @@ namespace WebCore {
         void setXSSAuditorEnabled(bool);
         bool xssAuditorEnabled() const { return m_xssAuditorEnabled; }
 
+        void setAcceleratedCompositingEnabled(bool);
+        bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
+
     private:
         Page* m_page;
         
@@ -301,6 +304,7 @@ namespace WebCore {
         unsigned m_editingBehavior : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
+        bool m_acceleratedCompositingEnabled : 1;
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 19c6e4e..f8a2f40 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -35,18 +35,15 @@
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "KURL.h"
+#include "ResourceResponseBase.h"
 #include "ScriptSourceCode.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 
+using namespace WTF;
+
 namespace WebCore {
-  
-// This method also appears in file ResourceResponseBase.cpp.
-static bool isControlCharacter(UChar c)
-{
-    return c < ' ' || c == 127;
-}
-  
+
 XSSAuditor::XSSAuditor(Frame* frame)
     : m_frame(frame)
 {
@@ -55,18 +52,18 @@ XSSAuditor::XSSAuditor(Frame* frame)
 XSSAuditor::~XSSAuditor()
 {
 }
-    
+
 bool XSSAuditor::isEnabled() const
 {
     Settings* settings = m_frame->settings();
     return (settings && settings->xssAuditorEnabled());
 }
-  
+
 bool XSSAuditor::canEvaluate(const String& sourceCode) const
 {
     if (!isEnabled())
         return true;
-    
+
     if (findInRequest(sourceCode)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
@@ -79,7 +76,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
 {
     if (!isEnabled())
         return true;
-    
+
     return canEvaluate(code);
 }
 
@@ -87,7 +84,7 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& url) const
 {
     if (!isEnabled())
         return true;
-  
+
     if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
@@ -103,27 +100,43 @@ bool XSSAuditor::canLoadObject(const String& url) const
 
     if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
-        m_frame->domWindow()->console()->addMessage(OtherMessageSource, ErrorMessageLevel, consoleMessage, 1, String());    
+        m_frame->domWindow()->console()->addMessage(OtherMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
     return true;
 }
 
-String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowNullCharacters)
+String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowControlCharacters)
 {
     String result;
     String url = str;
-    
+
     url.replace('+', ' ');
-    result = decodeURLEscapeSequences(url, encoding);
-    return allowNullCharacters ? result : result.removeCharacters(&isControlCharacter);
+    result = decodeURLEscapeSequences(url);
+    if (!allowControlCharacters)
+        result.removeCharacters(&isControlCharacter);
+    result = encoding.decode(result.utf8().data(), result.length());
+    if (!allowControlCharacters)
+        result.removeCharacters(&isControlCharacter);
+    return result;
 }
 
 bool XSSAuditor::findInRequest(const String& string) const
 {
-    ASSERT(m_frame->document());
-    String pageURL = m_frame->document()->url().string();
-    
+    bool result = false;
+    Frame* parentFrame = m_frame->tree()->parent();
+    if (parentFrame && m_frame->document()->url() == blankURL())
+        result = findInRequest(parentFrame, string);
+    if (!result)
+        result = findInRequest(m_frame, string);
+    return result;
+}
+
+bool XSSAuditor::findInRequest(Frame* frame, const String& string) const
+{
+    ASSERT(frame->document());
+    String pageURL = frame->document()->url().string();
+
     if (protocolIs(pageURL, "data"))
         return false;
 
@@ -132,12 +145,12 @@ bool XSSAuditor::findInRequest(const String& string) const
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = decodeURL(pageURL, m_frame->document()->decoder()->encoding());
+        String decodedPageURL = decodeURL(pageURL, frame->document()->decoder()->encoding());
         if (decodedPageURL.find(string, 0, false) != -1)
            return true;  // We've found the smoking gun.
     }
-    
-    FormData* formDataObj = m_frame->loader()->documentLoader()->originalRequest().httpBody();
+
+    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
     if (formDataObj && !formDataObj->isEmpty()) {
         String formData = formDataObj->flattenToString();
         if (string.length() < formData.length()) {
@@ -145,7 +158,7 @@ bool XSSAuditor::findInRequest(const String& string) const
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = decodeURL(formData, m_frame->document()->decoder()->encoding());
+            String decodedFormData = decodeURL(formData, frame->document()->decoder()->encoding());
             if (decodedFormData.find(string, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index e2b6140..7974d1c 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef XSSAuditor_h
@@ -62,7 +62,7 @@ namespace WebCore {
     // * ScriptController::evaluate - used to evaluate JavaScript scripts.
     // * ScriptController::createInlineEventListener - used to create JavaScript event handlers.
     // * HTMLTokenizer::scriptHandler - used to load external JavaScript scripts.
-    // 
+    //
     class XSSAuditor {
     public:
         XSSAuditor(Frame*);
@@ -82,17 +82,19 @@ namespace WebCore {
         // content of any user-submitted data.
         bool canLoadExternalScriptFromSrc(const String& url) const;
 
-        // Determines whether object should be loaded based on the content of 
+        // Determines whether object should be loaded based on the content of
         // any user-submitted data.
         //
         // This method is called by FrameLoader::requestObject.
         bool canLoadObject(const String& url) const;
 
     private:
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowNullCharacters = false);
+        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowControlCharacters = false);
 
         bool findInRequest(const String&) const;
 
+        bool findInRequest(Frame*, const String&) const;
+
         // The frame to audit.
         Frame* m_frame;
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index 362e334..1c8ec20 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -28,6 +28,7 @@
 #include "ContextMenu.h"
 
 #include "ContextMenuController.h"
+#include "ContextMenuClient.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -345,6 +346,12 @@ void ContextMenu::populate()
 #endif
                 }
                 appendItem(CopyItem);
+#if PLATFORM(MAC)
+                appendItem(*separatorItem());
+                ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
+                createAndAppendSpeechSubMenu(m_hitTestResult, SpeechMenuItem);
+                appendItem(SpeechMenuItem);
+#endif                
             } else {
 #if PLATFORM(GTK)
                 appendItem(BackItem);
@@ -481,8 +488,7 @@ void ContextMenu::populate()
             createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
             appendItem(FontMenuItem);
 #if PLATFORM(MAC)
-            ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, 
-                contextMenuItemTagSpeechMenu());
+            ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
             createAndAppendSpeechSubMenu(m_hitTestResult, SpeechMenuItem);
             appendItem(SpeechMenuItem);
 #endif
@@ -702,7 +708,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
             shouldCheck = frame->editor()->isAutomaticTextReplacementEnabled();
 #endif
             break;
-#endif
+        case ContextMenuItemTagStopSpeaking:
+            shouldEnable = controller() && controller()->client() && controller()->client()->isSpeaking();
+            break;
+#endif // PLATFORM(MAC)
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
             shouldEnable = frame->loader()->canGoBackOrForward(-1);
@@ -756,7 +765,6 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagShowColors:
         case ContextMenuItemTagSpeechMenu:
         case ContextMenuItemTagStartSpeaking:
-        case ContextMenuItemTagStopSpeaking:
         case ContextMenuItemTagWritingDirectionMenu:
         case ContextMenuItemTagTextDirectionMenu:
         case ContextMenuItemTagPDFSinglePageScrolling:
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index 6fe9748..ae8df4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -51,6 +51,9 @@ class wxPoint;
 
 namespace WebCore {
 
+    class FloatPoint;
+    class FloatSize;
+
     // Wheel events come in two flavors:
     // The ScrollByPixelWheelEvent is a fine-grained event that specifies the precise number of pixels to scroll.  It is sent directly by MacBook touchpads on OS X,
     // and synthesized in other cases where platforms generate line-by-line scrolling events.
@@ -99,7 +102,7 @@ namespace WebCore {
 
 #if PLATFORM(WIN)
         PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
-        PlatformWheelEvent(HWND, float deltaX, float deltaY, float xLoc, float yLoc);
+        PlatformWheelEvent(HWND, const FloatSize& delta, const FloatPoint& location);
 #endif
 
 #if PLATFORM(WX)
diff --git a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
index bee21b9..9c8e3cb 100644
--- a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
@@ -62,7 +62,7 @@ namespace WebCore {
         mutable State m_state;
     };
 
-#if !PLATFORM(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT)
+#if !PLATFORM(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT) || PLATFORM(GTK)
     inline PurgeableBuffer* PurgeableBuffer::create(const char*, size_t) { return 0; }
     inline PurgeableBuffer::~PurgeableBuffer() { }
     inline const char* PurgeableBuffer::data() const { return 0; }
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index 14bade8..9d3c128 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -165,6 +165,7 @@ bool ScrollView::canBlitOnScroll() const
     return m_canBlitOnScroll;
 }
 
+#if !PLATFORM(GTK)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
     if (platformWidget())
@@ -173,6 +174,7 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                    IntSize(max(0, width() - (verticalScrollbar() && !includeScrollbars ? verticalScrollbar()->width() : 0)), 
                            max(0, height() - (horizontalScrollbar() && !includeScrollbars ? horizontalScrollbar()->height() : 0))));
 }
+#endif
 
 int ScrollView::layoutWidth() const
 {
@@ -638,12 +640,12 @@ void ScrollView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppre
     }
 }
 
-Scrollbar* ScrollView::scrollbarUnderMouse(const PlatformMouseEvent& mouseEvent)
+Scrollbar* ScrollView::scrollbarUnderPoint(const IntPoint& windowPoint)
 {
     if (platformWidget())
         return 0;
 
-    IntPoint viewPoint = convertFromContainingWindow(mouseEvent.pos());
+    IntPoint viewPoint = convertFromContainingWindow(windowPoint);
     if (m_horizontalScrollbar && m_horizontalScrollbar->frameRect().contains(viewPoint))
         return m_horizontalScrollbar.get();
     if (m_verticalScrollbar && m_verticalScrollbar->frameRect().contains(viewPoint))
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 3549c66..7f99a22 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -181,7 +181,7 @@ public:
     virtual void setFrameRect(const IntRect&);
 
     // For platforms that need to hit test scrollbars from within the engine's event handlers (like Win32).
-    Scrollbar* scrollbarUnderMouse(const PlatformMouseEvent& mouseEvent);
+    Scrollbar* scrollbarUnderPoint(const IntPoint& windowPoint);
 
     // This method exists for scrollviews that need to handle wheel events manually.
     // On Mac the underlying NSScrollView just does the scrolling, but on other platforms
diff --git a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
index 6c301e3..b68a74c 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -162,15 +162,6 @@ void CheckCacheObjectStatus(DocLoader*, CachedResource*)
 Icon::~Icon() { }
 void Icon::paint(GraphicsContext*, const IntRect&) { }
 
-// This function provides the default value for the CSS property:
-// -webkit-focus-ring-color
-// It is also related to the CSS property outline-color:
-Color focusRingColor()
-{
-    verifiedOk();
-    return 0xFF0000FF;
-}
-
 }  // namespace WebCore
 
 // FIXME, no support for spelling yet.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
index 310af59..1cae191 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/IntPoint.h
@@ -29,10 +29,15 @@
 #include "IntSize.h"
 #include <wtf/Platform.h>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 #if PLATFORM(CG)
 typedef struct CGPoint CGPoint;
 #endif
 
+
 #if PLATFORM(MAC)
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGPoint NSPoint;
@@ -169,6 +174,23 @@ inline bool operator!=(const IntPoint& a, const IntPoint& b)
     return a.x() != b.x() || a.y() != b.y();
 }
 
+#if PLATFORM(QT)
+inline QDataStream& operator<<(QDataStream& stream, const IntPoint& point)
+{
+    stream << point.x() << point.y();
+    return stream;
+}
+
+inline QDataStream& operator>>(QDataStream& stream, IntPoint& point)
+{
+    int x, y;
+    stream >> x >> y;
+    point.setX(x);
+    point.setY(y);
+    return stream;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // IntPoint_h
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 7484a7a..a277675 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -62,6 +62,8 @@ public:
     virtual void play() { }
     virtual void pause() { }    
 
+    virtual bool supportsFullscreen() const { return false; }
+
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
     virtual bool hasVideo() const { return false; }
@@ -299,6 +301,11 @@ bool MediaPlayer::seeking() const
     return m_private->seeking();
 }
 
+bool MediaPlayer::supportsFullscreen() const
+{
+    return m_private->supportsFullscreen();
+}
+
 IntSize MediaPlayer::naturalSize()
 {
     return m_private->naturalSize();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 2a6993a..187c701 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -107,6 +107,7 @@ public:
     static void getSupportedTypes(HashSet<String>&);
     static bool isAvailable();
 
+    bool supportsFullscreen() const;
     IntSize naturalSize();
     bool hasVideo();
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index 9161bbb..edbe125 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -46,6 +46,8 @@ public:
     virtual void play() = 0;
     virtual void pause() = 0;    
 
+    virtual bool supportsFullscreen() const { return false; };
+
     virtual IntSize naturalSize() const = 0;
 
     virtual bool hasVideo() const = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index d22aa89..8503fb5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -763,7 +763,6 @@ void GraphicsContext::clipPath(WindRule clipRule)
  * RenderTheme handles drawing focus on widgets which 
  * need it.
  */
-Color focusRingColor() { return Color(0, 0, 0); }
 void GraphicsContext::drawFocusRing(const Color& color)
 {
     if (paintingDisabled())
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
index db6ecb6..9bdd276 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.h
@@ -41,6 +41,7 @@ class NSPasteboard;
 namespace WebCore {
 
 class Frame;
+class FileList;
 
 class ClipboardMac : public Clipboard, public CachedResourceClient {
 public:
@@ -60,6 +61,7 @@ public:
     
     // extensions beyond IE's API
     virtual HashSet<String> types() const;
+    virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
     void setDragImageElement(Node *, const IntPoint&);
diff --git a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
index d1b66a7..52bc952 100644
--- a/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
+++ b/src/3rdparty/webkit/WebCore/platform/mac/ClipboardMac.mm
@@ -31,6 +31,7 @@
 #import "DragController.h"
 #import "Editor.h"
 #import "FoundationExtras.h"
+#import "FileList.h"
 #import "Frame.h"
 #import "Image.h"
 #import "Page.h"
@@ -139,7 +140,7 @@ void ClipboardMac::clearAllData()
     [m_pasteboard.get() declareTypes:[NSArray array] owner:nil];
 }
 
-static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL)
+static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bool onlyFirstURL = false)
 {
     NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
 
@@ -163,7 +164,7 @@ static NSArray *absoluteURLsFromPasteboardFilenames(NSPasteboard* pasteboard, bo
     return urls;
 }
 
-static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL)
+static NSArray *absoluteURLsFromPasteboard(NSPasteboard* pasteboard, bool onlyFirstURL = false)
 {
     // NOTE: We must always check [availableTypes containsObject:] before accessing pasteboard data
     // or CoreFoundation will printf when there is not data of the corresponding type.
@@ -274,6 +275,26 @@ HashSet<String> ClipboardMac::types() const
     return result;
 }
 
+// FIXME: We could cache the computed fileList if necessary
+// Currently each access gets a new copy, setData() modifications to the
+// clipboard are not reflected in any FileList objects the page has accessed and stored
+PassRefPtr<FileList> ClipboardMac::files() const
+{
+    if (policy() != ClipboardReadable)
+        return FileList::create();
+
+    NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get());
+    NSUInteger count = [absoluteURLs count];
+
+    RefPtr<FileList> fileList = FileList::create();
+    for (NSUInteger x = 0; x < count; x++) {
+        NSURL *absoluteURL = [NSURL URLWithString:[absoluteURLs objectAtIndex:x]];
+        ASSERT([absoluteURL isFileURL]);
+        fileList->append(File::create([absoluteURL path]));
+    }
+    return fileList.release(); // We will always return a FileList, sometimes empty
+}
+
 // The rest of these getters don't really have any impact on security, so for now make no checks
 
 void ClipboardMac::setDragImage(CachedImage* img, const IntPoint &loc)
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2..a6d70fd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -502,7 +502,7 @@ static bool isCacheHeaderSeparator(UChar c)
     }
 }
 
-static bool isControlCharacter(UChar c)
+bool isControlCharacter(UChar c)
 {
     return c < ' ' || c == 127;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
index 7594c09..20165e7 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
@@ -162,6 +162,8 @@ struct CrossThreadResourceResponseData {
     time_t m_lastModifiedDate;
 };
 
+bool isControlCharacter(UChar c);
+    
 } // namespace WebCore
 
 #endif // ResourceResponseBase_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
index 9c49594..fddda01 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.cpp
@@ -32,16 +32,19 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "Element.h"
+#include "FileList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
 #include "Image.h"
 #include "IntPoint.h"
 #include "KURL.h"
 #include "markup.h"
+#include "NotImplemented.h"
 #include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
 #include "StringHash.h"
+
 #include <QList>
 #include <QMimeData>
 #include <QStringList>
@@ -178,6 +181,12 @@ HashSet<String> ClipboardQt::types() const
     return result;
 }
 
