Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.7

70 files changed, 1003 insertions, 476 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h b/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
index b134407..0d7c2c2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-buffer.h
@@ -32,6 +32,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 typedef struct HB_GlyphItemRec_ {
   HB_UInt     gindex;
   HB_UInt     properties;
@@ -48,13 +52,13 @@ typedef struct HB_PositionRec_ {
   HB_Fixed   y_advance;
   HB_UShort  back;            /* number of glyphs to go back
 				 for drawing current glyph   */
+  HB_Short  cursive_chain;   /* character to which this connects,
+				 may be positive or negative; used
+				 only internally                     */
   HB_Bool    new_advance;     /* if set, the advance width values are
 				 absolute, i.e., they won't be
 				 added to the original glyph's value
 				 but rather replace them.            */
-  HB_Short  cursive_chain;   /* character to which this connects,
-				 may be positive or negative; used
-				 only internally                     */
 } HB_PositionRec, *HB_Position;
 
 
@@ -66,12 +70,12 @@ typedef struct HB_BufferRec_{
   HB_UInt    in_pos;
   HB_UInt    out_pos;
   
-  HB_Bool       separate_out;
   HB_GlyphItem  in_string;
   HB_GlyphItem  out_string;
   HB_GlyphItem  alt_string;
   HB_Position   positions;
   HB_UShort      max_ligID;
+  HB_Bool       separate_out;
 } HB_BufferRec, *HB_Buffer;
 
 HB_Error
@@ -89,6 +93,10 @@ hb_buffer_add_glyph( HB_Buffer buffer,
 		      HB_UInt    properties,
 		      HB_UInt    cluster );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_BUFFER_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-dump.c b/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
index 8c81da1..54d42e9 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-dump.c
@@ -519,13 +519,14 @@ Dump_ValueRecord (HB_ValueRecord *ValueRecord, FILE *stream, int indent, HB_Type
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE)
     DUMP_FINT (ValueRecord, XAdvance);
   if (value_format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->XPlacementDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_X_PLACEMENT_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->YPlacementDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_Y_PLACEMENT_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->XAdvanceDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_X_ADVANCE_DEVICE]);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE)
-    RECURSE (Device, Device, &ValueRecord->YAdvanceDevice);
+    RECURSE (Device, Device, &*ValueRecord->DeviceTables[VR_Y_ADVANCE_DEVICE]);
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   if (value_format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT)
     DUMP_FUINT (ValueRecord, XIdPlacement);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ID_PLACEMENT)
@@ -534,6 +535,7 @@ Dump_ValueRecord (HB_ValueRecord *ValueRecord, FILE *stream, int indent, HB_Type
     DUMP_FUINT (ValueRecord, XIdAdvance);
   if (value_format & HB_GPOS_FORMAT_HAVE_Y_ID_ADVANCE)
     DUMP_FUINT (ValueRecord, XIdAdvance);
+#endif
 }
 
 static void
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-external.h b/src/3rdparty/harfbuzz/src/harfbuzz-external.h
index 760749b..7644f0d 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-external.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-external.h
@@ -146,11 +146,7 @@ HB_CharCategory HB_GetUnicodeCharCategory(HB_UChar32 ch);
 int HB_GetUnicodeCharCombiningClass(HB_UChar32 ch);
 HB_UChar16 HB_GetMirroredChar(HB_UChar16 ch);
 
-void *HB_Library_Resolve(const char *library, const char *symbol);
-
-void *HB_TextCodecForMib(int mib);
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength);
-void HB_TextCodec_FreeResult(char *);
+void *HB_Library_Resolve(const char *library, int version, const char *symbol);
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
index da06b6f..2a6d958 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef-private.h
@@ -34,12 +34,16 @@
 HB_BEGIN_HEADER
 
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Attachment related structures */
 
 struct  HB_AttachPoint_
 {
-  HB_UShort   PointCount;             /* size of the PointIndex array */
   HB_UShort*  PointIndex;             /* array of contour points      */
+  HB_UShort   PointCount;             /* size of the PointIndex array */
 };
 
 /* Ligature Caret related structures */
@@ -62,32 +66,36 @@ typedef struct HB_CaretValueFormat2_  HB_CaretValueFormat2;
 
 struct  HB_CaretValueFormat3_
 {
+  HB_Device*  Device;                 /* Device table for x or y value  */
   HB_Short    Coordinate;             /* x or y value (in design units) */
-  HB_Device  Device;                 /* Device table for x or y value  */
 };
 
 typedef struct HB_CaretValueFormat3_  HB_CaretValueFormat3;
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 struct  HB_CaretValueFormat4_
 {
   HB_UShort  IdCaretValue;            /* metric ID */
 };
 
 typedef struct HB_CaretValueFormat4_  HB_CaretValueFormat4;
+#endif
 
 
 struct  HB_CaretValue_
 {
-  HB_UShort  CaretValueFormat;        /* 1, 2, 3, or 4 */
-
   union
   {
     HB_CaretValueFormat1  cvf1;
     HB_CaretValueFormat2  cvf2;
     HB_CaretValueFormat3  cvf3;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     HB_CaretValueFormat4  cvf4;
+#endif
   } cvf;
+
+  HB_Byte  CaretValueFormat;          /* 1, 2, 3, or 4 */
 };
 
 typedef struct HB_CaretValue_  HB_CaretValue;
@@ -95,10 +103,9 @@ typedef struct HB_CaretValue_  HB_CaretValue;
 
 struct  HB_LigGlyph_
 {
-  HB_Bool          loaded;
-
-  HB_UShort        CaretCount;        /* number of caret values */
   HB_CaretValue*  CaretValue;        /* array of caret values  */
+  HB_UShort        CaretCount;        /* number of caret values */
+  HB_Bool          loaded;
 };
 