+PassRefPtr<FileList> ClipboardQt::files() const
+{
+    notImplemented();
+    return 0;
+}
+
 void ClipboardQt::setDragImage(CachedImage* image, const IntPoint& point) 
 {
     setDragImage(image, 0, point);
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
index caf040f..44324f2 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/ClipboardQt.h
@@ -56,8 +56,9 @@ namespace WebCore {
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        HashSet<String> types() const;
-    
+        virtual HashSet<String> types() const;
+        virtual PassRefPtr<FileList> files() const;
+
         void setDragImage(CachedImage*, const IntPoint&);
         void setDragImageElement(Node*, const IntPoint&);
 
diff --git a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
index 659dde2..ee2c8ce 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
+++ b/src/3rdparty/webkit/WebCore/platform/text/PlatformString.h
@@ -49,6 +49,7 @@ typedef const struct __CFString * CFStringRef;
 QT_BEGIN_NAMESPACE
 class QString;
 QT_END_NAMESPACE
+#include <QDataStream>
 #endif
 
 #if PLATFORM(WX)
@@ -248,6 +249,11 @@ private:
     RefPtr<StringImpl> m_impl;
 };
 
+#if PLATFORM(QT)
+QDataStream& operator<<(QDataStream& stream, const String& str);
+QDataStream& operator>>(QDataStream& stream, String& str);
+#endif
+
 String operator+(const String&, const String&);
 String operator+(const String&, const char*);
 String operator+(const char*, const String&);
diff --git a/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp b/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
index de9f527..97bbf40 100644
--- a/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/text/qt/StringQt.cpp
@@ -51,6 +51,22 @@ String::operator QString() const
     return QString(reinterpret_cast<const QChar*>(characters()), length());
 }
 
+QDataStream& operator<<(QDataStream& stream, const String& str)
+{
+    // could be faster
+    stream << QString(str);
+    return stream;
+}
+
+QDataStream& operator>>(QDataStream& stream, String& str)
+{
+    // mabe not the fastest way, but really easy
+    QString tmp;
+    stream >> tmp;
+    str = tmp;
+    return stream;
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index e477965..67c34eb 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -110,11 +110,6 @@ static BYTE* endPaint;
 
 HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return 0;
-#else     
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so set up the PAINTSTRUCT so
@@ -130,16 +125,10 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    beginPaint
-#endif
 }
 
 BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return FALSE;
-#else      
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so we don't have to do any
@@ -152,10 +141,8 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    endPaint
-#endif      
 }
 
-#if (!COMPILER(MINGW))
 static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE*& pProc, const void* pNewProc)
 {
     // See <http://www.fengyuan.com/article/wmprint.html> for an explanation of
@@ -196,7 +183,6 @@ static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAIN
     hook("user32.dll", "BeginPaint", beginPaintSysCall, beginPaint, hookedBeginPaint);
     hook("user32.dll", "EndPaint", endPaintSysCall, endPaint, hookedEndPaint);
 }
-#endif
 
 static bool registerPluginView()
 {
@@ -940,9 +926,8 @@ void PluginView::init()
 
     if (m_isWindowed) {
         registerPluginView();
-#if (!COMPILER(MINGW))       
         setUpOffscreenPaintingHooks(hookedBeginPaint, hookedEndPaint);
-#endif
+
         DWORD flags = WS_CHILD;
         if (isSelfVisible())
             flags |= WS_VISIBLE;
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index 0432a4c..be6b966 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -658,22 +658,20 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
-void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                    int my, int mh, int _tx, int _ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int _tx, int _ty, int w, int h, CompositeOperator op)
 {
     if (!fillLayer)
         return;
-    paintFillLayers(paintInfo, c, fillLayer->next(), my, mh, _tx, _ty, w, h, op);
-    paintFillLayer(paintInfo, c, fillLayer, my, mh, _tx, _ty, w, h, op);
+    paintFillLayers(paintInfo, c, fillLayer->next(), _tx, _ty, w, h, op);
+    paintFillLayer(paintInfo, c, fillLayer, _tx, _ty, w, h, op);
 }
 
-void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                   int my, int mh, int tx, int ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int w, int h, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
     bool hasFillImage = img && img->canRender(renderer()->style()->effectiveZoom());
     if ((!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, tx, ty, w, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, w, h, this, op);
     else {
         // We have a fill image that spans multiple lines.
         // We need to adjust _tx and _ty by the width of all previous lines.
@@ -692,7 +690,7 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
             totalWidth += curr->width();
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, width(), height()));
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, startX, ty, totalWidth, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, startX, ty, totalWidth, h, this, op);
         paintInfo.context->restore();
     }
 }
@@ -720,13 +718,6 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     GraphicsContext* context = paintInfo.context;
     
     // You can use p::first-line to specify a background. If so, the root line boxes for
@@ -738,7 +729,7 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
             paintBoxShadow(context, styleToUse, tx, ty, w, h);
 
         Color c = styleToUse->backgroundColor();
-        paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), my, mh, tx, ty, w, h);
+        paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), tx, ty, w, h);
 
         // :first-line cannot be used to put borders on a line. Always paint borders with our
         // non-first-line style.
@@ -789,14 +780,6 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
-    
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
@@ -811,7 +794,7 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
         compositeOp = CompositeSourceOver;
     }
 
-    paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
+    paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
     
     bool hasBoxImage = maskBoxImage && maskBoxImage->canRender(renderer()->style()->effectiveZoom());
     if (!hasBoxImage || !maskBoxImage->isLoaded())
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
index 2462eba..ab1b6f2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
@@ -87,10 +87,8 @@ public:
 
     virtual void paintBoxDecorations(RenderObject::PaintInfo&, int tx, int ty);
     virtual void paintMask(RenderObject::PaintInfo&, int tx, int ty);
-    void paintFillLayers(const RenderObject::PaintInfo&, const Color&, const FillLayer*,
-                         int my, int mh, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
-    void paintFillLayer(const RenderObject::PaintInfo&, const Color&, const FillLayer*,
-                         int my, int mh, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    void paintFillLayers(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, RenderStyle*, int tx, int ty, int w, int h);
     virtual void paintTextDecorations(RenderObject::PaintInfo&, int tx, int ty, bool paintedChildren = false);
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index d66519a..fc2790c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -101,6 +101,7 @@ void MediaTextDisplayElement::update()
 {
     if (renderer())
         renderer()->updateFromElement();
+    updateStyle();
 }
 
 void MediaTextDisplayElement::updateStyle()
@@ -125,13 +126,7 @@ MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseud
     , m_displayType(displayType)
 {
     setInputType(type);
-    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
-    RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
-    if (renderer) {
-        setRenderer(renderer);
-        renderer->setStyle(style);
-    }
-    setAttached();
+    updateStyle();
     setInDocument(true);
 }
 
@@ -147,14 +142,35 @@ void MediaControlInputElement::update()
     updateDisplayType();
     if (renderer())
         renderer()->updateFromElement();
+    updateStyle();
 }
 
 void MediaControlInputElement::updateStyle()
 {
-    if (renderer() && m_mediaElement->renderer()) {
-        RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    if (!m_mediaElement || !m_mediaElement->renderer())
+        return;
+    
+    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    
+    bool needsRenderer = rendererIsNeeded(style);
+    if (renderer() && !needsRenderer)
+        detach();
+    else if (!renderer() && needsRenderer) {
+        RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
+        if (!renderer)
+            return;
+        renderer->setStyle(style);
+        setRenderer(renderer);
+        setAttached();
+        if (parent() && parent()->renderer()) {
+            // Find next sibling with a renderer to determine where to insert.
+            Node* sibling = nextSibling();
+            while (sibling && !sibling->renderer())
+                sibling = sibling->nextSibling();
+            parent()->renderer()->addChild(renderer, sibling ? sibling->renderer() : 0);
+        }
+    } else if (renderer())
         renderer()->setStyle(style);
-    }
 }
 
 bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
@@ -323,6 +339,12 @@ void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
+{
+    return m_mediaElement->supportsFullscreen() && MediaControlInputElement::rendererIsNeeded(style);
+}
+
+
 // ----------------------------
 
 } //namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index d3e0040..eefb2ce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -91,7 +91,7 @@ public:
     MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
     void attachToParent(Element*);
     void update();
-    void updateStyle();
+    virtual void updateStyle();
     bool hitTest(const IntPoint& absPoint);
     MediaControlElementType displayType() const { return m_displayType; }
 
@@ -152,6 +152,7 @@ class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
     MediaControlFullscreenButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index e9db716..ab0d153 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -248,22 +248,22 @@ int RenderBox::clientHeight() const
     return height() - borderTop() - borderBottom() - horizontalScrollbarHeight();
 }
 
-// scrollWidth/scrollHeight will be the same as overflowWidth/overflowHeight unless the
-// object has overflow:hidden/scroll/auto specified and also has overflow.
-// FIXME: It's not completely clear how scrollWidth/Height should behave for 
-// objects with visible overflow.
 int RenderBox::scrollWidth() const
 {
     if (hasOverflowClip())
         return layer()->scrollWidth();
-    return overflowWidth();
+    // For objects with visible overflow, this matches IE.
+    if (style()->direction() == LTR)
+        return max(clientWidth(), rightmostPosition(true, false) - borderLeft());
+    return clientWidth() - min(0, leftmostPosition(true, false) - borderLeft());
 }
 
 int RenderBox::scrollHeight() const
 {
     if (hasOverflowClip())
         return layer()->scrollHeight();
-    return overflowHeight();
+    // For objects with visible overflow, this matches IE.
+    return max(clientHeight(), lowestPosition(true, false) - borderTop());
 }
 
 int RenderBox::scrollLeft() const
@@ -582,9 +582,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     int bw = max(w + marginLeft() + marginRight() + borderLeft() + borderRight(), rw);
     int bh = max(h + marginTop() + marginBottom() + borderTop() + borderBottom(), rh);
 
-    int my = max(by, paintInfo.rect.y());
-
-    paintFillLayers(paintInfo, bgColor, bgLayer, my, paintInfo.rect.height(), bx, by, bw, bh);
+    paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh);
 
     if (style()->hasBorder() && style()->display() != INLINE)
         paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -607,13 +605,6 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     // balloon layout is an example of this).
     borderFitAdjust(tx, w);
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     // FIXME: Should eventually give the theme control over whether the box shadow should paint, since controls could have
     // custom shadows of their own.
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
@@ -626,7 +617,7 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
         // independent of the body.  Go through the DOM to get to the root element's render object,
         // since the root could be inline and wrapped in an anonymous block.
         if (!isBody() || document()->documentElement()->renderer()->style()->hasBackground())
-            paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+            paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
         if (style()->hasAppearance())
             theme()->paintDecorations(this, paintInfo, IntRect(tx, ty, w, h));
     }
@@ -648,17 +639,10 @@ void RenderBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
     // balloon layout is an example of this).
     borderFitAdjust(tx, w);
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
-void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int tx, int ty, int w, int h)
+void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int w, int h)
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
@@ -689,7 +673,7 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int
         compositeOp = CompositeSourceOver;
     }
 
-    paintFillLayers(paintInfo, Color(), style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
+    paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
     paintNinePieceImage(paintInfo.context, tx, ty, w, h, style(), style()->maskBoxImage(), compositeOp);
     
     if (pushTransparencyLayer)
@@ -715,20 +699,18 @@ IntRect RenderBox::maskClipRect()
     return result;
 }
 
-void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                int clipY, int clipH, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
 {
     if (!fillLayer)
         return;
 
-    paintFillLayers(paintInfo, c, fillLayer->next(), clipY, clipH, tx, ty, width, height, op);
-    paintFillLayer(paintInfo, c, fillLayer, clipY, clipH, tx, ty, width, height, op);
+    paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op);
+    paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op);
 }
 
-void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                               int clipY, int clipH, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, clipY, clipH, tx, ty, width, height, 0, op);
+    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op);
 }
 
 void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index ceb3302..95c0637 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -288,10 +288,10 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateBoxModelInfoFromStyle();
 
-    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
-    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
 
-    void paintMaskImages(const PaintInfo&, int clipY, int clipHeight, int tx, int ty, int width, int height);
+    void paintMaskImages(const PaintInfo&, int tx, int ty, int width, int height);
 
 #if PLATFORM(MAC)
     void paintCustomHighlight(int tx, int ty, const AtomicString& type, bool behindText);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
index 467fa82..8973e64 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
@@ -297,8 +297,7 @@ int RenderBoxModelObject::paddingRight(bool) const
 }
 
 
-void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int clipY, int clipH,
-                                                  int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
 {
     GraphicsContext* context = paintInfo.context;
     bool includeLeftEdge = box ? box->includeLeftEdge() : true;
@@ -411,7 +410,8 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     // Paint the color first underneath all images.
     if (!bgLayer->next()) {
-        IntRect rect(tx, clipY, w, clipH);
+        IntRect rect(tx, ty, w, h);
+        rect.intersect(paintInfo.rect);
         // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
         if (isOpaqueRoot) {
             Color baseColor = view()->frameView()->baseBackgroundColor();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
index f2c6326..9feaf2f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
@@ -90,8 +90,7 @@ public:
     void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
     bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
-    virtual void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight,
-                                        int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
+    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
 
     // The difference between this inline's baseline position and the line's baseline position.
     int verticalPosition(bool firstLine) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
index 32e67a4..b207a31 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.cpp
@@ -82,12 +82,24 @@ void RenderDataGrid::paintObject(PaintInfo& paintInfo, int tx, int ty)
     if (style()->visibility() != VISIBLE)
         return;
 
-    // FIXME: Column and cell foregrounds will paint here.
-    
     // Paint our background and border.
     RenderBlock::paintObject(paintInfo, tx, ty);
     
-    // FIXME: Row, cell and column backgrounds will paint here.
+    if (paintInfo.phase != PaintPhaseForeground)
+        return;
+
+    // Paint our column headers first.
+    paintColumnHeaders(paintInfo, tx, ty);
+}
+
+void RenderDataGrid::paintColumnHeaders(PaintInfo&, int, int)
+{
+    gridElement()->columns();
+    
+}
+
+void RenderDataGrid::rebuildColumns()
+{
 }
 
 // Scrolling implementation functions
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
index a6566d7..6a4b32e 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderDataGrid.h
@@ -26,8 +26,12 @@
 #ifndef RenderDataGrid_h
 #define RenderDataGrid_h
 
+#include "HTMLDataGridElement.h"
 #include "RenderBlock.h"
 #include "ScrollbarClient.h"
+#include "StyleImage.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
@@ -44,7 +48,14 @@ public:
     
     virtual void paintObject(PaintInfo&, int tx, int ty);
 
+    void columnsChanged();
+
 private:
+    void paintColumnHeaders(PaintInfo&, int tx, int ty);
+    void rebuildColumns();
+
+    HTMLDataGridElement* gridElement() const { return static_cast<HTMLDataGridElement*>(node()); }
+
     // ScrollbarClient interface.
     virtual void valueChanged(Scrollbar*);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
index 310dbe4..1275882 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
@@ -131,13 +131,9 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     h -= yOff;
     ty += yOff;
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
 
-    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
 
     if (!style()->hasBorder())
         return;
@@ -176,11 +172,7 @@ void RenderFieldset::paintMask(PaintInfo& paintInfo, int tx, int ty)
     h -= yOff;
     ty += yOff;
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
         
 void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
index 56ad490..cd84a09 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderImage.cpp
@@ -452,11 +452,9 @@ bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         int tx = _tx + x();
         int ty = _ty + y();
         
-        HTMLMapElement* map = imageMap();
-        if (map) {
-            // we're a client side image map
-            inside = map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult);
-            tempResult.setInnerNonSharedNode(node());
+        if (HTMLMapElement* map = imageMap()) {
+            if (map->mapMouseEvent(_x - tx, _y - ty, IntSize(contentWidth(), contentHeight()), tempResult))
+                tempResult.setInnerNonSharedNode(node());
         }
     }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 94ca6c7..ba85f1a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -238,6 +238,15 @@ void RenderLayer::rendererContentChanged()
 }
 #endif // USE(ACCELERATED_COMPOSITING)
 
+bool RenderLayer::hasAcceleratedCompositing() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return compositor()->hasAcceleratedCompositing();
+#else
+    return false;
+#endif
+}
+
 void RenderLayer::setStaticY(int staticY)
 {
     if (m_staticY == staticY)
@@ -339,7 +348,7 @@ void RenderLayer::updateTransform()
         ASSERT(box);
         m_transform->makeIdentity();
         box->style()->applyTransform(*m_transform, box->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
-        makeMatrixRenderable(*m_transform);
+        makeMatrixRenderable(*m_transform, hasAcceleratedCompositing());
     }
 
     if (had3DTransform != has3DTransform())
@@ -356,7 +365,7 @@ TransformationMatrix RenderLayer::currentTransform() const
         TransformationMatrix currTransform;
         RefPtr<RenderStyle> style = renderer()->animation()->getAnimatedStyleForRenderer(renderer());
         style->applyTransform(currTransform, renderBox()->borderBoxRect().size(), RenderStyle::IncludeTransformOrigin);
-        makeMatrixRenderable(currTransform);
+        makeMatrixRenderable(currTransform, hasAcceleratedCompositing());
         return currTransform;
     }
 #endif
@@ -1053,8 +1062,10 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
         child->updateLayerPositions(false, false);
 
 #if USE(ACCELERATED_COMPOSITING)
-    if (isComposited())
-        m_backing->updateGraphicsLayerGeometry();
+    if (compositor()->inCompositingMode()) {
+        if (RenderLayer* compositingAncestor = ancestorCompositingLayer())
+            compositingAncestor->backing()->updateAfterLayout();
+    }
 #endif
     
     RenderView* view = renderer()->view();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
index 2bbb433..4feede8 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.h
@@ -289,6 +289,9 @@ public:
     // Allows updates of layer content without repainting.
     void rendererContentChanged();
 #endif
+
+    // Returns true if the accelerated compositing is enabled
+    bool hasAcceleratedCompositing() const;
     
     void updateLayerPosition();
     void updateLayerPositions(bool doFullRepaint = false, bool checkForRepaint = true);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index a1da7ce..1c6d43c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -120,7 +120,7 @@ void RenderLayerBacking::updateLayerTransform()
     TransformationMatrix t;
     if (m_owningLayer->hasTransform()) {
         style->applyTransform(t, toRenderBox(renderer())->borderBoxRect().size(), RenderStyle::ExcludeTransformOrigin);
-        makeMatrixRenderable(t);
+        makeMatrixRenderable(t, compositor()->hasAcceleratedCompositing());
     }
     
     m_graphicsLayer->setTransform(t);
@@ -543,29 +543,29 @@ bool RenderLayerBacking::hasNonCompositingContent() const
     // FIXME: test for overflow controls.
     if (m_owningLayer->isStackingContext()) {
         // Use the m_hasCompositingDescendant bit to optimize?
-        Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 if (!curLayer->isComposited())
                     return true;
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 if (!curLayer->isComposited())
                     return true;
             }
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (!curLayer->isComposited())
                 return true;
         }
@@ -698,27 +698,47 @@ bool RenderLayerBacking::paintingGoesToWindow() const
 
 void RenderLayerBacking::setContentsNeedDisplay()
 {
-    if (m_graphicsLayer)
+    bool needViewUpdate = false;
+
+    if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
         m_graphicsLayer->setNeedsDisplay();
-    if (m_contentsLayer)
+        needViewUpdate = true;
+    }
+    
+    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
         m_contentsLayer->setNeedsDisplay();
+        needViewUpdate = true;
+    }
+    
+    // Make sure layout happens before we get rendered again.
+    if (needViewUpdate)
+        compositor()->scheduleViewUpdate();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
-    if (m_graphicsLayer) {
+    bool needViewUpdate = false;
+
+    if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
         FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
-        if (bounds.intersects(dirtyRect))
+        if (bounds.intersects(dirtyRect)) {
             m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
+            needViewUpdate = true;
+        }
     }
 
-    if (m_contentsLayer) {
+    if (m_contentsLayer && m_contentsLayer->drawsContent()) {
         // FIXME: do incremental repaint
         m_contentsLayer->setNeedsDisplay();
+        needViewUpdate = true;
     }
+
+    // Make sure layout happens before we get rendered again.
+    if (needViewUpdate)
+        compositor()->scheduleViewUpdate();
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -774,7 +794,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
-    if (paintingPhase & GraphicsLayerPaintBackgroundMask) {
+    bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
+
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -818,7 +840,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    if (paintingPhase & GraphicsLayerPaintForegroundMask) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index d06629b..8b07ca9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -40,6 +40,7 @@
 #include "RenderLayerBacking.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 #if PROFILE_LAYER_REBUILD
 #include <wtf/CurrentTime.h>
@@ -59,16 +60,16 @@ namespace WebCore {
 
 struct CompositingState {
     CompositingState(RenderLayer* compAncestor)
-        : m_subtreeIsCompositing(false)
-        , m_compositingAncestor(compAncestor)
+        : m_compositingAncestor(compAncestor)
+        , m_subtreeIsCompositing(false)
 #ifndef NDEBUG
         , m_depth(0)
 #endif
     {
     }
     
-    bool m_subtreeIsCompositing;
     RenderLayer* m_compositingAncestor;
+    bool m_subtreeIsCompositing;
 #ifndef NDEBUG
     int m_depth;
 #endif
@@ -87,6 +88,7 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_compositing(false)
     , m_rootLayerAttached(false)
     , m_compositingLayersNeedUpdate(false)
+    , m_hasAcceleratedCompositing(true)
 #if PROFILE_LAYER_REBUILD
     , m_rootLayerUpdateCount(0)
 #endif // PROFILE_LAYER_REBUILD
@@ -109,9 +111,23 @@ void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
         // the empty root layer, which has minimal overhead.
         if (m_compositing)
             ensureRootPlatformLayer();
+        else
+            destroyRootPlatformLayer();
     }
 }
 
+void RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag()
+{
+    bool hasAcceleratedCompositing = false;
+    if (Settings* settings = m_renderView->document()->settings())
+        hasAcceleratedCompositing = settings-> acceleratedCompositingEnabled();
+
+    if (hasAcceleratedCompositing != m_hasAcceleratedCompositing)
+        setCompositingLayersNeedUpdate();
+        
+    m_hasAcceleratedCompositing = hasAcceleratedCompositing;
+}
+
 void RenderLayerCompositor::setCompositingLayersNeedUpdate(bool needUpdate)
 {
     if (inCompositingMode()) {
@@ -173,6 +189,9 @@ void RenderLayerCompositor::updateCompositingLayers(RenderLayer* updateRoot)
                     m_rootLayerUpdateCount, 1000.0 * (endTime - startTime));
 #endif
     ASSERT(updateRoot || !m_compositingLayersNeedUpdate);
+
+    if (!hasAcceleratedCompositing())
+        enableCompositingMode(false);
 }
 
 bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeRepaint shouldRepaint)
@@ -247,10 +266,13 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
     
     ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
 
-    Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-    if (negZOrderList) {
-        for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (!layer->isSelfPaintingLayer())
+        return IntRect();
+
+    if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+        size_t listSize = negZOrderList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = negZOrderList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(childUnionBounds);
@@ -258,10 +280,10 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-    if (posZOrderList) {
-        for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+        size_t listSize = posZOrderList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = posZOrderList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(childUnionBounds);
@@ -269,10 +291,10 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect curAbsBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(curAbsBounds);
@@ -345,7 +367,7 @@ RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const Rend
 //      must be compositing so that its contents render over that child.
 //      This implies that its positive z-index children must also be compositing.
 //
-void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, struct CompositingState& ioCompState)
+void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, struct CompositingState& compositingState)
 {
     layer->updateLayerPosition();
     layer->updateZOrderLists();
@@ -353,18 +375,23 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
     
     // Clear the flag
     layer->setHasCompositingDescendant(false);
-    layer->setMustOverlayCompositedLayers(ioCompState.m_subtreeIsCompositing);
+    layer->setMustOverlayCompositedLayers(compositingState.m_subtreeIsCompositing);
     
-    const bool willBeComposited = needsToBeComposited(layer);
-    ioCompState.m_subtreeIsCompositing = willBeComposited;
+    // The children of this layer don't need to composite, unless there is
+    // a compositing layer among them, so start by inheriting the compositing
+    // ancestor with m_subtreeIsCompositing set to false.
+    CompositingState childState(compositingState.m_compositingAncestor);
+#ifndef NDEBUG
+    ++childState.m_depth;
+#endif
 
-    CompositingState childState = ioCompState;
-    if (willBeComposited)
+    const bool willBeComposited = needsToBeComposited(layer);
+    if (willBeComposited) {
+        // Tell the parent it has compositing descendants.
+        compositingState.m_subtreeIsCompositing = true;
+        // This layer now acts as the ancestor for kids.
         childState.m_compositingAncestor = layer;
-
-    // The children of this stacking context don't need to composite, unless there is
-    // a compositing layer among them, so start by assuming false.
-    childState.m_subtreeIsCompositing = false;
+    }
 
 #if ENABLE(VIDEO)
     // Video is special. It's a replaced element with a content layer, but has shadow content
@@ -374,22 +401,18 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
         childState.m_subtreeIsCompositing = true;
 #endif
 
-#ifndef NDEBUG
-    ++childState.m_depth;
-#endif
-
     if (layer->isStackingContext()) {
         ASSERT(!layer->m_zOrderListsDirty);
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 computeCompositingRequirements(curLayer, childState);
 
-                // if we have to make a layer for this child, make one now so we can have a contents layer
-                // (since we need to ensure that the -ve z-order child renders underneath our contents)
+                // If we have to make a layer for this child, make one now so we can have a contents layer
+                // (since we need to ensure that the -ve z-order child renders underneath our contents).
                 if (childState.m_subtreeIsCompositing) {
-                    // make |this| compositing
+                    // make layer compositing
                     layer->setMustOverlayCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
                 }
@@ -398,19 +421,19 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
     }
     
     ASSERT(!layer->m_normalFlowListDirty);
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             computeCompositingRequirements(curLayer, childState);
         }
     }
 
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 computeCompositingRequirements(curLayer, childState);
             }
         }
@@ -425,7 +448,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
 
     // Subsequent layers in the parent stacking context also need to composite.
     if (childState.m_subtreeIsCompositing)
-        ioCompState.m_subtreeIsCompositing = true;
+        compositingState.m_subtreeIsCompositing = true;
 
     // If the layer is going into compositing mode, repaint its old location.
     if (!layer->isComposited() && needsToBeComposited(layer))
@@ -485,14 +508,14 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasMask() || o->hasReflection())
+    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
 }
 #endif
 
-void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& ioCompState)
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& compositingState)
 {
     // Make the layer compositing if necessary, and set up clipping and content layers.
     // Note that we can only do work here that is independent of whether the descendant layers
@@ -514,10 +537,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
 
     // host the document layer in the RenderView's root layer
-    if (layer->isRootLayer())
+    if (layer->isRootLayer() && layer->isComposited())
         parentInRootLayer(layer);
 
-    CompositingState childState = ioCompState;
+    CompositingState childState = compositingState;
     if (layer->isComposited())
         childState.m_compositingAncestor = layer;
 
@@ -532,10 +555,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     if (layer->isStackingContext()) {
         ASSERT(!layer->m_zOrderListsDirty);
 
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 rebuildCompositingLayerTree(curLayer, childState);
                 if (curLayer->isComposited())
                     setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -552,10 +575,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
 
     ASSERT(!layer->m_normalFlowListDirty);
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             rebuildCompositingLayerTree(curLayer, childState);
             if (curLayer->isComposited())
                 setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -563,10 +586,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
     
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 rebuildCompositingLayerTree(curLayer, childState);
                 if (curLayer->isComposited())
                     setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -592,19 +615,22 @@ void RenderLayerCompositor::updateCompositingChildrenGeometry(RenderLayer* compo
     
     if (layer->isStackingContext()) {
         if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
-            for (size_t i = 0; i < negZOrderList->size(); ++i)
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
                 updateCompositingChildrenGeometry(compositingAncestor, negZOrderList->at(i));
         }
     }
 
     if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
-        for (size_t i = 0; i < normalFlowList->size(); ++i)
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i)
             updateCompositingChildrenGeometry(compositingAncestor, normalFlowList->at(i));
     }
     
     if (layer->isStackingContext()) {
         if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
-            for (size_t i = 0; i < posZOrderList->size(); ++i)
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
                 updateCompositingChildrenGeometry(compositingAncestor, posZOrderList->at(i));
         }
     }
@@ -622,10 +648,10 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         layer->setBackingNeedsRepaintInRect(rect);
 
     if (layer->hasCompositingDescendant()) {
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 int x = 0, y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
@@ -634,10 +660,10 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 int x = 0, y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
@@ -645,17 +671,16 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
-        
-        Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-        if (normalFlowList) {
-            for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
-                int x = 0, y = 0;
-                curLayer->convertToLayerCoords(layer, x, y);
-                IntRect childRect(rect);
-                childRect.move(-x, -y);
-                recursiveRepaintLayerRect(curLayer, childRect);
-            }
+    }
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
+            int x = 0, y = 0;
+            curLayer->convertToLayerCoords(layer, x, y);
+            IntRect childRect(rect);
+            childRect.move(-x, -y);
+            recursiveRepaintLayerRect(curLayer, childRect);
         }
     }
 }
@@ -711,54 +736,17 @@ bool RenderLayerCompositor::has3DContent() const
 
 bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 {
+    if (!m_hasAcceleratedCompositing || !layer->isSelfPaintingLayer())
+        return false;
+
     return requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers();
 }
 
-#define VERBOSE_COMPOSITINGLAYER    0
-
 // Note: this specifies whether the RL needs a compositing layer for intrinsic reasons.
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
 {
-    // FIXME: cache the result of these tests?
-#if VERBOSE_COMPOSITINGLAYER
-    bool gotReason = false;
-
-    if (!gotReason && inCompositingMode() && layer->isRootLayer()) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it's the document root\n", layer);
-        gotReason = true;
-    }
-    
-    if (!gotReason && requiresCompositingForTransform(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has 3d transform, perspective or backface-hidden\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && requiresCompositingForVideo(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it is video\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has backface-visibility: hidden\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && clipsCompositingDescendants(layer)) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has overflow clip\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && requiresCompositingForAnimation(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has a running transition for opacity or transform\n", layer);
-        gotReason = true;
-    }
-    
-    if (!gotReason)
-        fprintf(stderr, "RenderLayer %p does not require compositing layer\n", layer);
-#endif
-
     // The root layer always has a compositing layer, but it may not have backing.
     return (inCompositingMode() && layer->isRootLayer()) ||
              requiresCompositingForTransform(layer->renderer()) ||
@@ -815,7 +803,7 @@ bool RenderLayerCompositor::clipsCompositingDescendants(const RenderLayer* layer
            layer->renderer()->hasOverflowClip();
 }
 
-bool RenderLayerCompositor::requiresCompositingForTransform(RenderObject* renderer)
+bool RenderLayerCompositor::requiresCompositingForTransform(RenderObject* renderer) const
 {
     RenderStyle* style = renderer->style();
     // Note that we ask the renderer if it has a transform, because the style may have transforms,
@@ -834,12 +822,12 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
     return false;
 }
 
-bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer)
+bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
-    AnimationController* animController = renderer->animation();
-    if (animController)
-        return animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyOpacity) ||
-               animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyWebkitTransform);
+    if (AnimationController* animController = renderer->animation()) {
+        return (animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyOpacity) && inCompositingMode())
+            || animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyWebkitTransform);
+    }
     return false;
 }
 
@@ -869,6 +857,16 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     didMoveOnscreen();
 }
 
+void RenderLayerCompositor::destroyRootPlatformLayer()
+{
+    if (!m_rootPlatformLayer)
+        return;
+
+    willMoveOffscreen();
+    delete m_rootPlatformLayer;
+    m_rootPlatformLayer = 0;
+}
+
 bool RenderLayerCompositor::layerHas3DContent(const RenderLayer* layer) const
 {
     const RenderStyle* style = layer->renderer()->style();
@@ -880,29 +878,29 @@ bool RenderLayerCompositor::layerHas3DContent(const RenderLayer* layer) const
         return true;
 
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 if (layerHas3DContent(curLayer))
                     return true;
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 if (layerHas3DContent(curLayer))
                     return true;
             }
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (layerHas3DContent(curLayer))
                 return true;
         }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
index c522180..bcd6a3f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -56,6 +56,12 @@ public:
     // This will make a compositing layer at the root automatically, and hook up to
     // the native view/window system.
     void enableCompositingMode(bool enable = true);
+    
+    // Returns true if the accelerated compositing is enabled
+    bool hasAcceleratedCompositing() const { return m_hasAcceleratedCompositing; }
+    
+    // Copy the acceleratedCompositingEnabledFlag from Settings
+    void cacheAcceleratedCompositingEnabledFlag();
 
     void setCompositingLayersNeedUpdate(bool needUpdate = true);
     bool compositingLayersNeedUpdate() const { return m_compositingLayersNeedUpdate; }
@@ -137,10 +143,11 @@ private:
     bool layerHas3DContent(const RenderLayer*) const;
 
     void ensureRootPlatformLayer();
-
+    void destroyRootPlatformLayer();
+    
     // Whether a running transition or animation enforces the need for a compositing layer.
-    static bool requiresCompositingForAnimation(RenderObject*);
-    static bool requiresCompositingForTransform(RenderObject*);
+    bool requiresCompositingForAnimation(RenderObject*) const;
+    bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
 
 private:
@@ -149,6 +156,8 @@ private:
     bool m_compositing;
     bool m_rootLayerAttached;
     bool m_compositingLayersNeedUpdate;
+    bool m_hasAcceleratedCompositing;
+    
 #if PROFILE_LAYER_REBUILD
     int m_rootLayerUpdateCount;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index 1803e49..b0eb097 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -299,6 +299,10 @@ void RenderMedia::updateControls()
         m_playButton->update();
     if (m_timeline)
         m_timeline->update();
+    if (m_currentTimeDisplay)
+        m_currentTimeDisplay->update();
+    if (m_timeRemainingDisplay)
+        m_timeRemainingDisplay->update();
     if (m_seekBackButton)
         m_seekBackButton->update();
     if (m_seekForwardButton)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
index 95de7a2..4cd7b43 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMenuList.cpp
@@ -297,7 +297,7 @@ void RenderMenuList::hidePopup()
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
-    select->setSelectedIndex(select->listToOptionIndex(listIndex), true, fireOnChange);
+    select->setSelectedIndexByUser(select->listToOptionIndex(listIndex), true, fireOnChange);
 }
 