 
@@ -119,6 +126,10 @@ _HB_GDEF_LoadMarkAttachClassDef_From_LookupFlags( HB_GDEFHeader* gdef,
 						  HB_Lookup*     lo,
 						  HB_UShort      num_lookups );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GDEF_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
index ff3a1f4..c0c6f2c 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.c
@@ -442,7 +442,11 @@ static HB_Error  Load_CaretValue( HB_CaretValue*  cv,
     if ( ACCESS_Frame( 2L ) )
       return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     cv->cvf.cvf4.IdCaretValue = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
     break;
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
index b6dcadc..f9a03dd 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gdef.h
@@ -31,6 +31,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* GDEF glyph properties.  Note that HB_GDEF_COMPONENT has no corresponding
  * flag in the LookupFlag field.     */
 #define HB_GDEF_BASE_GLYPH  0x0002
@@ -44,12 +48,11 @@ typedef struct HB_AttachPoint_  HB_AttachPoint;
 
 struct  HB_AttachList_
 {
-  HB_Bool           loaded;
-
+  HB_AttachPoint*   AttachPoint;      /* array of AttachPoint tables */
   HB_Coverage       Coverage;         /* Coverage table              */
   HB_UShort         GlyphCount;       /* number of glyphs with
 					 attachments                 */
-  HB_AttachPoint*   AttachPoint;      /* array of AttachPoint tables */
+  HB_Bool           loaded;
 };
 
 typedef struct HB_AttachList_  HB_AttachList;
@@ -58,11 +61,10 @@ typedef struct HB_LigGlyph_  HB_LigGlyph;
 
 struct  HB_LigCaretList_
 {
-  HB_Bool        loaded;
-
+  HB_LigGlyph*   LigGlyph;            /* array of LigGlyph tables  */
   HB_Coverage    Coverage;            /* Coverage table            */
   HB_UShort      LigGlyphCount;       /* number of ligature glyphs */
-  HB_LigGlyph*   LigGlyph;            /* array of LigGlyph tables  */
+  HB_Bool        loaded;
 };
 
 typedef struct HB_LigCaretList_  HB_LigCaretList;
@@ -91,18 +93,18 @@ typedef struct HB_LigCaretList_  HB_LigCaretList;
 
 struct  HB_GDEFHeader_
 {
+  HB_UShort**          NewGlyphClasses;
   HB_UInt             offset;
+  HB_UInt             MarkAttachClassDef_offset;
 
   HB_16Dot16             Version;
 
   HB_ClassDefinition   GlyphClassDef;
   HB_AttachList        AttachList;
   HB_LigCaretList      LigCaretList;
-  HB_UInt             MarkAttachClassDef_offset;
   HB_ClassDefinition   MarkAttachClassDef;        /* new in OT 1.2 */
 
   HB_UShort            LastGlyph;
-  HB_UShort**          NewGlyphClasses;
 };
 
 typedef struct HB_GDEFHeader_   HB_GDEFHeader;
@@ -129,6 +131,9 @@ HB_Error  HB_GDEF_Build_ClassDefinition( HB_GDEFHeader*  gdef,
 					 HB_UShort*       glyph_array,
 					 HB_UShort*       class_array );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-global.h b/src/3rdparty/harfbuzz/src/harfbuzz-global.h
index d4e6b46..5b2b679 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-global.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-global.h
@@ -39,6 +39,10 @@
 #define HB_END_HEADER  /* nothing */
 #endif
 
+#if defined(__GNUC__) || defined(__ARMCC__) || defined(__CC_ARM) || defined(_MSC_VER)
+#define HB_USE_PACKED_STRUCTS
+#endif
+
 HB_BEGIN_HEADER
 
 #ifndef FALSE
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
index 4110700..39f3159 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos-private.h
@@ -32,9 +32,17 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
 
 /* shared tables */
 
+#define VR_X_PLACEMENT_DEVICE 0
+#define VR_Y_PLACEMENT_DEVICE 1
+#define VR_X_ADVANCE_DEVICE   2
+#define VR_Y_ADVANCE_DEVICE   3
+
 struct  HB_ValueRecord_
 {
   HB_Short    XPlacement;             /* horizontal adjustment for
@@ -45,18 +53,16 @@ struct  HB_ValueRecord_
 					 advance                        */
   HB_Short    YAdvance;               /* vertical adjustment for
 					 advance                        */
-  HB_Device  XPlacementDevice;       /* device table for horizontal
-					 placement                      */
-  HB_Device  YPlacementDevice;       /* device table for vertical
-					 placement                      */
-  HB_Device  XAdvanceDevice;         /* device table for horizontal
-					 advance                        */
-  HB_Device  YAdvanceDevice;         /* device table for vertical
-					 advance                        */
+
+  HB_Device** DeviceTables;           /* device tables for placement
+					 and advance                    */
+
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_UShort   XIdPlacement;           /* horizontal placement metric ID */
   HB_UShort   YIdPlacement;           /* vertical placement metric ID   */
   HB_UShort   XIdAdvance;             /* horizontal advance metric ID   */
   HB_UShort   YIdAdvance;             /* vertical advance metric ID     */
+#endif
 };
 
 typedef struct HB_ValueRecord_  HB_ValueRecord;
@@ -65,6 +71,8 @@ typedef struct HB_ValueRecord_  HB_ValueRecord;
 /* Mask values to scan the value format of the ValueRecord structure.
  We always expand compressed ValueRecords of the font.              */
 
+#define HB_GPOS_FORMAT_HAVE_DEVICE_TABLES       0x00F0
+
 #define HB_GPOS_FORMAT_HAVE_X_PLACEMENT         0x0001
 #define HB_GPOS_FORMAT_HAVE_Y_PLACEMENT         0x0002
 #define HB_GPOS_FORMAT_HAVE_X_ADVANCE           0x0004
@@ -97,18 +105,20 @@ struct  HB_AnchorFormat2_
 
 typedef struct HB_AnchorFormat2_  HB_AnchorFormat2;
 
+#define AF3_X_DEVICE_TABLE 0
+#define AF3_Y_DEVICE_TABLE 1
 
 struct  HB_AnchorFormat3_
 {
   HB_Short    XCoordinate;            /* horizontal value              */
   HB_Short    YCoordinate;            /* vertical value                */
-  HB_Device  XDeviceTable;           /* device table for X coordinate */
-  HB_Device  YDeviceTable;           /* device table for Y coordinate */
+  HB_Device** DeviceTables;           /* device tables for coordinates */
 };
 
 typedef struct HB_AnchorFormat3_  HB_AnchorFormat3;
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 struct  HB_AnchorFormat4_
 {
   HB_UShort  XIdAnchor;               /* horizontal metric ID */
@@ -116,11 +126,12 @@ struct  HB_AnchorFormat4_
 };
 
 typedef struct HB_AnchorFormat4_  HB_AnchorFormat4;
+#endif
 
 
 struct  HB_Anchor_
 {
-  HB_UShort  PosFormat;               /* 1, 2, 3, or 4 -- 0 indicates
+  HB_Byte  PosFormat;                 /* 1, 2, 3, or 4 -- 0 indicates
 					 that there is no Anchor table */
 
   union
@@ -128,7 +139,9 @@ struct  HB_Anchor_
     HB_AnchorFormat1  af1;
     HB_AnchorFormat2  af2;
     HB_AnchorFormat3  af3;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     HB_AnchorFormat4  af4;
+#endif
   } af;
 };
 