 String RenderMenuList::itemText(unsigned listIndex) const
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
index 1c01b8a..098932a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.cpp
@@ -1699,7 +1699,7 @@ void RenderObject::getTransformFromContainer(const RenderObject* containerObject
         transform.multLeft(layer->currentTransform());
     
 #if ENABLE(3D_RENDERING)
-    if (containerObject && containerObject->style()->hasPerspective()) {
+    if (containerObject && containerObject->hasLayer() && containerObject->style()->hasPerspective()) {
         // Perpsective on the container affects us, so we have to factor it in here.
         ASSERT(containerObject->hasLayer());
         FloatPoint perspectiveOrigin = toRenderBox(containerObject)->layer()->perspectiveOrigin();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
index f85cf76..311ef9c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderObject.h
@@ -959,12 +959,14 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
         last->scheduleRelayout();
 }
 
-inline void makeMatrixRenderable(TransformationMatrix& matrix)
+inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
+    UNUSED_PARAM(has3DRendering);
     matrix.makeAffine();
 #else
-    UNUSED_PARAM(matrix);
+    if (!has3DRendering)
+        matrix.makeAffine();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index 5d9de1e..7a3aa64 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -142,6 +142,24 @@ static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, co
 #endif
 }
 
+static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
+{
+    // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e. Real and WMP
+    // require "src" attribute).
+    int srcIndex = -1, dataIndex = -1;
+    for (unsigned int i = 0; i < paramNames->size(); ++i) {
+        if (equalIgnoringCase((*paramNames)[i], "src"))
+            srcIndex = i;
+        else if (equalIgnoringCase((*paramNames)[i], "data"))
+            dataIndex = i;
+    }
+
+    if (srcIndex == -1 && dataIndex != -1) {
+        paramNames->append("src");
+        paramValues->append((*paramValues)[dataIndex]);
+    }
+}
+
 void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 {
     String url;
@@ -238,6 +256,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
             }
         }
 
+        mapDataParamToSrc(&paramNames, &paramValues);
+
         // If we still don't have a type, try to map from a specific CLASSID to a type.
         if (serviceType.isEmpty())
             serviceType = serviceTypeForClassId(o->classId(), pluginData);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
index a59a0a0..48b0d1c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
@@ -514,16 +514,9 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
             ty += captionHeight;
     }
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
     
-    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
 
     if (style()->hasBorder() && !collapseBorders())
         paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -545,14 +538,7 @@ void RenderTable::paintMask(PaintInfo& paintInfo, int tx, int ty)
             ty += captionHeight;
     }
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-    
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
 void RenderTable::calcPrefWidths()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
index 81c96f1..9b02c9d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
@@ -818,10 +818,6 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
     Color c = backgroundObject->style()->backgroundColor();
     const FillLayer* bgLayer = backgroundObject->style()->backgroundLayers();
 
@@ -835,7 +831,7 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
             paintInfo.context->save();
             paintInfo.context->clip(clipRect);
         }
-        paintFillLayers(paintInfo, c, bgLayer, my, mh, tx, ty, w, h);
+        paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h);
         if (shouldClip)
             paintInfo.context->restore();
     }
@@ -874,11 +870,7 @@ void RenderTableCell::paintMask(PaintInfo& paintInfo, int tx, int ty)
     int w = width();
     int h = height();
    
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index 4bdc046..517d911 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -849,4 +849,9 @@ Color RenderTheme::platformInactiveTextSearchHighlightColor() const
     return Color(255, 255, 0); // Yellow.
 }
 
+Color RenderTheme::focusRingColor() const
+{
+    return Color(0, 0, 0); // Black.
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
index 5c87ebd..a1519ce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
@@ -137,6 +137,8 @@ public:
     virtual Color platformActiveTextSearchHighlightColor() const;
     virtual Color platformInactiveTextSearchHighlightColor() const;
 
+    virtual Color focusRingColor() const;
+
     virtual void platformColorsDidChange();
 
     virtual double caretBlinkInterval() const { return 0.5; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index c7d0a9f..5497d52 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -63,6 +63,8 @@ namespace WebCore {
         virtual Color platformActiveSelectionBackgroundColor() const;
         virtual Color platformInactiveSelectionBackgroundColor() const;
         virtual Color activeListBoxSelectionBackgroundColor() const;
+
+        virtual Color focusRingColor() const;
         
         virtual void platformColorsDidChange();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index 6417f4a..bd90831 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -32,6 +32,8 @@
 #import <math.h>
 
 #import "BitmapImage.h"
+#import "ChromiumBridge.h"
+#import "ColorMac.h"
 #import "CSSStyleSelector.h"
 #import "CSSValueKeywords.h"
 #import "Element.h"
@@ -170,6 +172,14 @@ Color RenderThemeChromiumMac::activeListBoxSelectionBackgroundColor() const
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
 }
 
+Color RenderThemeChromiumMac::focusRingColor() const
+{
+    if (ChromiumBridge::layoutTestMode())
+        return oldAquaFocusRingColor();
+
+    return systemColor(CSSValueWebkitFocusRingColor);
+}
+
 static FontWeight toFontWeight(NSInteger appKitFontWeight)
 {
     ASSERT(appKitFontWeight > 0 && appKitFontWeight < 15);
@@ -422,6 +432,9 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
     case CSSValueThreedlightshadow:
         color = convertNSColorToColor([NSColor controlLightHighlightColor]);
         break;
+    case CSSValueWebkitFocusRingColor:
+        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+        break;
     case CSSValueWindow:
         color = convertNSColorToColor([NSColor windowBackgroundColor]);
         break;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 7d5b493..1fb0cb2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -162,6 +162,12 @@ Color RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+Color RenderThemeChromiumSkia::focusRingColor() const
+{
+    static Color focusRingColor(229, 151, 0, 255);
+    return focusRingColor;
+}
+
 double RenderThemeChromiumSkia::caretBlinkInterval() const
 {
     // Disable the blinking caret in layout test mode, as it introduces
@@ -581,6 +587,12 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
     return 1;
 }
 
+// static
+void RenderThemeChromiumSkia::setDefaultFontSize(int fontSize)
+{
+    defaultFontSize = static_cast<float>(fontSize);
+}
+
 double RenderThemeChromiumSkia::caretBlinkIntervalInternal() const
 {
     return RenderTheme::caretBlinkInterval();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
index 421bd26..b81d4fa 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -54,6 +54,7 @@ namespace WebCore {
         virtual Color platformInactiveSelectionBackgroundColor() const;
         virtual Color platformActiveSelectionForegroundColor() const;
         virtual Color platformInactiveSelectionForegroundColor() const;
+        virtual Color focusRingColor() const;
 
         // To change the blink interval, override caretBlinkIntervalInternal instead of this one so that we may share layout test code an intercepts.
         virtual double caretBlinkInterval() const;
@@ -116,6 +117,13 @@ namespace WebCore {
         virtual int buttonInternalPaddingTop() const;
         virtual int buttonInternalPaddingBottom() const;
 
+        // Provide a way to pass the default font size from the Settings object
+        // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
+        // to remove the default font size from this object and have callers
+        // that need the value to get it directly from the appropriate Settings
+        // object.
+        static void setDefaultFontSize(int);
+
     protected:
         static const String& defaultGUIFont();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
index ffc13e1..4ed8d88 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -425,7 +425,7 @@ bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const RenderObject::
 // static
 void RenderThemeChromiumWin::setDefaultFontSize(int fontSize)
 {
-    defaultFontSize = static_cast<float>(fontSize);
+    RenderThemeChromiumSkia::setDefaultFontSize(fontSize);
 
     // Reset cached fonts.
     smallSystemFont = menuFont = labelFont = FontDescription();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
index af51e79..5e98c9b 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumWin.h
@@ -81,11 +81,8 @@ namespace WebCore {
         // entire menulist.
         virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
-        // Provide a way to pass the default font size from the Settings object
-        // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
-        // to remove the default font size from this object and have callers
-        // that need the value to get it directly from the appropriate Settings
-        // object.
+        // Override RenderThemeChromiumSkia's setDefaultFontSize method to also reset the local font property caches.
+        // See comment in RenderThemeChromiumSkia::setDefaultFontSize() regarding ugliness of this hack.
         static void setDefaultFontSize(int);
 
     protected:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index b532352..ba32105 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -58,6 +58,7 @@ public:
     virtual Color platformActiveListBoxSelectionForegroundColor() const;
     virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
     virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+    virtual Color focusRingColor() const;
 
     virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 16d744f..914f7ee 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -94,6 +94,17 @@ SOFT_LINK(SafariTheme, paintThemePart, void, __stdcall, (ThemePart part, CGConte
 #if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
 SOFT_LINK(SafariTheme, STPaintProgressIndicator, void, APIENTRY, (ProgressIndicatorType type, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state, float value), (type, context, rect, size, state, value))
 #endif
+SOFT_LINK_OPTIONAL(SafariTheme, STCopyThemeColor, CGColorRef, APIENTRY, (unsigned color, SafariTheme::ThemeControlState));
+
+static const unsigned stFocusRingColorID = 4;
+
+static const unsigned aquaFocusRingColor = 0xFF7DADD9;
+
+static RGBA32 makeRGBAFromCGColor(CGColorRef color)
+{
+    const CGFloat* components = CGColorGetComponents(color);
+    return makeRGBA(255 * components[0], 255 * components[1], 255 * components[2], 255 * components[3]);
+}
 
 ThemeControlState RenderThemeSafari::determineState(RenderObject* o) const
 {
@@ -149,6 +160,22 @@ Color RenderThemeSafari::activeListBoxSelectionBackgroundColor() const
     return Color(56, 117, 215);
 }
 
+Color RenderThemeSafari::focusRingColor() const
+{
+    static Color focusRingColor;
+
+    if (!focusRingColor.isValid()) {
+        if (STCopyThemeColorPtr()) {
+            RetainPtr<CGColorRef> color(AdoptCF, STCopyThemeColorPtr()(stFocusRingColorID, SafariTheme::ActiveState));
+            focusRingColor = makeRGBAFromCGColor(color.get());
+        }
+        if (!focusRingColor.isValid())
+            focusRingColor = aquaFocusRingColor;
+    }
+
+    return focusRingColor;
+}
+
 static float systemFontSizeForControlSize(NSControlSize controlSize)
 {
     static float sizes[] = { 13.0f, 11.0f, 9.0f };
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
index d0a70ef..4685238 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
@@ -69,6 +69,8 @@ public:
     virtual Color platformInactiveSelectionBackgroundColor() const;
     virtual Color activeListBoxSelectionBackgroundColor() const;
 
+    virtual Color focusRingColor() const;
+
     // System fonts.
     virtual void systemFont(int propId, FontDescription&) const;
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
deleted file mode 100644
index 1cfc119..0000000
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "LocalStorage.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "CString.h"
-#include "EventNames.h"
-#include "FileSystem.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "LocalStorageArea.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "StorageArea.h"
-#include "StorageSyncManager.h"
-#include <wtf/StdLibExtras.h>
-
-namespace WebCore {
-
-typedef HashMap<String, LocalStorage*> LocalStorageMap;
-
-static LocalStorageMap& localStorageMap()
-{
-    DEFINE_STATIC_LOCAL(LocalStorageMap, localStorageMap, ());
-    return localStorageMap;
-}
-
-PassRefPtr<LocalStorage> LocalStorage::localStorage(const String& path)
-{
-    const String lookupPath = path.isNull() ? String("") : path;
-    LocalStorageMap::iterator it = localStorageMap().find(lookupPath);
-    if (it == localStorageMap().end()) {
-        RefPtr<LocalStorage> localStorage = adoptRef(new LocalStorage(lookupPath));
-        localStorageMap().set(lookupPath, localStorage.get());
-        return localStorage.release();
-    }
-    
-    return it->second;
-}
-
-LocalStorage::LocalStorage(const String& path)
-    : m_path(path.copy())
-{
-    if (!m_path.isEmpty())
-        m_syncManager = StorageSyncManager::create(m_path);
-}
-
-LocalStorage::~LocalStorage()
-{
-    ASSERT(localStorageMap().get(m_path) == this);
-    localStorageMap().remove(m_path);
-}
-
-PassRefPtr<StorageArea> LocalStorage::storageArea(SecurityOrigin* origin)
-{
-    ASSERT(isMainThread());
-
-    // FIXME: If the security origin in question has never had a storage area established,
-    // we need to ask a client call if establishing it is okay.  If the client denies the request,
-    // this method will return null.
-    // The sourceFrame argument exists for the purpose of asking a client.
-    // To know if an area has previously been established, we need to wait until this LocalStorage 
-    // object has finished it's AreaImport task.
-
-    // FIXME: If the storage area is being established for the first time here, we need to 
-    // sync its existance and quota out to disk via an task of type AreaSync
-
-    RefPtr<LocalStorageArea> storageArea;
-    if (storageArea = m_storageAreaMap.get(origin))
-        return storageArea.release();
-
-    storageArea = LocalStorageArea::create(origin, m_syncManager);
-    m_storageAreaMap.set(origin, storageArea);
-    return storageArea.release();
-}
-
-void LocalStorage::close()
-{
-    ASSERT(isMainThread());
-
-    LocalStorageAreaMap::iterator end = m_storageAreaMap.end();
-    for (LocalStorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
-        it->second->scheduleFinalSync();
-    
-    m_syncManager = 0;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index 915639a..f9b8dc2 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -28,13 +28,12 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorage.h"
-#include "LocalStorageArea.h"
 #include "LocalStorageThread.h"
+#include "StorageAreaSync.h"
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageArea> area)
+LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
     : m_type(type)
     , m_area(area)
 {
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
index eb2cbcc..2c397da 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.h
@@ -34,25 +34,26 @@
 
 namespace WebCore {
 
-    class LocalStorageArea;
+    class StorageAreaSync;
     class LocalStorageThread;
 
+    // FIXME: Rename this class to StorageTask
     class LocalStorageTask : public ThreadSafeShared<LocalStorageTask> {
     public:
         enum Type { AreaImport, AreaSync, TerminateThread };
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<LocalStorageArea> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<LocalStorageArea> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
         static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<LocalStorageArea>);
+        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
         LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
 
         Type m_type;
-        RefPtr<LocalStorageArea> m_area;
+        RefPtr<StorageAreaSync> m_area;
         RefPtr<LocalStorageThread> m_thread;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index 60cc9fa..2da5934 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -28,9 +28,8 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorage.h"
-#include "LocalStorageArea.h"
 #include "LocalStorageTask.h"
+#include "StorageAreaSync.h"
 
 namespace WebCore {
 
@@ -87,13 +86,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<LocalStorageArea> area)
+void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<LocalStorageArea> area)
+void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
index f11660a..3d58427 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.h
@@ -35,17 +35,18 @@
 
 namespace WebCore {
 
-    class LocalStorageArea;
+    class StorageAreaSync;
     class LocalStorageTask;
 
+    // FIXME: Rename this class to StorageThread
     class LocalStorageThread : public ThreadSafeShared<LocalStorageThread> {
     public:
         static PassRefPtr<LocalStorageThread> create();
 
         bool start();
 