@@ -175,7 +188,7 @@ typedef struct HB_SinglePosFormat2_  HB_SinglePosFormat2;
 
 struct  HB_SinglePos_
 {
-  HB_UShort     PosFormat;            /* 1 or 2         */
+  HB_Byte       PosFormat;            /* 1 or 2         */
   HB_Coverage  Coverage;             /* Coverage table */
 
   HB_UShort     ValueFormat;          /* format of ValueRecord table */
@@ -255,7 +268,7 @@ typedef struct HB_PairPosFormat2_  HB_PairPosFormat2;
 
 struct  HB_PairPos_
 {
-  HB_UShort     PosFormat;            /* 1 or 2         */
+  HB_Byte       PosFormat;            /* 1 or 2         */
   HB_Coverage  Coverage;             /* Coverage table */
   HB_UShort     ValueFormat1;         /* format of ValueRecord table
 					 for first glyph             */
@@ -507,7 +520,7 @@ typedef struct HB_ContextPosFormat3_  HB_ContextPosFormat3;
 
 struct  HB_ContextPos_
 {
-  HB_UShort  PosFormat;               /* 1, 2, or 3     */
+  HB_Byte  PosFormat;                 /* 1, 2, or 3     */
 
   union
   {
@@ -524,18 +537,18 @@ typedef struct HB_ContextPos_  HB_ContextPos;
 
 struct  HB_ChainPosRule_
 {
+  HB_UShort*            Backtrack;    /* array of backtrack glyph IDs     */
+  HB_UShort*            Input;        /* array of input glyph IDs         */
+  HB_UShort*            Lookahead;    /* array of lookahead glyph IDs     */
+  HB_PosLookupRecord*  PosLookupRecord;
+				      /* array of PosLookupRecords       */
   HB_UShort             BacktrackGlyphCount;
 				      /* total number of backtrack glyphs */
-  HB_UShort*            Backtrack;    /* array of backtrack glyph IDs     */
   HB_UShort             InputGlyphCount;
 				      /* total number of input glyphs     */
-  HB_UShort*            Input;        /* array of input glyph IDs         */
   HB_UShort             LookaheadGlyphCount;
 				      /* total number of lookahead glyphs */
-  HB_UShort*            Lookahead;    /* array of lookahead glyph IDs     */
   HB_UShort             PosCount;     /* number of PosLookupRecords       */
-  HB_PosLookupRecord*  PosLookupRecord;
-				      /* array of PosLookupRecords       */
 };
 
 typedef struct HB_ChainPosRule_  HB_ChainPosRule;
@@ -565,20 +578,20 @@ typedef struct HB_ChainContextPosFormat1_  HB_ChainContextPosFormat1;
 
 struct  HB_ChainPosClassRule_
 {
+  HB_UShort*            Backtrack;    /* array of backtrack classes      */
+  HB_UShort*            Input;        /* array of context classes        */
+  HB_UShort*            Lookahead;    /* array of lookahead classes      */
+  HB_PosLookupRecord*  PosLookupRecord;
+				      /* array of substitution lookups   */
   HB_UShort             BacktrackGlyphCount;
 				      /* total number of backtrack
 					 classes                         */
-  HB_UShort*            Backtrack;    /* array of backtrack classes      */
   HB_UShort             InputGlyphCount;
 				      /* total number of context classes */
-  HB_UShort*            Input;        /* array of context classes        */
   HB_UShort             LookaheadGlyphCount;
 				      /* total number of lookahead
 					 classes                         */
-  HB_UShort*            Lookahead;    /* array of lookahead classes      */
   HB_UShort             PosCount;     /* number of PosLookupRecords      */
-  HB_PosLookupRecord*  PosLookupRecord;
-				      /* array of substitution lookups   */
 };
 
 typedef struct HB_ChainPosClassRule_  HB_ChainPosClassRule;
@@ -656,7 +669,7 @@ typedef struct HB_ChainContextPosFormat3_  HB_ChainContextPosFormat3;
 
 struct  HB_ChainContextPos_
 {
-  HB_UShort  PosFormat;             /* 1, 2, or 3 */
+  HB_Byte  PosFormat;               /* 1, 2, or 3 */
 
   union
   {
@@ -707,6 +720,10 @@ HB_INTERNAL void
 _HB_GPOS_Free_SubTable( HB_GPOS_SubTable* st,
 			      HB_UShort     lookup_type );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GPOS_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
index 356dc01..d71a85e 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.c
@@ -57,6 +57,7 @@ static HB_Error  GPOS_Do_Glyph_Lookup( GPOS_Instance*    gpi,
 
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 /* the client application must replace this with something more
    meaningful if multiple master fonts are to be supported.     */
 
@@ -71,6 +72,7 @@ static HB_Error  default_mmfunc( HB_Font      font,
   HB_UNUSED(data);
   return ERR(HB_Err_Not_Covered); /* ERR() call intended */
 }
+#endif
 
 
 
@@ -97,7 +99,9 @@ HB_Error  HB_Load_GPOS_Table( HB_Stream stream,
   if ( ALLOC ( gpos, sizeof( *gpos ) ) )
     return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   gpos->mmfunc = default_mmfunc;
+#endif
 
   /* skip version */
 
@@ -252,6 +256,20 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
   else
     vr->YAdvance = 0;
 
+  if ( format & HB_GPOS_FORMAT_HAVE_DEVICE_TABLES )
+  {
+    if ( ALLOC_ARRAY( vr->DeviceTables, 4, HB_Device ) )
+      return error;
+    vr->DeviceTables[VR_X_ADVANCE_DEVICE] = 0;
+    vr->DeviceTables[VR_Y_ADVANCE_DEVICE] = 0;
+    vr->DeviceTables[VR_X_PLACEMENT_DEVICE] = 0;
+    vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] = 0;
+  }
+  else
+  {
+    vr->DeviceTables = 0;
+  }
+
   if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
   {
     if ( ACCESS_Frame( 2L ) )
@@ -267,20 +285,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->XPlacementDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	return error;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty1;
-  }
-  else
-  {
-  empty1:
-    vr->XPlacementDevice.StartSize  = 0;
-    vr->XPlacementDevice.EndSize    = 0;
-    vr->XPlacementDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
@@ -298,20 +307,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->YPlacementDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail3;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty2;
-  }
-  else
-  {
-  empty2:
-    vr->YPlacementDevice.StartSize  = 0;
-    vr->YPlacementDevice.EndSize    = 0;
-    vr->YPlacementDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
@@ -329,20 +329,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->XAdvanceDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail2;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty3;
-  }
-  else
-  {
-  empty3:
-    vr->XAdvanceDevice.StartSize  = 0;
-    vr->XAdvanceDevice.EndSize    = 0;
-    vr->XAdvanceDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
@@ -360,20 +351,11 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &vr->YAdvanceDevice,
+	   ( error = _HB_OPEN_Load_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail1;
       (void)FILE_Seek( cur_offset );
     }
-    else
-      goto empty4;
-  }
-  else
-  {
-  empty4:
-    vr->YAdvanceDevice.StartSize  = 0;
-    vr->YAdvanceDevice.EndSize    = 0;
-    vr->YAdvanceDevice.DeltaValue = NULL;
   }
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT )
@@ -381,59 +363,85 @@ static HB_Error  Load_ValueRecord( HB_ValueRecord*  vr,
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->XIdPlacement = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->XIdPlacement = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ID_PLACEMENT )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->YIdPlacement = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->YIdPlacement = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_ADVANCE )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->XIdAdvance = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->XIdAdvance = 0;
+#endif
 
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ID_ADVANCE )
   {
     if ( ACCESS_Frame( 2L ) )
       goto Fail1;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     vr->YIdAdvance = GET_UShort();
+#else
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
   }
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   else
     vr->YIdAdvance = 0;
+#endif
 
   return HB_Err_Ok;
 
 Fail1:
-  _HB_OPEN_Free_Device( &vr->YAdvanceDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
 
 Fail2:
-  _HB_OPEN_Free_Device( &vr->XAdvanceDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
 
 Fail3:
-  _HB_OPEN_Free_Device( &vr->YPlacementDevice );
+  _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
+
+  FREE( vr->DeviceTables );
   return error;
 }
 
@@ -442,13 +450,14 @@ static void  Free_ValueRecord( HB_ValueRecord*  vr,
 			       HB_UShort         format )
 {
   if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->YAdvanceDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
-    _HB_OPEN_Free_Device( &vr->XAdvanceDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->YPlacementDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] );
   if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
-    _HB_OPEN_Free_Device( &vr->XPlacementDevice );
+    _HB_OPEN_Free_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE] );
+  FREE( vr->DeviceTables );
 }
 
 
@@ -457,10 +466,12 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
 				  HB_UShort         format,
 				  HB_Position      gd )
 {
-  HB_Fixed           value;
   HB_Short         pixel_value;
   HB_Error         error = HB_Err_Ok;
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_GPOSHeader*  gpos = gpi->gpos;
+  HB_Fixed           value;
+#endif
 
   HB_UShort  x_ppem, y_ppem;
   HB_16Dot16   x_scale, y_scale;
@@ -489,28 +500,39 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
   {
     /* pixel -> fractional pixel */
 
+    if ( format & HB_GPOS_FORMAT_HAVE_DEVICE_TABLES )
+    {
+      if ( ALLOC_ARRAY( vr->DeviceTables, 4, HB_Device ) )
+        return error;
+      vr->DeviceTables[VR_X_ADVANCE_DEVICE] = 0;
+      vr->DeviceTables[VR_Y_ADVANCE_DEVICE] = 0;
+      vr->DeviceTables[VR_X_PLACEMENT_DEVICE] = 0;
+      vr->DeviceTables[VR_Y_PLACEMENT_DEVICE] = 0;
+    }
+
     if ( format & HB_GPOS_FORMAT_HAVE_X_PLACEMENT_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->XPlacementDevice, x_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_X_PLACEMENT_DEVICE], x_ppem, &pixel_value );
       gd->x_pos += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_Y_PLACEMENT_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->YPlacementDevice, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_Y_PLACEMENT_DEVICE], y_ppem, &pixel_value );
       gd->y_pos += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_X_ADVANCE_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->XAdvanceDevice, x_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_X_ADVANCE_DEVICE], x_ppem, &pixel_value );
       gd->x_advance += pixel_value << 6;
     }
     if ( format & HB_GPOS_FORMAT_HAVE_Y_ADVANCE_DEVICE )
     {
-      _HB_OPEN_Get_Device( &vr->YAdvanceDevice, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &vr->DeviceTables[VR_Y_ADVANCE_DEVICE], y_ppem, &pixel_value );
       gd->y_advance += pixel_value << 6;
     }
   }
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   /* values returned from mmfunc() are already in fractional pixels */
 
   if ( format & HB_GPOS_FORMAT_HAVE_X_ID_PLACEMENT )
@@ -545,6 +567,7 @@ static HB_Error  Get_ValueRecord( GPOS_Instance*    gpi,
       return error;
     gd->y_advance += value;
   }
+#endif
 
   return error;
 }
@@ -608,21 +631,21 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
 
     if ( new_offset )
     {
+      if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+        return error;
+
+      an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] = 0;
+      an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] = 0;
+
       new_offset += base_offset;
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &an->af.af3.XDeviceTable,
+	   ( error = _HB_OPEN_Load_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE],
 				  stream ) ) != HB_Err_Ok )
 	return error;
       (void)FILE_Seek( cur_offset );
     }
-    else
-    {
-      an->af.af3.XDeviceTable.StartSize  = 0;
-      an->af.af3.XDeviceTable.EndSize    = 0;
-      an->af.af3.XDeviceTable.DeltaValue = NULL;
-    }
 
     if ( ACCESS_Frame( 2L ) )
       goto Fail;
@@ -633,29 +656,37 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
 
     if ( new_offset )
     {
+      if ( !an->af.af3.DeviceTables )
+      {
+        if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+          return error;
+
+        an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] = 0;
+        an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] = 0;
+      }
+
       new_offset += base_offset;
 
       cur_offset = FILE_Pos();
       if ( FILE_Seek( new_offset ) ||
-	   ( error = _HB_OPEN_Load_Device( &an->af.af3.YDeviceTable,
+	   ( error = _HB_OPEN_Load_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE],
 				  stream ) ) != HB_Err_Ok )
 	goto Fail;
       (void)FILE_Seek( cur_offset );
     }
-    else
-    {
-      an->af.af3.YDeviceTable.StartSize  = 0;
-      an->af.af3.YDeviceTable.EndSize    = 0;
-      an->af.af3.YDeviceTable.DeltaValue = NULL;
-    }
     break;
 
   case 4:
     if ( ACCESS_Frame( 4L ) )
       return error;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     an->af.af4.XIdAnchor = GET_UShort();
     an->af.af4.YIdAnchor = GET_UShort();
+#else
+    (void) GET_UShort();
+    (void) GET_UShort();
+#endif
 
     FORGET_Frame();
     break;
@@ -667,7 +698,9 @@ static HB_Error  Load_Anchor( HB_Anchor*  an,
   return HB_Err_Ok;
 