-        void scheduleImport(PassRefPtr<LocalStorageArea>);
-        void scheduleSync(PassRefPtr<LocalStorageArea>);
+        void scheduleImport(PassRefPtr<StorageAreaSync>);
+        void scheduleSync(PassRefPtr<StorageAreaSync>);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
deleted file mode 100644
index c10a1be..0000000
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
- 
-#include "config.h"
-#include "SessionStorage.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "Page.h"
-#include "SecurityOrigin.h"
-#include "StorageArea.h"
-#include "StorageMap.h"
-
-namespace WebCore {
-
-PassRefPtr<SessionStorage> SessionStorage::create(Page* page)
-{
-    return adoptRef(new SessionStorage(page));
-}
-
-SessionStorage::SessionStorage(Page* page)
-    : m_page(page)
-{
-    ASSERT(m_page);
-}
-
-PassRefPtr<SessionStorage> SessionStorage::copy(Page* newPage)
-{
-    ASSERT(newPage);
-    RefPtr<SessionStorage> newSession = SessionStorage::create(newPage);
-    
-    SessionStorageAreaMap::iterator end = m_storageAreaMap.end();
-    for (SessionStorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
-        RefPtr<SessionStorageArea> areaCopy = i->second->copy(i->first.get(), newPage);
-        newSession->m_storageAreaMap.set(i->first, areaCopy.release());
-    }
-    
-    return newSession.release();
-}
-
-PassRefPtr<StorageArea> SessionStorage::storageArea(SecurityOrigin* origin)
-{
-    RefPtr<SessionStorageArea> storageArea;
-    if (storageArea = m_storageAreaMap.get(origin))
-        return storageArea.release();
-        
-    storageArea = SessionStorageArea::create(origin, m_page);
-    m_storageAreaMap.set(origin, storageArea);
-    return storageArea.release();
-}
-
-}
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
deleted file mode 100644
index 7fb6ca8..0000000
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.cpp
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "SessionStorageArea.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "DOMWindow.h"
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "HTMLElement.h"
-#include "Page.h"
-#include "PlatformString.h"
-#include "SecurityOrigin.h"
-#include "StorageEvent.h"
-#include "StorageMap.h"
-
-namespace WebCore {
-
-PassRefPtr<SessionStorageArea> SessionStorageArea::copy(SecurityOrigin* origin, Page* page)
-{
-    return adoptRef(new SessionStorageArea(origin, page, this));
-}
-
-SessionStorageArea::SessionStorageArea(SecurityOrigin* origin, Page* page)
-    : StorageArea(origin)
-    , m_page(page)
-{
-    ASSERT(page);
-}
-
-SessionStorageArea::SessionStorageArea(SecurityOrigin* origin, Page* page, SessionStorageArea* area)
-    : StorageArea(origin, area)
-    , m_page(page)
-{
-    ASSERT(page);
-}
-
-void SessionStorageArea::itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    dispatchStorageEvent(key, oldValue, newValue, sourceFrame);
-}
-
-void SessionStorageArea::itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame)
-{
-    dispatchStorageEvent(key, oldValue, String(), sourceFrame);
-}
-
-void SessionStorageArea::areaCleared(Frame* sourceFrame)
-{
-    dispatchStorageEvent(String(), String(), String(), sourceFrame);
-}
-
-void SessionStorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    // For SessionStorage events, each frame in the page's frametree with the same origin as this StorageArea needs to be notified of the change
-    Vector<RefPtr<Frame> > frames;
-    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-        if (frame->document()->securityOrigin()->equal(securityOrigin()))
-            frames.append(frame);
-    }
-
-    for (unsigned i = 0; i < frames.size(); ++i)
-        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
index 97bfd9f..ac41447 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
@@ -28,39 +28,74 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "CString.h"
+#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "StorageEvent.h"
+#include "StorageAreaSync.h"
 #include "StorageMap.h"
+#include "StorageSyncManager.h"
 
 namespace WebCore {
 
-StorageArea::StorageArea(SecurityOrigin* origin)
-    : m_securityOrigin(origin)
+PassRefPtr<StorageArea> StorageArea::create(StorageType storageType, SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+{
+    return adoptRef(new StorageArea(storageType, origin, syncManager));
+}
+
+StorageArea::StorageArea(StorageType storageType, SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+    : m_storageType(storageType)
+    , m_securityOrigin(origin)
     , m_storageMap(StorageMap::create())
+    , m_storageSyncManager(syncManager)
+#ifndef NDEBUG
+    , m_isShutdown(false)
+#endif
 {
+    ASSERT(m_securityOrigin);
+    ASSERT(m_storageMap);
+
+    // FIXME: If there's no backing storage for LocalStorage, the default WebKit behavior should be that of private browsing,
+    // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
+    if (m_storageSyncManager) {
+        m_storageAreaSync = StorageAreaSync::create(m_storageSyncManager, this);
+        ASSERT(m_storageAreaSync);
+    }
 }
 
-StorageArea::StorageArea(SecurityOrigin* origin, StorageArea* area)
-    : m_securityOrigin(origin)
-    , m_storageMap(area->m_storageMap)
+PassRefPtr<StorageArea> StorageArea::copy(SecurityOrigin* origin)
 {
+    ASSERT(!m_isShutdown);
+    return adoptRef(new StorageArea(origin, this));
 }
 
-StorageArea::~StorageArea()
+StorageArea::StorageArea(SecurityOrigin* origin, StorageArea* area)
+    : m_storageType(area->m_storageType)
+    , m_securityOrigin(origin)
+    , m_storageMap(area->m_storageMap)
+    , m_storageSyncManager(area->m_storageSyncManager)
+#ifndef NDEBUG
+    , m_isShutdown(area->m_isShutdown)
+#endif
 {
+    ASSERT(m_securityOrigin);
+    ASSERT(m_storageMap);
+    ASSERT(!m_isShutdown);
 }
 
 unsigned StorageArea::length() const
 {
+    ASSERT(!m_isShutdown);
     return m_storageMap->length();
 }
 
 String StorageArea::key(unsigned index, ExceptionCode& ec) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     String key;
@@ -75,6 +110,7 @@ String StorageArea::key(unsigned index, ExceptionCode& ec) const
 
 String StorageArea::getItem(const String& key) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     return m_storageMap->getItem(key);
@@ -82,6 +118,7 @@ String StorageArea::getItem(const String& key) const
 
 void StorageArea::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     ASSERT(!value.isNull());
     blockUntilImportComplete();
     
@@ -104,12 +141,16 @@ void StorageArea::setItem(const String& key, const String& value, ExceptionCode&
         m_storageMap = newMap.release();
 
     // Only notify the client if an item was actually changed
-    if (oldValue != value)
-        itemChanged(key, oldValue, value, frame);
+    if (oldValue != value) {
+        if (m_storageAreaSync)
+            m_storageAreaSync->scheduleItemForSync(key, value);
+        dispatchStorageEvent(key, oldValue, value, frame);
+    }
 }
 
 void StorageArea::removeItem(const String& key, Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     if (frame->page()->settings()->privateBrowsingEnabled())
@@ -121,12 +162,16 @@ void StorageArea::removeItem(const String& key, Frame* frame)
         m_storageMap = newMap.release();
 
     // Only notify the client if an item was actually removed
-    if (!oldValue.isNull())
-        itemRemoved(key, oldValue, frame);
+    if (!oldValue.isNull()) {
+        if (m_storageAreaSync)
+            m_storageAreaSync->scheduleItemForSync(key, String());
+        dispatchStorageEvent(key, oldValue, String(), frame);
+    }
 }
 
 void StorageArea::clear(Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     if (frame->page()->settings()->privateBrowsingEnabled())
@@ -134,11 +179,14 @@ void StorageArea::clear(Frame* frame)
     
     m_storageMap = StorageMap::create();
     
-    areaCleared(frame);
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleClear();
+    dispatchStorageEvent(String(), String(), String(), frame);
 }
 
 bool StorageArea::contains(const String& key) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     return m_storageMap->contains(key);
@@ -146,9 +194,62 @@ bool StorageArea::contains(const String& key) const
 
 void StorageArea::importItem(const String& key, const String& value)
 {
+    ASSERT(!m_isShutdown);
     m_storageMap->importItem(key, value);
 }
 
+void StorageArea::close()
+{
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleFinalSync();
+
+#ifndef NDEBUG
+    m_isShutdown = true;
+#endif
+}
+
+void StorageArea::blockUntilImportComplete() const
+{
+    if (m_storageAreaSync)
+        m_storageAreaSync->blockUntilImportComplete();
+}
+
+void StorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
+{
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+
+    // FIXME: When can this occur?
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    if (m_storageType == SessionStorage) {
+        // Send events only to our page.
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin()))
+                frames.append(frame);
+        }
+        
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin()))
+                    frames.append(frame);
+            }
+        }
+        
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
+    }        
+}
+
 }
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index d8e1913..69e7882 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -29,6 +29,10 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "PlatformString.h"
+#include "SecurityOrigin.h"
+#include "StorageAreaSync.h"
+#include "StorageMap.h"
+#include "StorageSyncManager.h"
 
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
@@ -38,14 +42,19 @@
 namespace WebCore {
 
     class Frame;
+    class Page;
     class SecurityOrigin;
+    class StorageAreaSync;
     class StorageMap;
+    class StorageSyncManager;
     typedef int ExceptionCode;
+    enum StorageType { LocalStorage, SessionStorage };
 
-    class StorageArea : public RefCounted<StorageArea> {
+    class StorageArea : public ThreadSafeShared<StorageArea> {
     public:
-        virtual ~StorageArea();
-        
+        static PassRefPtr<StorageArea> create(StorageType, SecurityOrigin*, PassRefPtr<StorageSyncManager>);
+        PassRefPtr<StorageArea> copy(SecurityOrigin*);
+
         // The HTML5 DOM Storage API
         unsigned length() const;
         String key(unsigned index, ExceptionCode& ec) const;
@@ -55,24 +64,31 @@ namespace WebCore {
         void clear(Frame* sourceFrame);
 
         bool contains(const String& key) const;
+        void close();
 
+        // Could be called from a background thread.
+        void importItem(const String& key, const String& value);
         SecurityOrigin* securityOrigin() { return m_securityOrigin.get(); }
 
     protected:
-        StorageArea(SecurityOrigin*);
+        StorageArea(StorageType, SecurityOrigin*, PassRefPtr<StorageSyncManager>);
         StorageArea(SecurityOrigin*, StorageArea*);
-                
-        // This is meant to be called from a background thread for LocalStorageArea's background thread import procedure.
-        void importItem(const String& key, const String& value);
 
     private:
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame) = 0;
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame) = 0;
-        virtual void areaCleared(Frame* sourceFrame) = 0;
-        virtual void blockUntilImportComplete() const { }
+        void blockUntilImportComplete() const;
 
+        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
+
+        StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
+
+        RefPtr<StorageAreaSync> m_storageAreaSync;
+        RefPtr<StorageSyncManager> m_storageSyncManager;
+
+#ifndef NDEBUG
+        bool m_isShutdown;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 1c612a0..2cef56d 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -24,53 +24,60 @@
  */
 
 #include "config.h"
-#include "LocalStorageArea.h"
+#include "StorageAreaSync.h"
 
 #if ENABLE(DOM_STORAGE)
 
 #include "CString.h"
-#include "DOMWindow.h"
 #include "EventNames.h"
-#include "Frame.h"
 #include "HTMLElement.h"
-#include "LocalStorage.h"
-#include "Page.h"
-#include "PageGroup.h"
 #include "SQLiteStatement.h"
-#include "StorageEvent.h"
+#include "StorageArea.h"
 #include "SuddenTermination.h"
 
 namespace WebCore {
 
-// If the LocalStorageArea undergoes rapid changes, don't sync each change to disk.
+// If the StorageArea undergoes rapid changes, don't sync each change to disk.
 // Instead, queue up a batch of items to sync and actually do the sync at the following interval.
-static const double LocalStorageSyncInterval = 1.0;
+static const double StorageSyncInterval = 1.0;
 
-LocalStorageArea::LocalStorageArea(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
-    : StorageArea(origin)
-    , m_syncTimer(this, &LocalStorageArea::syncTimerFired)
+PassRefPtr<StorageAreaSync> StorageAreaSync::create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea)
+{
+    return adoptRef(new StorageAreaSync(storageSyncManager, storageArea));
+}
+
+StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea)
+    : m_syncTimer(this, &StorageAreaSync::syncTimerFired)
     , m_itemsCleared(false)
     , m_finalSyncScheduled(false)
-    , m_syncManager(syncManager)
+    , m_storageArea(storageArea)
+    , m_syncManager(storageSyncManager)
     , m_clearItemsWhileSyncing(false)
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
-    if (!m_syncManager || !m_syncManager->scheduleImport(this))
+    ASSERT(m_storageArea);
+    ASSERT(m_syncManager);
+
+    // FIXME: If it can't import, then the default WebKit behavior should be that of private browsing,
+    // not silently ignoring it.  https://bugs.webkit.org/show_bug.cgi?id=25894
+    if (!m_syncManager->scheduleImport(this))
         m_importComplete = true;
 }
 
-LocalStorageArea::~LocalStorageArea()
+#ifndef NDEBUG
+StorageAreaSync::~StorageAreaSync()
 {
     ASSERT(!m_syncTimer.isActive());
 }
+#endif
 
-void LocalStorageArea::scheduleFinalSync()
+void StorageAreaSync::scheduleFinalSync()
 {
     ASSERT(isMainThread());
-    if (!m_syncManager)
-        return;
-
+    // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
+    blockUntilImportComplete();
+    
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
     else {
@@ -78,67 +85,20 @@ void LocalStorageArea::scheduleFinalSync()
         // syncTimerFired function.
         disableSuddenTermination();
     }
+    // FIXME: This is synchronous.  We should do it on the background process, but
+    // we should do it safely.
     syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
 }
 
-void LocalStorageArea::itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleItemForSync(key, newValue);
-    dispatchStorageEvent(key, oldValue, newValue, sourceFrame);
-}
-
-void LocalStorageArea::itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleItemForSync(key, String());
-    dispatchStorageEvent(key, oldValue, String(), sourceFrame);
-}
-
-void LocalStorageArea::areaCleared(Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), sourceFrame);
-}
-
-void LocalStorageArea::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-    ASSERT(isMainThread());
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // Need to copy all relevant frames from every page to a vector, since sending the event to one frame might mutate the frame tree
-    // of any given page in the group, or mutate the page group itself
-    Vector<RefPtr<Frame> > frames;
-    const HashSet<Page*>& pages = page->group().pages();
-    
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-    }
-
-    for (unsigned i = 0; i < frames.size(); ++i)
-        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-}
-
-void LocalStorageArea::scheduleItemForSync(const String& key, const String& value)
+void StorageAreaSync::scheduleItemForSync(const String& key, const String& value)
 {
     ASSERT(isMainThread());
     ASSERT(!m_finalSyncScheduled);
 
     m_changedItems.set(key, value);
     if (!m_syncTimer.isActive()) {
-        m_syncTimer.startOneShot(LocalStorageSyncInterval);
+        m_syncTimer.startOneShot(StorageSyncInterval);
 
         // The following is balanced by the call to enableSuddenTermination in the
         // syncTimerFired function.
@@ -146,7 +106,7 @@ void LocalStorageArea::scheduleItemForSync(const String& key, const String& valu
     }
 }
 
-void LocalStorageArea::scheduleClear()
+void StorageAreaSync::scheduleClear()
 {
     ASSERT(isMainThread());
     ASSERT(!m_finalSyncScheduled);
@@ -154,7 +114,7 @@ void LocalStorageArea::scheduleClear()
     m_changedItems.clear();
     m_itemsCleared = true;
     if (!m_syncTimer.isActive()) {
-        m_syncTimer.startOneShot(LocalStorageSyncInterval);
+        m_syncTimer.startOneShot(StorageSyncInterval);
 
         // The following is balanced by the call to enableSuddenTermination in the
         // syncTimerFired function.
@@ -162,11 +122,9 @@ void LocalStorageArea::scheduleClear()
     }
 }
 
-void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
+void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 {
     ASSERT(isMainThread());
-    if (!m_syncManager)
-        return;
 
     HashMap<String, String>::iterator it = m_changedItems.begin();
     HashMap<String, String>::iterator end = m_changedItems.end();
@@ -201,14 +159,12 @@ void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
     m_changedItems.clear();
 }
 
-void LocalStorageArea::performImport()
+void StorageAreaSync::performImport()
 {
     ASSERT(!isMainThread());
     ASSERT(!m_database.isOpen());
-    if (!m_syncManager)
-        return;
 
-    String databaseFilename = m_syncManager->fullDatabaseFilename(securityOrigin());
+    String databaseFilename = m_syncManager->fullDatabaseFilename(m_storageArea->securityOrigin());
 
     if (databaseFilename.isEmpty()) {
         LOG_ERROR("Filename for local storage database is empty - cannot open for persistent storage");
@@ -255,29 +211,33 @@ void LocalStorageArea::performImport()
     HashMap<String, String>::iterator end = itemMap.end();
     
     for (; it != end; ++it)
-        importItem(it->first, it->second);
+        m_storageArea->importItem(it->first, it->second);
     
+    // Break the (ref count) cycle.
+    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
 
-void LocalStorageArea::markImported()
+void StorageAreaSync::markImported()
 {
     ASSERT(!isMainThread());
 
     MutexLocker locker(m_importLock);
+    // Break the (ref count) cycle.
+    m_storageArea = 0;
     m_importComplete = true;
     m_importCondition.signal();
 }
 
-// FIXME: In the future, we should allow use of localStorage while it's importing (when safe to do so).
+// FIXME: In the future, we should allow use of StorageAreas while it's importing (when safe to do so).
 // Blocking everything until the import is complete is by far the simplest and safest thing to do, but
 // there is certainly room for safe optimization: Key/length will never be able to make use of such an
 // optimization (since the order of iteration can change as items are being added). Get can return any
 // item currently in the map. Get/remove can work whether or not it's in the map, but we'll need a list
 // of items the import should not overwrite. Clear can also work, but it'll need to kill the import
 // job first.
-void LocalStorageArea::blockUntilImportComplete() const
+void StorageAreaSync::blockUntilImportComplete() const
 {
     ASSERT(isMainThread());
 
@@ -289,9 +249,10 @@ void LocalStorageArea::blockUntilImportComplete() const
     while (!m_importComplete)
         m_importCondition.wait(m_importLock);
     ASSERT(m_importComplete);
+    ASSERT(!m_storageArea);
 }
 
-void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& items)
+void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items)
 {
     ASSERT(!isMainThread());
 
@@ -347,7 +308,7 @@ void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& item
     }
 }
 
-void LocalStorageArea::performSync()
+void StorageAreaSync::performSync()
 {
     ASSERT(!isMainThread());
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
index 7a385aa..fa10e63 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.h
@@ -23,47 +23,50 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef LocalStorageArea_h
-#define LocalStorageArea_h
+#ifndef StorageAreaSync_h
+#define StorageAreaSync_h
 
 #if ENABLE(DOM_STORAGE)
 
 #include "SQLiteDatabase.h"
-#include "StorageArea.h"
 #include "StringHash.h"
 #include "StorageSyncManager.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 
 namespace WebCore {
-    
+
+    class Frame;
+    class StorageArea;    
     class StorageSyncManager;
     
-    class LocalStorageArea : public StorageArea {
+    class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
-        virtual ~LocalStorageArea();
-
-        static PassRefPtr<LocalStorageArea> create(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager) { return adoptRef(new LocalStorageArea(origin, syncManager)); }
+#ifndef NDEBUG
+        ~StorageAreaSync();
+#endif
 
+        static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea);
+        
         void scheduleFinalSync();
-
-    private:
-        LocalStorageArea(SecurityOrigin*, PassRefPtr<StorageSyncManager> syncManager);
-
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame);
-        virtual void areaCleared(Frame* sourceFrame);
+        void blockUntilImportComplete() const;
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
+        
+    private:
+        StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageArea> storageArea);
+
+        
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
-        Timer<LocalStorageArea> m_syncTimer;        
+        Timer<StorageAreaSync> m_syncTimer;        
         HashMap<String, String> m_changedItems;
         bool m_itemsCleared;
         
         bool m_finalSyncScheduled;
 
+        RefPtr<StorageArea> m_storageArea;
         RefPtr<StorageSyncManager> m_syncManager;
 
         // The database handle will only ever be opened and used on the background thread.
@@ -72,11 +75,11 @@ namespace WebCore {
     // The following members are subject to thread synchronization issues.
     public:
         // Called from the background thread
-        virtual void performImport();
-        virtual void performSync();
+        void performImport();
+        void performSync();
 
     private:
-        void syncTimerFired(Timer<LocalStorageArea>*);
+        void syncTimerFired(Timer<StorageAreaSync>*);
         void sync(bool clearItems, const HashMap<String, String>& items);
 
         Mutex m_syncLock;
@@ -88,11 +91,10 @@ namespace WebCore {
         mutable ThreadCondition m_importCondition;
         mutable bool m_importComplete;
         void markImported();
-        void blockUntilImportComplete() const;
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
 
-#endif // LocalStorageArea_h
+#endif // StorageAreaSync_h
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
new file mode 100644
index 0000000..d8d85a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageNamespace.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<String, StorageNamespace*> LocalStorageNamespaceMap;
+
+static LocalStorageNamespaceMap& localStorageNamespaceMap()
+{
+    DEFINE_STATIC_LOCAL(LocalStorageNamespaceMap, localStorageNamespaceMap, ());
+    return localStorageNamespaceMap;
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+{
+    const String lookupPath = path.isNull() ? String("") : path;
+    LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
+    if (it == localStorageNamespaceMap().end()) {
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespace(LocalStorage, lookupPath));
+        localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
+        return storageNamespace.release();
+    }
+
+    return it->second;
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
+{
+    return adoptRef(new StorageNamespace(SessionStorage, String()));
+}
+
+StorageNamespace::StorageNamespace(StorageType storageType, const String& path)
+    : m_storageType(storageType)
+    , m_path(path.copy())  // FIXME: Is the .copy necessary?
+    , m_syncManager(0)
+#ifndef NDEBUG
+    , m_isShutdown(false)
+#endif
+{
+    if (m_storageType == LocalStorage && !m_path.isEmpty())
+        m_syncManager = StorageSyncManager::create(m_path);
+}
+
+StorageNamespace::~StorageNamespace()
+{
+    ASSERT(isMainThread());
+
+    if (m_storageType == LocalStorage) {
+        ASSERT(localStorageNamespaceMap().get(m_path) == this);
+        localStorageNamespaceMap().remove(m_path);
+    }
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::copy()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    RefPtr<StorageNamespace> newNamespace = adoptRef(new StorageNamespace(m_storageType, m_path));
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
+        RefPtr<StorageArea> areaCopy = i->second->copy(i->first.get());
+        newNamespace->m_storageAreaMap.set(i->first, areaCopy.release());
+    }
+
+    return newNamespace.release();
+}
+
+PassRefPtr<StorageArea> StorageNamespace::storageArea(SecurityOrigin* origin)
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    RefPtr<StorageArea> storageArea;
+    if (storageArea = m_storageAreaMap.get(origin))
+        return storageArea.release();
+
+    storageArea = StorageArea::create(m_storageType, origin, m_syncManager);
+    m_storageAreaMap.set(origin, storageArea);
+    return storageArea.release();
+}
+
+void StorageNamespace::close()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->close();
+
+#ifndef NDEBUG
+    m_isShutdown = true;
+#endif
+}
+
+#endif // ENABLE(DOM_STORAGE)
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
index cc874d7..5621b01 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -20,16 +20,16 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef LocalStorage_h
-#define LocalStorage_h
+#ifndef StorageNamespace_h
+#define StorageNamespace_h
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorageArea.h"
 #include "SecurityOriginHash.h"
+#include "StorageArea.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -39,28 +39,36 @@ namespace WebCore {
     class StorageArea;
     class StorageSyncManager;
 
-    class LocalStorage : public RefCounted<LocalStorage> {
+    class StorageNamespace : public RefCounted<StorageNamespace> {
     public:
-        ~LocalStorage();
+        ~StorageNamespace();
 
-        static PassRefPtr<LocalStorage> localStorage(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
-
+        PassRefPtr<StorageNamespace> copy();
         void close();
 
     private:
-        LocalStorage(const String& path);
+        StorageNamespace(StorageType, const String& path);
+
+        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> StorageAreaMap;
+        StorageAreaMap m_storageAreaMap;
 
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<LocalStorageArea>, SecurityOriginHash> LocalStorageAreaMap;
-        LocalStorageAreaMap m_storageAreaMap;
+        StorageType m_storageType;
 
+        // Only used if m_storageType == LocalStorage and the path was not "" in our constructor.
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
+
+#ifndef NDEBUG
+        bool m_isShutdown;
+#endif
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
 
-#endif // LocalStorage_h
+#endif // StorageNamespace_h
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
index b2067bc..5dab7a6 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.cpp
@@ -35,7 +35,7 @@
 #include "FrameTree.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "StorageArea.h"
+#include "StorageAreaSync.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -74,7 +74,7 @@ void StorageSyncManager::close()
     }
 }
 
-bool StorageSyncManager::scheduleImport(PassRefPtr<LocalStorageArea> area)
+bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
 
@@ -84,7 +84,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<LocalStorageArea> area)
     return m_thread;
 }
 
-void StorageSyncManager::scheduleSync(PassRefPtr<LocalStorageArea> area)
+void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
 {
     ASSERT(isMainThread());
 
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
index 28370aa..83353ed 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageSyncManager.h
@@ -28,9 +28,10 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorageArea.h"
 #include "LocalStorageTask.h"
 #include "LocalStorageThread.h"
+#include "StorageArea.h"
+#include "StorageAreaSync.h"
 
 #include <wtf/Threading.h>
 
@@ -40,8 +41,8 @@ namespace WebCore {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
 
-        bool scheduleImport(PassRefPtr<LocalStorageArea>);
-        void scheduleSync(PassRefPtr<LocalStorageArea>);
+        bool scheduleImport(PassRefPtr<StorageAreaSync>);
+        void scheduleSync(PassRefPtr<StorageAreaSync>);
 
         void close();
 
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
index 725711d..334a6eb 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
+++ b/src/3rdparty/webkit/WebCore/svg/SVGAnimatedProperty.h
@@ -435,7 +435,7 @@ namespace WebCore {
         if (old && value.isNull()) 
             namedAttrMap->removeAttribute(old->name()); 
         else if (!old && !value.isNull()) 
-            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(QualifiedName(nullAtom, attributeName.localName(), nullAtom), value)); 
+            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
         else if (old && !value.isNull()) 
             old->setValue(value); 
     }
diff --git a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
index 9aff93d..a5684a2 100644
--- a/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/SVGImageElement.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
+                  2004, 2005, 2006, 2007, 2008, 2009 Rob Buis <buis@kde.org>
                   2006 Alexander Kellett <lypanov@kde.org>
 
     This file is part of the KDE project
@@ -93,23 +93,20 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    if (SVGURIReference::isKnownAttribute(attrName))
+        m_imageLoader.updateFromElementIgnoringPreviousError();
+
     if (!renderer())
         return;
 
-    bool isURIAttribute = SVGURIReference::isKnownAttribute(attrName);
-
     if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
         attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
         attrName == SVGNames::preserveAspectRatioAttr ||
         SVGTests::isKnownAttribute(attrName) ||
         SVGLangSpace::isKnownAttribute(attrName) ||
         SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        isURIAttribute ||
         SVGStyledTransformableElement::isKnownAttribute(attrName)) {
         renderer()->setNeedsLayout(true);
-
-        if (isURIAttribute)
-            m_imageLoader.updateFromElementIgnoringPreviousError();
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index 2157144..227b570 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -95,7 +95,7 @@ SVGImage::~SVGImage()
     }
 
     // Verify that page teardown destroyed the Chrome
-    ASSERT(!m_chromeClient->image());
+    ASSERT(!m_chromeClient || !m_chromeClient->image());
 }
 
 void SVGImage::setContainerSize(const IntSize& containerSize)
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
index 300cbf6..aac99db 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLAnchorElement.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 
 WMLAnchorElement::WMLAnchorElement(const QualifiedName& tagName, Document* doc)
     : WMLAElement(tagName, doc)
+    , m_task(0)
 {
     // Calling setIsLink(true), and returning a non-null value on CSSStyleSelectors' linkAttribute
     // method, makes it possible to 'appear as link' (just like <a href="..">) without the need to
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
index c8e92af..3713c59 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.cpp
@@ -206,6 +206,11 @@ void WMLCardElement::handleDeckLevelTaskOverridesIfNeeded()
         (*it)->setActive(!cardDoElementNames.contains((*it)->name()));
 }
 
+String WMLCardElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 void WMLCardElement::parseMappedAttribute(MappedAttribute* attr)
 {
     WMLIntrinsicEventType eventType = WMLIntrinsicEventUnknown;
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
index 972961e..e033e3d 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLCardElement.h
@@ -47,6 +47,7 @@ public:
     void handleIntrinsicEventIfNeeded();
     void handleDeckLevelTaskOverridesIfNeeded();
 
+    virtual String title() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
index 916bc6e..f553fff 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.cpp
@@ -98,8 +98,6 @@ void WMLDoElement::parseMappedAttribute(MappedAttribute* attr)
         m_type = parseValueForbiddingVariableReferences(attr->value());
     else if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::labelAttr)
-        m_label = parseValueSubstitutingVariableReferences(attr->value());
     else if (attr->name() == optionalAttr)
         m_isOptional = (attr->value() == "true");
     else
@@ -145,6 +143,11 @@ void WMLDoElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+String WMLDoElement::label() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::labelAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
index 98e97cc..51e37c4 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLDoElement.h
@@ -42,7 +42,7 @@ public:
     void registerTask(WMLTaskElement* task) { m_task = task; }
 
     bool isActive() const { return m_isActive; }
-    String label() const { return m_label; }
+    String label() const;
     String name() const { return m_name; }
 
     void setActive(bool active) { m_isActive = active; }
@@ -53,7 +53,6 @@ private:
     bool m_isActive;
     bool m_isNoop;
     bool m_isOptional;
-    String m_label;
     String m_name;
     String m_type;
 };
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
index e818f9d..f59a3a1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.cpp
@@ -87,7 +87,7 @@ RenderObject* WMLElement::createRenderer(RenderArena*, RenderStyle* style)
     return RenderObject::createObject(this, style);
 }
 
-String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode)
+String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString& value, WMLErrorCode defaultErrorCode) const
 {
     bool isValid = false;
     if (!containsVariableReference(value, isValid))
@@ -101,7 +101,7 @@ String WMLElement::parseValueSubstitutingVariableReferences(const AtomicString&
     return substituteVariableReferences(value, document());
 }
 
-String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value)
+String WMLElement::parseValueForbiddingVariableReferences(const AtomicString& value) const
 {
     bool isValid = false;
     if (containsVariableReference(value, isValid)) {
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLElement.h b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
index 61bd98f..04e28d0 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLElement.h
@@ -42,8 +42,8 @@ public:
 
 protected:
     // Helper function for derived classes
-    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference);
-    String parseValueForbiddingVariableReferences(const AtomicString&);
+    String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
+    String parseValueForbiddingVariableReferences(const AtomicString&) const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
index 8146375..c0b4bc5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.cpp
@@ -43,19 +43,12 @@ WMLFieldSetElement::~WMLFieldSetElement()
 {
 }
 
-void WMLFieldSetElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::titleAttr)
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLFieldSetElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    if (m_title.isEmpty())
+    String title = parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+    if (title.isEmpty())
         return;
 
     m_insertedLegendElement = WMLElementFactory::createWMLElement(insertedLegendTag, document());
@@ -67,7 +60,7 @@ void WMLFieldSetElement::insertedIntoDocument()
     ASSERT(ec == 0);
 
     // Create text node holding the 'title' attribute value
-    m_insertedLegendElement->appendChild(document()->createTextNode(m_title), ec);
+    m_insertedLegendElement->appendChild(document()->createTextNode(title), ec);
     ASSERT(ec == 0);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
index 2043364..1087fa1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLFieldSetElement.h
@@ -31,14 +31,12 @@ public:
     WMLFieldSetElement(const QualifiedName& tagName, Document*);
     virtual ~WMLFieldSetElement();
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 private:
-    String m_title;
     RefPtr<WMLElement> m_insertedLegendElement;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
index d70731c..3614c6c 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.cpp
@@ -44,6 +44,11 @@ WMLOptGroupElement::~WMLOptGroupElement()
 {
 }
 
+String WMLOptGroupElement::title() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::titleAttr));
+}
+
 const AtomicString& WMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
@@ -120,11 +125,6 @@ void WMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChang
 
 void WMLOptGroupElement::parseMappedAttribute(MappedAttribute* attr)
 {
-    if (attr->name() == HTMLNames::titleAttr) {
-        m_title = parseValueSubstitutingVariableReferences(attr->value());
-        return;
-    }
-
     WMLFormControlElement::parseMappedAttribute(attr);
     recalcSelectOptions();
 }
@@ -154,7 +154,7 @@ RenderStyle* WMLOptGroupElement::nonRendererRenderStyle() const
 
 String WMLOptGroupElement::groupLabelText() const
 {
-    String itemText = document()->displayStringModifiedByEncoding(m_title);
+    String itemText = document()->displayStringModifiedByEncoding(title());
 
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     itemText = itemText.stripWhiteSpace();
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
index 1ba5ac1..0460056 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLOptGroupElement.h
@@ -32,7 +32,7 @@ public:
     WMLOptGroupElement(const QualifiedName& tagName, Document*);
     virtual ~WMLOptGroupElement();
 
-    String title() const { return m_title; }
+    String title() const;
 
     virtual const AtomicString& formControlType() const;
 
@@ -59,7 +59,6 @@ private:
     void recalcSelectOptions();
 
 private:
-    String m_title;
     RefPtr<RenderStyle> m_style;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
index 69f61f5..7d001e1 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.cpp
@@ -26,7 +26,6 @@
 #include "CString.h"
 #include "TextEncoding.h"
 #include "HTMLNames.h"
-#include "MappedAttribute.h"
 #include "WMLDocument.h"
 #include "WMLGoElement.h"
 #include "WMLNames.h"
@@ -40,16 +39,6 @@ WMLPostfieldElement::WMLPostfieldElement(const QualifiedName& tagName, Document*
 {
 }
 
-void WMLPostfieldElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    if (attr->name() == HTMLNames::nameAttr)
-        m_name = parseValueSubstitutingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
-        WMLElement::parseMappedAttribute(attr);
-}
-
 void WMLPostfieldElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
@@ -63,6 +52,16 @@ void WMLPostfieldElement::insertedIntoDocument()
     static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
 }
 
+String WMLPostfieldElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr));
+}
+
+String WMLPostfieldElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 static inline CString encodedString(const TextEncoding& encoding, const String& data)
 {
     return encoding.encode(data.characters(), data.length(), EntitiesForUnencodables);
@@ -70,8 +69,8 @@ static inline CString encodedString(const TextEncoding& encoding, const String&
 
 void WMLPostfieldElement::encodeData(const TextEncoding& encoding, CString& name, CString& value)
 {
-    name = encodedString(encoding, m_name);
-    value = encodedString(encoding, m_value);
+    name = encodedString(encoding, this->name());
+    value = encodedString(encoding, this->value());
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
index 59b7f64..945e6d3 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLPostfieldElement.h
@@ -30,18 +30,13 @@ class WMLPostfieldElement : public WMLElement {
 public:
     WMLPostfieldElement(const QualifiedName& tagName, Document*);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
+    String name() const;
+    String value() const;
 