 Fail:
-  _HB_OPEN_Free_Device( &an->af.af3.XDeviceTable );
+  _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+
+  FREE( an->af.af3.DeviceTables );
   return error;
 }
 
@@ -676,8 +709,9 @@ static void  Free_Anchor( HB_Anchor*  an)
 {
   if ( an->PosFormat == 3 )
   {
-    _HB_OPEN_Free_Device( &an->af.af3.YDeviceTable );
-    _HB_OPEN_Free_Device( &an->af.af3.XDeviceTable );
+    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE] );
+    _HB_OPEN_Free_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE] );
+    FREE( an->af.af3.DeviceTables );
   }
 }
 
@@ -690,7 +724,9 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
 {
   HB_Error  error = HB_Err_Ok;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   HB_GPOSHeader*  gpos = gpi->gpos;
+#endif
   HB_UShort        ap;
 
   HB_Short         pixel_value;
@@ -743,9 +779,12 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
   case 3:
     if ( !gpi->dvi )
     {
-      _HB_OPEN_Get_Device( &an->af.af3.XDeviceTable, x_ppem, &pixel_value );
+      if ( ALLOC_ARRAY( an->af.af3.DeviceTables, 2, HB_Device ) )
+        return error;
+
+      _HB_OPEN_Get_Device( &an->af.af3.DeviceTables[AF3_X_DEVICE_TABLE], x_ppem, &pixel_value );
       *x_value = pixel_value << 6;
-      _HB_OPEN_Get_Device( &an->af.af3.YDeviceTable, y_ppem, &pixel_value );
+      _HB_OPEN_Get_Device( &an->af.af3.DeviceTables[AF3_Y_DEVICE_TABLE], y_ppem, &pixel_value );
       *y_value = pixel_value << 6;
     }
     else
@@ -756,6 +795,7 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
     break;
 
   case 4:
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
     error = (gpos->mmfunc)( gpi->font, an->af.af4.XIdAnchor,
 			    x_value, gpos->data );
     if ( error )
@@ -766,6 +806,9 @@ static HB_Error  Get_Anchor( GPOS_Instance*   gpi,
     if ( error )
       return error;
     break;
+#else
+    return ERR(HB_Err_Not_Covered);
+#endif
   }
 
   return error;
@@ -5966,8 +6009,7 @@ HB_Error  HB_GPOS_Clear_Features( HB_GPOSHeader*  gpos )
   return HB_Err_Ok;
 }
 
-
-
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 					HB_MMFunction   mmfunc,
 					void*            data )
@@ -5980,6 +6022,7 @@ HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 
   return HB_Err_Ok;
 }
+#endif
 
 /* If `dvi' is TRUE, glyph contour points for anchor points and device
    tables are ignored -- you will get device independent values.         */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
index 2840dae..92bff84 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gpos.h
@@ -44,6 +44,7 @@ HB_BEGIN_HEADER
 #define HB_GPOS_LOOKUP_CHAIN      8
 #define HB_GPOS_LOOKUP_EXTENSION  9
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 /* A pointer to a function which accesses the PostScript interpreter.
    Multiple Master fonts need this interface to convert a metric ID
    (as stored in an OpenType font version 1.2 or higher) `metric_id'
@@ -59,6 +60,7 @@ typedef HB_Error  (*HB_MMFunction)(HB_Font       font,
 				    HB_UShort    metric_id,
 				    HB_Fixed*      metric_value,
 				    void*        data );
+#endif
 
 
 struct  HB_GPOSHeader_
@@ -71,12 +73,14 @@ struct  HB_GPOSHeader_
 
   HB_GDEFHeader*    gdef;
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
   /* this is OpenType 1.2 -- Multiple Master fonts need this
      callback function to get various metric values from the
      PostScript interpreter.                                 */
 
   HB_MMFunction     mmfunc;
   void*              data;
+#endif
 };
 
 typedef struct HB_GPOSHeader_  HB_GPOSHeader;
@@ -129,9 +133,11 @@ HB_Error  HB_GPOS_Add_Feature( HB_GPOSHeader*  gpos,
 HB_Error  HB_GPOS_Clear_Features( HB_GPOSHeader*  gpos );
 
 
+#ifdef HB_SUPPORT_MULTIPLE_MASTER
 HB_Error  HB_GPOS_Register_MM_Function( HB_GPOSHeader*  gpos,
 					HB_MMFunction   mmfunc,
 					void*            data );
+#endif
 
 /* If `dvi' is TRUE, glyph contour points for anchor points and device
    tables are ignored -- you will get device independent values.         */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
index dd5ffdf..7eb329e 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub-private.h
@@ -32,6 +32,9 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
 
 typedef union HB_GSUB_SubTable_  HB_GSUB_SubTable;
 
@@ -48,9 +51,9 @@ typedef struct HB_SingleSubstFormat1_  HB_SingleSubstFormat1;
 
 struct  HB_SingleSubstFormat2_
 {
+  HB_UShort*  Substitute;             /* array of substitute glyph IDs */
   HB_UShort   GlyphCount;             /* number of glyph IDs in
 					 Substitute array              */
-  HB_UShort*  Substitute;             /* array of substitute glyph IDs */
 };
 
 typedef struct HB_SingleSubstFormat2_  HB_SingleSubstFormat2;
@@ -58,14 +61,14 @@ typedef struct HB_SingleSubstFormat2_  HB_SingleSubstFormat2;
 
 struct  HB_SingleSubst_
 {
-  HB_UShort     SubstFormat;          /* 1 or 2         */
-  HB_Coverage  Coverage;             /* Coverage table */
-
   union
   {
     HB_SingleSubstFormat1  ssf1;
     HB_SingleSubstFormat2  ssf2;
   } ssf;
+
+  HB_Coverage  Coverage;             /* Coverage table */
+  HB_Byte     SubstFormat;            /* 1 or 2         */
 };
 
 typedef struct HB_SingleSubst_  HB_SingleSubst;
@@ -75,10 +78,10 @@ typedef struct HB_SingleSubst_  HB_SingleSubst;
 
 struct  HB_Sequence_
 {
-  HB_UShort   GlyphCount;             /* number of glyph IDs in the
-					 Substitute array           */
   HB_UShort*  Substitute;             /* string of glyph IDs to
 					 substitute                 */
+  HB_UShort   GlyphCount;             /* number of glyph IDs in the
+					 Substitute array           */
 };
 
 typedef struct HB_Sequence_  HB_Sequence;
@@ -86,10 +89,10 @@ typedef struct HB_Sequence_  HB_Sequence;
 