     // Encode name() and value() in a CString using the passed encoding
     void encodeData(const TextEncoding&, CString& name, CString& value);
-
-private:
-    String m_name;
-    String m_value;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
index da9a1f4..f0c50cc 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.cpp
@@ -43,16 +43,11 @@ WMLSetvarElement::~WMLSetvarElement()
 void WMLSetvarElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr) {
-        String name = parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName);
-        if (!isValidVariableName(name)) {
+        if (!isValidVariableName(parseValueSubstitutingVariableReferences(attr->value(), WMLErrorInvalidVariableName))) {
             reportWMLError(document(), WMLErrorInvalidVariableName);
             return;
         }
-
-        m_name = name;
-    } else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
-    else
+    } else
         WMLElement::parseMappedAttribute(attr);
 }
 
@@ -70,6 +65,16 @@ void WMLSetvarElement::insertedIntoDocument()
         static_cast<WMLTaskElement*>(parent)->registerVariableSetter(this);
 }
 
+String WMLSetvarElement::name() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::nameAttr), WMLErrorInvalidVariableName);
+}
+
+String WMLSetvarElement::value() const
+{
+   return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
index ebedbc8..12400a5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLSetvarElement.h
@@ -34,12 +34,8 @@ public:
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void insertedIntoDocument();
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
-
-private:
-    String m_name;
-    String m_value;
+    String name() const;
+    String value() const;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
index 00c7036..a41daf5 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.cpp
@@ -46,8 +46,6 @@ void WMLTimerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == HTMLNames::nameAttr)
         m_name = parseValueForbiddingVariableReferences(attr->value());
-    else if (attr->name() == HTMLNames::valueAttr)
-        m_value = parseValueSubstitutingVariableReferences(attr->value());
     else
         WMLElement::parseMappedAttribute(attr);
 }
@@ -57,7 +55,7 @@ void WMLTimerElement::insertedIntoDocument()
     WMLElement::insertedIntoDocument();
 
     // If the value of timeout is not a positive integer, ignore it
-    if (m_value.toInt() <= 0)
+    if (value().toInt() <= 0)
         return;
 
     Node* parent = parentNode();
@@ -81,10 +79,12 @@ void WMLTimerElement::timerFired(Timer<WMLTimerElement>*)
     if (!pageState)
         return;
 
+    String value = this->value();
+
     // When the timer expires, set the name varialbe of timer to '0'
     if (!m_name.isEmpty()) {
-        m_value = "0";
-        pageState->storeVariable(m_name, m_value);
+        value = "0";
+        pageState->storeVariable(m_name, value);
     }
 
     WMLIntrinsicEventType eventType = WMLIntrinsicEventOnTimer;
@@ -114,7 +114,7 @@ void WMLTimerElement::start(int interval)
     }
 
     if (interval <= 0)
-        interval = m_value.toInt();
+        interval = value().toInt();
 
     if (interval > 0)
         m_timer.startOneShot(interval / 10.0f);
@@ -137,6 +137,11 @@ void WMLTimerElement::storeIntervalToPageState()
         pageState->storeVariable(m_name, String::number(interval));
 }
 
+String WMLTimerElement::value() const
+{
+    return parseValueSubstitutingVariableReferences(getAttribute(HTMLNames::valueAttr));
+}
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
index eecacf3..b367eb9 100644
--- a/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
+++ b/src/3rdparty/webkit/WebCore/wml/WMLTimerElement.h
@@ -42,10 +42,11 @@ public:
     void stop();
     void storeIntervalToPageState();
 
+    String value() const;
+
 private:
     WMLCardElement* m_card;
     String m_name;
-    String m_value;
     Timer<WMLTimerElement> m_timer;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
index 1f1d985..da39443 100644
--- a/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/xml/XPathFunctions.cpp
@@ -667,12 +667,12 @@ Value FunRound::evaluate() const
     return round(arg(0)->evaluate().toNumber());
 }
 
-struct FunctionMapping {
-    const char *name;
-    FunctionRec function;
-};
 static void createFunctionMap()
 {
+    struct FunctionMapping {
+        const char *name;
+        FunctionRec function;
+    };
     static const FunctionMapping functions[] = {
         { "boolean", { &createFunBoolean, 1 } },
         { "ceiling", { &createFunCeiling, 1 } },
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
index 07d027d..7cdc00e 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.cpp
@@ -28,6 +28,7 @@
 #include "PageGroup.h"
 
 #include <QSharedData>
+#include <QDebug>
 
 /*!
   \class QWebHistoryItem
@@ -213,6 +214,8 @@ bool QWebHistoryItem::isValid() const
   number of items is given by count(), and the history can be cleared with the
   clear() function.
 
+  QWebHistory's state can be saved with saveState() and loaded with restoreState().
+
   \sa QWebHistoryItem, QWebHistoryInterface, QWebPage
 */
 
@@ -405,9 +408,13 @@ int QWebHistory::currentItemIndex() const
 */
 QWebHistoryItem QWebHistory::itemAt(int i) const
 {
-    WebCore::HistoryItem *item = d->lst->itemAtIndex(i);
-
-    QWebHistoryItemPrivate *priv = new QWebHistoryItemPrivate(item);
+    QWebHistoryItemPrivate *priv;
+    if (i < 0 || i >= count())
+        priv = new QWebHistoryItemPrivate(0);
+    else {
+        WebCore::HistoryItem *item = d->lst->entries()[i].get();
+        priv = new QWebHistoryItemPrivate(item);
+    }
     return QWebHistoryItem(priv);
 }
 
@@ -441,3 +448,129 @@ void QWebHistory::setMaximumItemCount(int count)
     d->lst->setCapacity(count);
 }
 
+/*!
+   \enum QWebHistory::HistoryStateVersion
+
+   This enum describes the versions available for QWebHistory's saveState() function:
+
+   \value HistoryVersion_1 Version 1 (Qt 4.6)
+   \value DefaultHistoryVersion The current default version in 1.
+*/
+
+/*!
+  \since 4.6
+
+  Restores the state of QWebHistory from the given \a buffer. Returns true
+  if the history was successfully restored; otherwise returns false.
+
+  \sa saveState()
+*/
+bool QWebHistory::restoreState(const QByteArray& buffer)
+{
+    QDataStream stream(buffer);
+    int version;
+    bool result = false;
+    stream >> version;
+
+    switch (version) {
+    case HistoryVersion_1: {
+        int count;
+        int currentIndex;
+        stream >> count >> currentIndex;
+
+        clear();
+        // only if there are elements
+        if (count) {
+            // after clear() is new clear HistoryItem (at the end we had to remove it)
+            WebCore::HistoryItem *nullItem = d->lst->currentItem();
+            for (int i = 0;i < count;i++) {
+                WTF::PassRefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create();
+                item->restoreState(stream, version);
+                d->lst->addItem(item);
+            }
+            d->lst->removeItem(nullItem);
+            goToItem(itemAt(currentIndex));
+            result = stream.status() == QDataStream::Ok;
+        }
+        break;
+    }
+    default: {} // result is false;
+    }
+
+    return result;
+};
+
+/*!
+  \since 4.6
+  Saves the state of this QWebHistory into a QByteArray.
+
+  Saves the current state of this QWebHistory. The version number, \a version, is
+  stored as part of the data.
+
+  To restore the saved state, pass the return value to restoreState().
+
+  \sa restoreState()
+*/
+QByteArray QWebHistory::saveState(HistoryStateVersion version) const
+{
+    QByteArray buffer;
+    QDataStream stream(&buffer, QIODevice::WriteOnly);
+    stream << version;
+
+    switch (version) {
+    case HistoryVersion_1: {
+        stream << count() << currentItemIndex();
+
+        const WebCore::HistoryItemVector &items = d->lst->entries();
+        for (int i = 0; i < items.size(); i++)
+            items[i].get()->saveState(stream, version);
+
+        if (stream.status() != QDataStream::Ok)
+            buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
+        break;
+    }
+    default:
+        buffer.clear();
+
+    }
+
+    return buffer;
+}
+
+/*!
+  \since 4.6
+  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+  \relates QWebHistory
+
+  Saves the given \a history into the specified \a stream. This is a convenience function
+  and is equivalent to calling the saveState() method.
+
+  \sa QWebHistory::saveState()
+*/
+
+QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+{
+    return stream << history.saveState();
+}
+
+/*!
+  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+  \relates QWebHistory
+  \since 4.6
+
+  Loads a QWebHistory from the specified \a stream into the given \a history.
+  This is a convenience function and it is equivalent to calling the restoreState()
+  method.
+
+  \sa QWebHistory::restoreState()
+*/
+
+QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+{
+    QByteArray buffer;
+    stream >> buffer;
+    history.restoreState(buffer);
+    return stream;
+}
+
+
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
index c39077d..1a048f4 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory.h
@@ -42,6 +42,9 @@ public:
     QWebHistoryItem &operator=(const QWebHistoryItem &other);
     ~QWebHistoryItem();
 
+    //bool restoreState(QByteArray& buffer);
+    //QByteArray saveState(QWebHistory::HistoryStateVersion version = DefaultHistoryVersion) const;
+
     QUrl originalUrl() const;
     QUrl url() const;
 
@@ -60,13 +63,29 @@ private:
     friend class QWebHistory;
     friend class QWebPage;
     friend class WebCore::FrameLoaderClientQt;
+    friend class QWebHistoryItemPrivate;
+    //friend QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
+    //friend QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
     QExplicitlySharedDataPointer<QWebHistoryItemPrivate> d;
 };
 
+//QWEBKIT_EXPORT QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
+//QWEBKIT_EXPORT QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
+
+
 class QWebHistoryPrivate;
 class QWEBKIT_EXPORT QWebHistory
 {
 public:
+    enum HistoryStateVersion {
+        HistoryVersion_1,
+        /*, HistoryVersion_2, */
+        DefaultHistoryVersion = HistoryVersion_1
+    };
+    
+    bool restoreState(const QByteArray& buffer);
+    QByteArray saveState(HistoryStateVersion version = DefaultHistoryVersion) const;
+    
     void clear();
 
     QList<QWebHistoryItem> items() const;
@@ -98,10 +117,15 @@ private:
 
     friend class QWebPage;
     friend class QWebPagePrivate;
+    friend QWEBKIT_EXPORT QDataStream& operator>>(QDataStream&, QWebHistory&);
+    friend QWEBKIT_EXPORT QDataStream& operator<<(QDataStream&, const QWebHistory&);
 
     Q_DISABLE_COPY(QWebHistory)
 
     QWebHistoryPrivate *d;
 };
 
+QWEBKIT_EXPORT QDataStream& operator<<(QDataStream& stream, const QWebHistory& history);
+QWEBKIT_EXPORT QDataStream& operator>>(QDataStream& stream, QWebHistory& history);
+
 #endif
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
index 32e69fe..4bee62b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebhistory_p.h
@@ -22,10 +22,16 @@
 
 #include "BackForwardList.h"
 #include "HistoryItem.h"
+#include <QtCore/qglobal.h>
+#include <QtCore/qshareddata.h>
 
-class QWebHistoryItemPrivate : public QSharedData
+class Q_AUTOTEST_EXPORT QWebHistoryItemPrivate : public QSharedData
 {
 public:
+    static QExplicitlySharedDataPointer<QWebHistoryItemPrivate> get(QWebHistoryItem *q)
+    {
+        return q->d;
+    }
     QWebHistoryItemPrivate(WebCore::HistoryItem *i)
     {
         if (i)
@@ -37,6 +43,25 @@ public:
         if (item)
             item->deref();
     }
+
+ /*   QByteArray saveStateWithoutVersionControl(QWebHistory::HistoryStateVersion version)
+    {
+        QByteArray buffer;
+        switch(version){
+            case QWebHistory::HistoryVersion1:
+                buffer=item->saveState(version);
+                break;
+            default:{}
+        }
+        return buffer;
+    }
+
+    bool restoreStateWithoutVersionControl(QWebHistory::HistoryStateVersion version,QDataStream& stream)
+    {
+
+    }
+*/
+
     WebCore::HistoryItem *item;
 };
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 3370f15..5899a1b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -796,7 +796,7 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
             defaultFont = view->font();
         QFontMetrics fm(defaultFont);
         int fontHeight = fm.height();
-        if (!handleScrolling(ev)) {
+        if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
             case Qt::Key_Back:
                 q->triggerAction(QWebPage::Back);
@@ -999,7 +999,7 @@ void QWebPagePrivate::shortcutOverrideEvent(QKeyEvent* event)
     }
 }
 
-bool QWebPagePrivate::handleScrolling(QKeyEvent *ev)
+bool QWebPagePrivate::handleScrolling(QKeyEvent *ev, Frame *frame)
 {
     ScrollDirection direction;
     ScrollGranularity granularity;
@@ -1046,10 +1046,7 @@ bool QWebPagePrivate::handleScrolling(QKeyEvent *ev)
         }
     }
 
-    if (!mainFrame->d->frame->eventHandler()->scrollOverflow(direction, granularity))
-        mainFrame->d->frame->view()->scroll(direction, granularity);
-
-    return true;
+    return frame->eventHandler()->scrollRecursively(direction, granularity);
 }
 
 /*!
@@ -1115,6 +1112,7 @@ QVariant QWebPage::inputMethodQuery(Qt::InputMethodQuery property) const
    changes the behaviour to a case sensitive find operation.
    \value FindWrapsAroundDocument Makes findText() restart from the beginning of the document if the end
    was reached and the text was not found.
+   \value HighlightAllOccurrences Highlights all existing occurrences of a specific string.
 */
 
 /*!
@@ -2197,7 +2195,7 @@ bool QWebPage::swallowContextMenuEvent(QContextMenuEvent *event)
 
     if (QWebFrame* webFrame = d->frameAt(event->pos())) {
         Frame* frame = QWebFramePrivate::core(webFrame);
-        if (Scrollbar* scrollbar = frame->view()->scrollbarUnderMouse(PlatformMouseEvent(event, 1))) {
+        if (Scrollbar* scrollbar = frame->view()->scrollbarUnderPoint(PlatformMouseEvent(event, 1).pos())) {
             return scrollbar->contextMenu(PlatformMouseEvent(event, 1));
         }
     }
@@ -2356,8 +2354,18 @@ bool QWebPage::supportsExtension(Extension extension) const
 }
 
 /*!
-    Finds the next occurrence of the string, \a subString, in the page, using the given \a options.
-    Returns true of \a subString was found and selects the match visually; otherwise returns false.
+    Finds the specified string, \a subString, in the page, using the given \a options.
+
+    If the HighlightAllOccurrences flag is passed, the function will highlight all occurrences
+    that exist in the page. All subsequent calls will extend the highlight, rather than
+    replace it, with occurrences of the new string.
+
+    If the HighlightAllOccurrences flag is not passed, the function will select an occurrence
+    and all subsequent calls will replace the current occurrence with the next one.
+
+    To clear the selection, just pass an empty string.
+
+    Returns true if \a subString was found; otherwise returns false.
 */
 bool QWebPage::findText(const QString &subString, FindFlags options)
 {
@@ -2365,13 +2373,22 @@ bool QWebPage::findText(const QString &subString, FindFlags options)
     if (options & FindCaseSensitively)
         caseSensitivity = ::TextCaseSensitive;
 
-    ::FindDirection direction = ::FindDirectionForward;
-    if (options & FindBackward)
-        direction = ::FindDirectionBackward;
+    if (options & HighlightAllOccurrences) {
+        if (subString.isEmpty()) {
+            d->page->unmarkAllTextMatches();
+            return true;
+        } else {
+            return d->page->markAllMatchesForText(subString, caseSensitivity, true, 0);
+        }
+    } else {
+        ::FindDirection direction = ::FindDirectionForward;
+        if (options & FindBackward)
+            direction = ::FindDirectionBackward;
 
-    const bool shouldWrap = options & FindWrapsAroundDocument;
+        const bool shouldWrap = options & FindWrapsAroundDocument;
 
-    return d->page->findString(subString, caseSensitivity, direction, shouldWrap);
+        return d->page->findString(subString, caseSensitivity, direction, shouldWrap);
+    }
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
index 7edc060..86822d2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.h
@@ -172,7 +172,8 @@ public:
     enum FindFlag {
         FindBackward = 1,
         FindCaseSensitively = 2,
-        FindWrapsAroundDocument = 4
+        FindWrapsAroundDocument = 4,
+        HighlightAllOccurrences = 8
     };
     Q_DECLARE_FLAGS(FindFlags, FindFlag)
 
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
index a897bf1..984bec1 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage_p.h
@@ -45,6 +45,7 @@ namespace WebCore
     class Element;
     class Node;
     class Page;
+    class Frame;
 
 #ifndef QT_NO_CURSOR
     class SetCursorEvent : public QEvent {
@@ -113,7 +114,7 @@ public:
 
     void shortcutOverrideEvent(QKeyEvent*);
     void leaveEvent(QEvent *);
-    bool handleScrolling(QKeyEvent*);
+    bool handleScrolling(QKeyEvent*, WebCore::Frame*);
 
 #ifndef QT_NO_SHORTCUT
     static QWebPage::WebAction editorActionForKeyEvent(QKeyEvent* event);
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
index 3c56b93..c634a7f 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebview.cpp
@@ -646,9 +646,18 @@ void QWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
 
 
 /*!
-    Finds the next occurrence of the string, \a subString, in the page, using
-    the given \a options. Returns true of \a subString was found and selects
-    the match visually; otherwise returns false.
+    Finds the specified string, \a subString, in the page, using the given \a options.
+
+    If the HighlightAllOccurrences flag is passed, the function will highlight all occurrences
+    that exist in the page. All subsequent calls will extend the highlight, rather than
+    replace it, with occurrences of the new string.
+
+    If the HighlightAllOccurrences flag is not passed, the function will select an occurrence
+    and all subsequent calls will replace the current occurrence with the next one.
+
+    To clear the selection, just pass an empty string.
+
+    Returns true if \a subString was found; otherwise returns false.
 