 struct  HB_MultipleSubst_
 {
-  HB_UShort      SubstFormat;         /* always 1                  */
+  HB_Sequence*  Sequence;            /* array of Sequence tables  */
   HB_Coverage   Coverage;            /* Coverage table            */
+  HB_UShort      SubstFormat;         /* always 1                  */
   HB_UShort      SequenceCount;       /* number of Sequence tables */
-  HB_Sequence*  Sequence;            /* array of Sequence tables  */
 };
 
 typedef struct HB_MultipleSubst_  HB_MultipleSubst;
@@ -99,9 +102,9 @@ typedef struct HB_MultipleSubst_  HB_MultipleSubst;
 
 struct  HB_AlternateSet_
 {
+  HB_UShort*  Alternate;              /* array of alternate glyph IDs */
   HB_UShort   GlyphCount;             /* number of glyph IDs in the
 					 Alternate array              */
-  HB_UShort*  Alternate;              /* array of alternate glyph IDs */
 };
 
 typedef struct HB_AlternateSet_  HB_AlternateSet;
@@ -109,11 +112,11 @@ typedef struct HB_AlternateSet_  HB_AlternateSet;
 
 struct  HB_AlternateSubst_
 {
-  HB_UShort          SubstFormat;     /* always 1                      */
+  HB_AlternateSet*  AlternateSet;    /* array of AlternateSet tables  */
   HB_Coverage       Coverage;        /* Coverage table                */
+  HB_UShort          SubstFormat;     /* always 1                      */
   HB_UShort          AlternateSetCount;
 				      /* number of AlternateSet tables */
-  HB_AlternateSet*  AlternateSet;    /* array of AlternateSet tables  */
 };
 
 typedef struct HB_AlternateSubst_  HB_AlternateSubst;
@@ -123,10 +126,10 @@ typedef struct HB_AlternateSubst_  HB_AlternateSubst;
 
 struct  HB_Ligature_
 {
+  HB_UShort*  Component;              /* array of component glyph IDs     */
   HB_UShort   LigGlyph;               /* glyphID of ligature
 					 to substitute                    */
   HB_UShort   ComponentCount;         /* number of components in ligature */
-  HB_UShort*  Component;              /* array of component glyph IDs     */
 };
 
 typedef struct HB_Ligature_  HB_Ligature;
@@ -134,8 +137,8 @@ typedef struct HB_Ligature_  HB_Ligature;
 
 struct  HB_LigatureSet_
 {
-  HB_UShort      LigatureCount;       /* number of Ligature tables */
   HB_Ligature*  Ligature;            /* array of Ligature tables  */
+  HB_UShort      LigatureCount;       /* number of Ligature tables */
 };
 
 typedef struct HB_LigatureSet_  HB_LigatureSet;
@@ -143,10 +146,10 @@ typedef struct HB_LigatureSet_  HB_LigatureSet;
 
 struct  HB_LigatureSubst_
 {
-  HB_UShort         SubstFormat;      /* always 1                     */
+  HB_LigatureSet*  LigatureSet;      /* array of LigatureSet tables  */
   HB_Coverage      Coverage;         /* Coverage table               */
+  HB_UShort         SubstFormat;      /* always 1                     */
   HB_UShort         LigatureSetCount; /* number of LigatureSet tables */
-  HB_LigatureSet*  LigatureSet;      /* array of LigatureSet tables  */
 };
 
 typedef struct HB_LigatureSubst_  HB_LigatureSubst;
@@ -168,13 +171,13 @@ typedef struct HB_SubstLookupRecord_  HB_SubstLookupRecord;
 
 struct  HB_SubRule_
 {
-  HB_UShort               GlyphCount; /* total number of input glyphs */
-  HB_UShort               SubstCount; /* number of SubstLookupRecord
-					 tables                       */
   HB_UShort*              Input;      /* array of input glyph IDs     */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of SubstLookupRecord
 					 tables                       */
+  HB_UShort               GlyphCount; /* total number of input glyphs */
+  HB_UShort               SubstCount; /* number of SubstLookupRecord
+					 tables                       */
 };
 
 typedef struct HB_SubRule_  HB_SubRule;
@@ -182,8 +185,8 @@ typedef struct HB_SubRule_  HB_SubRule;
 
 struct  HB_SubRuleSet_
 {
-  HB_UShort     SubRuleCount;         /* number of SubRule tables */
   HB_SubRule*  SubRule;              /* array of SubRule tables  */
+  HB_UShort     SubRuleCount;         /* number of SubRule tables */
 };
 
 typedef struct HB_SubRuleSet_  HB_SubRuleSet;
@@ -191,9 +194,9 @@ typedef struct HB_SubRuleSet_  HB_SubRuleSet;
 
 struct  HB_ContextSubstFormat1_
 {
+  HB_SubRuleSet*  SubRuleSet;        /* array of SubRuleSet tables  */
   HB_Coverage     Coverage;          /* Coverage table              */
   HB_UShort        SubRuleSetCount;   /* number of SubRuleSet tables */
-  HB_SubRuleSet*  SubRuleSet;        /* array of SubRuleSet tables  */
 };
 
 typedef struct HB_ContextSubstFormat1_  HB_ContextSubstFormat1;
@@ -201,13 +204,13 @@ typedef struct HB_ContextSubstFormat1_  HB_ContextSubstFormat1;
 
 struct  HB_SubClassRule_
 {
-  HB_UShort               GlyphCount; /* total number of context classes */
-  HB_UShort               SubstCount; /* number of SubstLookupRecord
-					 tables                          */
   HB_UShort*              Class;      /* array of classes                */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of SubstLookupRecord
 					 tables                          */
+  HB_UShort               GlyphCount; /* total number of context classes */
+  HB_UShort               SubstCount; /* number of SubstLookupRecord
+					 tables                          */
 };
 
 typedef struct HB_SubClassRule_  HB_SubClassRule;
@@ -215,9 +218,9 @@ typedef struct HB_SubClassRule_  HB_SubClassRule;
 
 struct  HB_SubClassSet_
 {
+  HB_SubClassRule*  SubClassRule;    /* array of SubClassRule tables  */
   HB_UShort          SubClassRuleCount;
 				      /* number of SubClassRule tables */
-  HB_SubClassRule*  SubClassRule;    /* array of SubClassRule tables  */
 };
 
 typedef struct HB_SubClassSet_  HB_SubClassSet;
@@ -229,13 +232,13 @@ typedef struct HB_SubClassSet_  HB_SubClassSet;
 
 struct  HB_ContextSubstFormat2_
 {
-  HB_UShort            MaxContextLength;
-				      /* maximal context length       */
+  HB_SubClassSet*     SubClassSet;   /* array of SubClassSet tables  */
   HB_Coverage         Coverage;      /* Coverage table               */
   HB_ClassDefinition  ClassDef;      /* ClassDef table               */
   HB_UShort            SubClassSetCount;
 				      /* number of SubClassSet tables */
-  HB_SubClassSet*     SubClassSet;   /* array of SubClassSet tables  */
+  HB_UShort            MaxContextLength;
+				      /* maximal context length       */
 };
 
 typedef struct HB_ContextSubstFormat2_  HB_ContextSubstFormat2;
@@ -243,11 +246,11 @@ typedef struct HB_ContextSubstFormat2_  HB_ContextSubstFormat2;
 
 struct  HB_ContextSubstFormat3_
 {
-  HB_UShort               GlyphCount; /* number of input glyphs        */
-  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
   HB_Coverage*           Coverage;   /* array of Coverage tables      */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of substitution lookups */
+  HB_UShort               GlyphCount; /* number of input glyphs        */
+  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
 };
 
 typedef struct HB_ContextSubstFormat3_  HB_ContextSubstFormat3;
@@ -255,14 +258,14 @@ typedef struct HB_ContextSubstFormat3_  HB_ContextSubstFormat3;
 
 struct  HB_ContextSubst_
 {
-  HB_UShort  SubstFormat;             /* 1, 2, or 3 */
-
   union
   {
     HB_ContextSubstFormat1  csf1;
     HB_ContextSubstFormat2  csf2;
     HB_ContextSubstFormat3  csf3;
   } csf;
+
+  HB_Byte  SubstFormat;               /* 1, 2, or 3 */
 };
 
 typedef struct HB_ContextSubst_  HB_ContextSubst;
@@ -272,18 +275,18 @@ typedef struct HB_ContextSubst_  HB_ContextSubst;
 
 struct  HB_ChainSubRule_
 {
+  HB_UShort*              Backtrack;  /* array of backtrack glyph IDs     */
+  HB_UShort*              Input;      /* array of input glyph IDs         */
+  HB_UShort*              Lookahead;  /* array of lookahead glyph IDs     */
+  HB_SubstLookupRecord*  SubstLookupRecord;
+				      /* array of SubstLookupRecords      */
   HB_UShort               BacktrackGlyphCount;
 				      /* total number of backtrack glyphs */
-  HB_UShort*              Backtrack;  /* array of backtrack glyph IDs     */
   HB_UShort               InputGlyphCount;
 				      /* total number of input glyphs     */
-  HB_UShort*              Input;      /* array of input glyph IDs         */
   HB_UShort               LookaheadGlyphCount;
 				      /* total number of lookahead glyphs */
-  HB_UShort*              Lookahead;  /* array of lookahead glyph IDs     */
   HB_UShort               SubstCount; /* number of SubstLookupRecords     */
-  HB_SubstLookupRecord*  SubstLookupRecord;
-				      /* array of SubstLookupRecords      */
 };
 
 typedef struct HB_ChainSubRule_  HB_ChainSubRule;
@@ -291,9 +294,9 @@ typedef struct HB_ChainSubRule_  HB_ChainSubRule;
 
 struct  HB_ChainSubRuleSet_
 {
+  HB_ChainSubRule*  ChainSubRule;    /* array of ChainSubRule tables  */
   HB_UShort          ChainSubRuleCount;
 				      /* number of ChainSubRule tables */
-  HB_ChainSubRule*  ChainSubRule;    /* array of ChainSubRule tables  */
 };
 
 typedef struct HB_ChainSubRuleSet_  HB_ChainSubRuleSet;
@@ -301,11 +304,11 @@ typedef struct HB_ChainSubRuleSet_  HB_ChainSubRuleSet;
 
 struct  HB_ChainContextSubstFormat1_
 {
+  HB_ChainSubRuleSet*  ChainSubRuleSet;
+				      /* array of ChainSubRuleSet tables  */
   HB_Coverage          Coverage;     /* Coverage table                   */
   HB_UShort             ChainSubRuleSetCount;
 				      /* number of ChainSubRuleSet tables */
-  HB_ChainSubRuleSet*  ChainSubRuleSet;
-				      /* array of ChainSubRuleSet tables  */
 };
 
 typedef struct HB_ChainContextSubstFormat1_  HB_ChainContextSubstFormat1;
@@ -313,20 +316,20 @@ typedef struct HB_ChainContextSubstFormat1_  HB_ChainContextSubstFormat1;
 
 struct  HB_ChainSubClassRule_
 {
+  HB_UShort*              Backtrack;  /* array of backtrack classes      */
+  HB_UShort*              Input;      /* array of context classes        */
+  HB_UShort*              Lookahead;  /* array of lookahead classes      */
+  HB_SubstLookupRecord*  SubstLookupRecord;
+				      /* array of substitution lookups   */
   HB_UShort               BacktrackGlyphCount;
 				      /* total number of backtrack
 					 classes                         */
-  HB_UShort*              Backtrack;  /* array of backtrack classes      */
   HB_UShort               InputGlyphCount;
 				      /* total number of context classes */
-  HB_UShort*              Input;      /* array of context classes        */
   HB_UShort               LookaheadGlyphCount;
 				      /* total number of lookahead
 					 classes                         */
-  HB_UShort*              Lookahead;  /* array of lookahead classes      */
   HB_UShort               SubstCount; /* number of SubstLookupRecords    */
-  HB_SubstLookupRecord*  SubstLookupRecord;
-				      /* array of substitution lookups   */
 };
 
 typedef struct HB_ChainSubClassRule_  HB_ChainSubClassRule;
@@ -334,12 +337,12 @@ typedef struct HB_ChainSubClassRule_  HB_ChainSubClassRule;
 
 struct  HB_ChainSubClassSet_
 {
-  HB_UShort               ChainSubClassRuleCount;
-				      /* number of ChainSubClassRule
-					 tables                      */
   HB_ChainSubClassRule*  ChainSubClassRule;
 				      /* array of ChainSubClassRule
 					 tables                      */
+  HB_UShort               ChainSubClassRuleCount;
+				      /* number of ChainSubClassRule
+					 tables                      */
 };
 
 typedef struct HB_ChainSubClassSet_  HB_ChainSubClassSet;
@@ -351,27 +354,27 @@ typedef struct HB_ChainSubClassSet_  HB_ChainSubClassSet;
 
 struct  HB_ChainContextSubstFormat2_
 {
+  HB_ChainSubClassSet*  ChainSubClassSet;
+				      /* array of ChainSubClassSet
+					 tables                     */
   HB_Coverage           Coverage;    /* Coverage table             */
 