     \sa selectedText(), selectionChanged()
 */
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index c2ed475..dffa5e5 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,150 @@
+2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing isSpeaking() implementation to
+        ContextMenuClient.
+
+        * WebCoreSupport/ContextMenuClientQt.cpp:
+        (WebCore::ContextMenuClientQt::isSpeaking):
+        * WebCoreSupport/ContextMenuClientQt.h:
+
+2009-06-28  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix build break for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=26779
+
+        * Api/qwebpage.cpp:
+        (QWebPage::swallowContextMenuEvent):
+
+2009-06-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Build fix for Qt under Windows.
+
+        * Api/qwebhistory.h: Use consistent export linkage for the datastream operators.
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Changed call of scrollbarUnderMouse to scrollbarUnderPoint to match new API.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::swallowContextMenuEvent):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
+
+        This includes streaming operators for QWebHistory. for convenience.
+
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::restoreState):
+        (QWebHistory::saveState):
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+        * Api/qwebhistory_p.h:
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::):
+        (tst_QWebHistory::init):
+        (tst_QWebHistory::title):
+        (tst_QWebHistory::count):
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::itemAt):
+        (tst_QWebHistory::goToItem):
+        (tst_QWebHistory::items):
+        (tst_QWebHistory::serialize_1):
+        (tst_QWebHistory::serialize_2):
+        (tst_QWebHistory::serialize_3):
+        (tst_QWebHistory::saveAndRestore_1):
+        (tst_QWebHistory::saveAndRestore_2):
+        (tst_QWebHistory::saveAndRestore_3):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the behaviour of QWebHistory::itemAt to interpret the specified index as absolute index.
+
+        Returns an invalid QWebHistoryItem if the index is out of range.
+
+        * Api/qwebhistory.cpp:
+        (QWebHistory::itemAt):
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (tst_QWebHistory::itemAt):
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added a few autotest to QWebHistory.
+
+        * tests/qwebhistory/data/page1.html: Added.
+        * tests/qwebhistory/data/page2.html: Added.
+        * tests/qwebhistory/data/page3.html: Added.
+        * tests/qwebhistory/data/page4.html: Added.
+        * tests/qwebhistory/data/page5.html: Added.
+        * tests/qwebhistory/data/page6.html: Added.
+        * tests/qwebhistory/qwebhistory.pro: Added.
+        * tests/qwebhistory/tst_qwebhistory.cpp: Added.
+        (tst_QWebHistory::):
+        (tst_QWebHistory::tst_QWebHistory):
+        (tst_QWebHistory::~tst_QWebHistory):
+        (tst_QWebHistory::init):
+        (tst_QWebHistory::cleanup):
+        (tst_QWebHistory::title):
+        (tst_QWebHistory::count):
+        (tst_QWebHistory::back):
+        (tst_QWebHistory::forward):
+        (tst_QWebHistory::goToItem):
+        (tst_QWebHistory::items):
+        * tests/qwebhistory/tst_qwebhistory.qrc: Added.
+        * tests/tests.pro:
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix support for documenting functions prefixed with QWEBKIT_EXPORT
+
+        Add QWEBKIT_EXPORT to the list of macros to ignore by qdoc.
+
+        * docs/qtwebkit.qdocconf:
+
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 20303: [Qt] Key events are not working in frames.
+
+        Send scrolling events to current focused frame, bubble the event
+        up to parent frame if it is not handled.  Use EventHandler's new
+        shared scrolling code.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::keyPressEvent):
+        (QWebPagePrivate::handleScrolling):
+        * Api/qwebpage_p.h:
+
+2009-06-25  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Adam Treat.
+
+        Add highlight functionality to the QWebPage::findText() method. Introduced is
+        new HighlightAllOccurrences flag which passed to the function will make it mark
+        all existing occurrences of specified string in the page.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::findText):
+        * Api/qwebpage.h:
+        * Api/qwebview.cpp:
+
 2009-06-19  Daniel Teske <qt-info@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
index ae9d718..ed79946 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
@@ -67,6 +67,12 @@ void ContextMenuClientQt::speak(const String&)
     notImplemented();
 }
 
+bool ContextMenuClientQt::isSpeaking()
+{
+    notImplemented();
+    return false;
+}
+
 void ContextMenuClientQt::stopSpeaking()
 {
     notImplemented();
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
index ad6bfae..8440ff5 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
@@ -44,6 +44,7 @@ namespace WebCore {
         virtual void downloadURL(const KURL& url);
         virtual void lookUpInDictionary(Frame*);
         virtual void speak(const String&);
+        virtual bool isSpeaking();
         virtual void stopSpeaking();
         virtual void searchWithGoogle(const Frame*);
     };
diff --git a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
index e60e586..6343b17 100644
--- a/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
+++ b/src/3rdparty/webkit/WebKit/qt/docs/qtwebkit.qdocconf
@@ -146,7 +146,8 @@ Cpp.ignoretokens        = QAXFACTORY_EXPORT \
                           QT_END_NAMESPACE \
                           QT_END_INCLUDE_NAMESPACE \
                           PHONON_EXPORT \
-                          EXTENSIONSYSTEM_EXPORT
+                          EXTENSIONSYSTEM_EXPORT \
+                          QWEBKIT_EXPORT
 Cpp.ignoredirectives    = Q_DECLARE_HANDLE \
                           Q_DECLARE_INTERFACE \
                           Q_DECLARE_METATYPE \
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html
new file mode 100644
index 0000000..82fa4af
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page1.html
@@ -0,0 +1 @@
+<title>page1</title><body><h1>page1</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html
new file mode 100644
index 0000000..5307bdc
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page2.html
@@ -0,0 +1 @@
+<title>page2</title><body><h1>page2</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html
new file mode 100644
index 0000000..4e5547c
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page3.html
@@ -0,0 +1 @@
+<title>page3</title><body><h1>page3</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html
new file mode 100644
index 0000000..3c57aed
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page4.html
@@ -0,0 +1 @@
+<title>page4</title><body><h1>page4</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html
new file mode 100644
index 0000000..8593552
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page5.html
@@ -0,0 +1 @@
+<title>page5</title><body><h1>page5</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html
new file mode 100644
index 0000000..c5bbc6f
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/data/page6.html
@@ -0,0 +1 @@
+<title>page6</title><body><h1>page6</h1></body>
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
new file mode 100644
index 0000000..fd1074c
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -0,0 +1,7 @@
+TEMPLATE = app
+TARGET = tst_qwebhistory
+include(../../../../WebKit.pri)
+SOURCES  += tst_qwebhistory.cpp
+RESOURCES  += tst_qwebhistory.qrc
+QT += testlib network
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
new file mode 100644
index 0000000..5b55613
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -0,0 +1,326 @@
+/*
+    Copyright (C) 2008 Holger Hans Peter Freyther
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include <QtTest/QtTest>
+
+#include "qwebpage.h"
+#include "qwebview.h"
+#include "qwebframe.h"
+#include "qwebhistory.h"
+#include "qdebug.h"
+
+class tst_QWebHistory : public QObject
+{
+    Q_OBJECT
+
+public:
+    tst_QWebHistory();
+    virtual ~tst_QWebHistory();
+
+protected :
+    void loadPage(int nr)
+    {
+        frame->load(QUrl("qrc:/data/page" + QString::number(nr) + ".html"));
+        waitForLoadFinished.exec();
+    }
+
+public slots:
+    void init();
+    void cleanup();
+
+private slots:
+    void title();
+    void count();
+    void back();
+    void forward();
+    void itemAt();
+    void goToItem();
+    void items();
+    void serialize_1(); //QWebHistory countity
+    void serialize_2(); //QWebHistory index
+    void serialize_3(); //QWebHistoryItem
+    void saveAndRestore_1();  //simple checks saveState and restoreState
+    void saveAndRestore_2();  //bad parameters saveState and restoreState
+    void saveAndRestore_3();  //try use different version
+
+private:
+    QWebPage* page;
+    QWebFrame* frame;
+    QWebHistory* hist;
+    QEventLoop waitForLoadFinished;  //operation on history are asynchronous!
+    int histsize;
+};
+
+tst_QWebHistory::tst_QWebHistory()
+{
+}
+
+tst_QWebHistory::~tst_QWebHistory()
+{
+}
+
+void tst_QWebHistory::init()
+{
+    page = new QWebPage(this);
+    frame = page->mainFrame();
+    connect(page, SIGNAL(loadFinished(bool)), &waitForLoadFinished, SLOT(quit()));
+
+    for (int i = 1;i < 6;i++) {
+        loadPage(i);
+    }
+    hist = page->history();
+    histsize = 5;
+}
+
+void tst_QWebHistory::cleanup()
+{
+    delete page;
+}
+
+/**
+  * Check QWebHistoryItem::title() method
+  */
+void tst_QWebHistory::title()
+{
+    QCOMPARE(hist->currentItem().title(), QString("page5"));
+}
+
+/**
+  * Check QWebHistory::count() method
+  */
+void tst_QWebHistory::count()
+{
+    QCOMPARE(hist->count(), histsize);
+}
+
+/**
+  * Check QWebHistory::back() method
+  */
+void tst_QWebHistory::back()
+{
+    for (int i = histsize;i > 1;i--) {
+        QCOMPARE(page->mainFrame()->toPlainText(), QString("page") + QString::number(i));
+        hist->back();
+        waitForLoadFinished.exec();
+    }
+}
+
+/**
+  * Check QWebHistory::forward() method
+  */
+void tst_QWebHistory::forward()
+{
+    //rewind history :-)
+    while (hist->canGoBack()) {
+        hist->back();
+        waitForLoadFinished.exec();
+    }
+
+    for (int i = 1;i < histsize;i++) {
+        QCOMPARE(page->mainFrame()->toPlainText(), QString("page") + QString::number(i));
+        hist->forward();
+        waitForLoadFinished.exec();
+    }
+}
+
+/**
+  * Check QWebHistory::itemAt() method
+  */
+void tst_QWebHistory::itemAt()
+{
+    for (int i = 1;i < histsize;i++) {
+        QCOMPARE(hist->itemAt(i - 1).title(), QString("page") + QString::number(i));
+        QVERIFY(hist->itemAt(i - 1).isValid());
+    }
+    //check out of range values
+    QVERIFY(!hist->itemAt(-1).isValid());
+    QVERIFY(!hist->itemAt(histsize).isValid());
+}
+
+/**
+  * Check QWebHistory::goToItem() method
+  */
+void tst_QWebHistory::goToItem()
+{
+    QWebHistoryItem current = hist->currentItem();
+    hist->back();
+    waitForLoadFinished.exec();
+    hist->back();
+    waitForLoadFinished.exec();
+    QVERIFY(hist->currentItem().title() != current.title());
+    hist->goToItem(current);
+    waitForLoadFinished.exec();
+    QCOMPARE(hist->currentItem().title(), current.title());
+}
+
+/**
+  * Check QWebHistory::items() method
+  */
+void tst_QWebHistory::items() 
+{
+    QList<QWebHistoryItem> items = hist->items();
+    //check count
+    QCOMPARE(histsize, items.count());
+
+    //check order
+    for (int i = 1;i <= histsize;i++) {
+        QCOMPARE(items.at(i - 1).title(), QString("page") + QString::number(i));
+    }
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks history size, history order
+  */
+void tst_QWebHistory::serialize_1() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    QCOMPARE(hist->count(), histsize);
+
+    //check size of history
+    //load next page to find differences
+    loadPage(6);
+    QCOMPARE(hist->count(), histsize + 1);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+    QCOMPARE(hist->count(), histsize);
+
+    //check order of historyItems
+    QList<QWebHistoryItem> items = hist->items();
+    for (int i = 1;i <= histsize;i++) {
+        QCOMPARE(items.at(i - 1).title(), QString("page") + QString::number(i));
+    }
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks history currentIndex value
+  */
+void tst_QWebHistory::serialize_2() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    int oldCurrentIndex = hist->currentItemIndex();
+
+    hist->back();
+    waitForLoadFinished.exec();
+    hist->back();
+    waitForLoadFinished.exec();
+    //check if current index was changed (make sure that it is not last item)
+    QVERIFY(hist->currentItemIndex() != oldCurrentIndex);
+    //save current index
+    oldCurrentIndex = hist->currentItemIndex();
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+
+    //check current index
+    QCOMPARE(hist->currentItemIndex(), oldCurrentIndex);
+}
+
+/**
+  * Check history state after serialization (pickle, persistent..) method
+  * Checks QWebHistoryItem public property after serialization
+  */
+void tst_QWebHistory::serialize_3() 
+{
+    QByteArray tmp;  //buffer
+    QDataStream save(&tmp, QIODevice::WriteOnly); //here data will be saved
+    QDataStream load(&tmp, QIODevice::ReadOnly); //from here data will be loaded
+
+    //prepare two different history items
+    QWebHistoryItem a = hist->currentItem();
+    a.setUserData("A - user data");
+
+    //check properties BEFORE serialization
+    QString title(a.title());
+    QDateTime lastVisited(a.lastVisited());
+    QUrl originalUrl(a.originalUrl());
+    QUrl url(a.url());
+    QVariant userData(a.userData());
+
+    save << *hist;
+    QVERIFY(save.status() == QDataStream::Ok);
+    QVERIFY(!load.atEnd());
+    hist->clear();
+    QVERIFY(hist->count() == 1);
+    load >> *hist;
+    QVERIFY(load.status() == QDataStream::Ok);
+    QWebHistoryItem b = hist->currentItem();
+
+    //check properties AFTER serialization
+    QCOMPARE(b.title(), title);
+    QCOMPARE(b.lastVisited(), lastVisited);
+    QCOMPARE(b.originalUrl(), originalUrl);
+    QCOMPARE(b.url(), url);
+    QCOMPARE(b.userData(), userData);
+
+    //Check if all data was read
+    QVERIFY(load.atEnd());
+}
+
+/** Simple checks should be a bit redundant to streaming operators */
+void tst_QWebHistory::saveAndRestore_1() 
+{
+    hist->back();
+    waitForLoadFinished.exec();
+    QByteArray buffer(hist->saveState());
+    hist->clear();
+    QVERIFY(hist->count() == 1);
+    hist->restoreState(buffer);
+
+    //check only few values, do not make full test
+    //because most of the code is shared with streaming operators
+    //and these are checked before
+    QCOMPARE(hist->count(), histsize);
+    QCOMPARE(hist->currentItemIndex(), histsize - 2);
+    QCOMPARE(hist->itemAt(0).title(), QString("page1"));
+    QCOMPARE(hist->itemAt(histsize - 1).title(), QString("page") + QString::number(histsize));
+}
+
+/** Check returns value if there are bad parameters. Actually, result
+  * is no so importent. The test shouldn't crash :-) */
+void tst_QWebHistory::saveAndRestore_2() 
+{
+    QByteArray buffer;
+    hist->restoreState(buffer);
+    QVERIFY(hist->count() == 1);
+    QVERIFY(hist->itemAt(0).isValid());
+}
+
+/** Try to use bad version value */
+void tst_QWebHistory::saveAndRestore_3() 
+{
+    QByteArray tmp = hist->saveState((QWebHistory::HistoryStateVersion)29999);
+    QVERIFY(hist->saveState((QWebHistory::HistoryStateVersion)29999).isEmpty());
+    QVERIFY(hist->count() == histsize);
+    QVERIFY(hist->itemAt(3).isValid());
+}
+
+QTEST_MAIN(tst_QWebHistory)
+#include "tst_qwebhistory.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
new file mode 100644
index 0000000..7c5ff0e
--- /dev/null
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebhistory/tst_qwebhistory.qrc
@@ -0,0 +1,11 @@
+<!DOCTYPE RCC><RCC version="1.0">
+<qresource>
+    <file>data/page1.html</file>
+    <file>data/page2.html</file>    
+    <file>data/page3.html</file>
+    <file>data/page4.html</file>
+    <file>data/page5.html</file>
+    <file>data/page6.html</file>
+</qresource>
+</RCC>
+
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
index e898ca0..076046f 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
+++ b/src/3rdparty/webkit/WebKit/qt/tests/tests.pro
@@ -1,3 +1,3 @@
 
 TEMPLATE = subdirs
-SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview
+SUBDIRS = qwebframe qwebpage qwebelement qwebhistoryinterface qwebview qwebhistory