-  HB_UShort              MaxBacktrackLength;
-				      /* maximal backtrack length   */
   HB_ClassDefinition    BacktrackClassDef;
 				      /* BacktrackClassDef table    */
-  HB_UShort              MaxInputLength;
-				      /* maximal input length       */
   HB_ClassDefinition    InputClassDef;
 				      /* InputClassDef table        */
-  HB_UShort              MaxLookaheadLength;
-				      /* maximal lookahead length   */
   HB_ClassDefinition    LookaheadClassDef;
 				      /* LookaheadClassDef table    */
 
   HB_UShort              ChainSubClassSetCount;
 				      /* number of ChainSubClassSet
 					 tables                     */
-  HB_ChainSubClassSet*  ChainSubClassSet;
-				      /* array of ChainSubClassSet
-					 tables                     */
+  HB_UShort              MaxBacktrackLength;
+				      /* maximal backtrack length   */
+  HB_UShort              MaxLookaheadLength;
+				      /* maximal lookahead length   */
+  HB_UShort              MaxInputLength;
+				      /* maximal input length       */
 };
 
 typedef struct HB_ChainContextSubstFormat2_  HB_ChainContextSubstFormat2;
@@ -379,24 +382,24 @@ typedef struct HB_ChainContextSubstFormat2_  HB_ChainContextSubstFormat2;
 
 struct  HB_ChainContextSubstFormat3_
 {
-  HB_UShort               BacktrackGlyphCount;
-				      /* number of backtrack glyphs    */
   HB_Coverage*           BacktrackCoverage;
 				      /* array of backtrack Coverage
 					 tables                        */
-  HB_UShort               InputGlyphCount;
-				      /* number of input glyphs        */
   HB_Coverage*           InputCoverage;
 				      /* array of input coverage
 					 tables                        */
-  HB_UShort               LookaheadGlyphCount;
-				      /* number of lookahead glyphs    */
   HB_Coverage*           LookaheadCoverage;
 				      /* array of lookahead coverage
 					 tables                        */
-  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
   HB_SubstLookupRecord*  SubstLookupRecord;
 				      /* array of substitution lookups */
+  HB_UShort               BacktrackGlyphCount;
+				      /* number of backtrack glyphs    */
+  HB_UShort               InputGlyphCount;
+				      /* number of input glyphs        */
+  HB_UShort               LookaheadGlyphCount;
+				      /* number of lookahead glyphs    */
+  HB_UShort               SubstCount; /* number of SubstLookupRecords  */
 };
 
 typedef struct HB_ChainContextSubstFormat3_  HB_ChainContextSubstFormat3;
@@ -404,14 +407,14 @@ typedef struct HB_ChainContextSubstFormat3_  HB_ChainContextSubstFormat3;
 
 struct  HB_ChainContextSubst_
 {
-  HB_UShort  SubstFormat;             /* 1, 2, or 3 */
-
   union
   {
     HB_ChainContextSubstFormat1  ccsf1;
     HB_ChainContextSubstFormat2  ccsf2;
     HB_ChainContextSubstFormat3  ccsf3;
   } ccsf;
+
+  HB_Byte  SubstFormat;               /* 1, 2, or 3 */
 };
 
 typedef struct HB_ChainContextSubst_  HB_ChainContextSubst;
@@ -421,9 +424,9 @@ typedef struct HB_ChainContextSubst_  HB_ChainContextSubst;
 /* LookupType 7 */
 struct HB_ExtensionSubst_
 {
+  HB_GSUB_SubTable *subtable;         /* referenced subtable */
   HB_UShort      SubstFormat;         /* always 1 */
   HB_UShort      LookuptType;         /* lookup-type of referenced subtable */
-  HB_GSUB_SubTable *subtable;         /* referenced subtable */
 };
 
 typedef struct HB_ExtensionSubst_  HB_ExtensionSubst;
@@ -433,16 +436,16 @@ typedef struct HB_ExtensionSubst_  HB_ExtensionSubst;
 /* LookupType 8 */
 struct HB_ReverseChainContextSubst_
 {
-  HB_UShort      SubstFormat;         /* always 1 */
-  HB_Coverage   Coverage;	        /* coverage table for input glyphs */
-  HB_UShort      BacktrackGlyphCount; /* number of backtrack glyphs      */
+  HB_Coverage*  LookaheadCoverage;   /* array of lookahead Coverage
+					 tables                          */
+  HB_UShort*     Substitute;          /* array of substitute Glyph ID    */
   HB_Coverage*  BacktrackCoverage;   /* array of backtrack Coverage
 					 tables                          */
+  HB_Coverage   Coverage;	        /* coverage table for input glyphs */
+  HB_UShort      SubstFormat;         /* always 1 */
+  HB_UShort      BacktrackGlyphCount; /* number of backtrack glyphs      */
   HB_UShort      LookaheadGlyphCount; /* number of lookahead glyphs      */
-  HB_Coverage*  LookaheadCoverage;   /* array of lookahead Coverage
-					 tables                          */
   HB_UShort      GlyphCount;          /* number of Glyph IDs             */
-  HB_UShort*     Substitute;          /* array of substitute Glyph ID    */
 };
 
 typedef struct HB_ReverseChainContextSubst_  HB_ReverseChainContextSubst;
@@ -471,6 +474,10 @@ HB_INTERNAL void
 _HB_GSUB_Free_SubTable( HB_GSUB_SubTable* st,
 			      HB_UShort     lookup_type );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 HB_END_HEADER
 
 #endif /* HARFBUZZ_GSUB_PRIVATE_H */
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
index 1ca3f0c..b00df44 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-gsub.h
@@ -32,6 +32,10 @@
 HB_BEGIN_HEADER
 
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Lookup types for glyph substitution */
 
 #define HB_GSUB_LOOKUP_SINGLE        1
@@ -60,6 +64,14 @@ typedef HB_UShort  (*HB_AltFunction)(HB_UInt    pos,
 
 struct  HB_GSUBHeader_
 {
+  HB_GDEFHeader*  gdef;
+
+  /* the next two fields are used for an alternate substitution callback
+     function to select the proper alternate glyph.                      */
+
+  void*            data;
+  HB_AltFunction  altfunc;
+
   HB_UInt         offset;
 
   HB_16Dot16         Version;
@@ -67,14 +79,6 @@ struct  HB_GSUBHeader_
   HB_ScriptList   ScriptList;
   HB_FeatureList  FeatureList;
   HB_LookupList   LookupList;
-
-  HB_GDEFHeader*  gdef;
-
-  /* the next two fields are used for an alternate substitution callback
-     function to select the proper alternate glyph.                      */
-
-  HB_AltFunction  altfunc;
-  void*            data;
 };
 
 typedef struct HB_GSUBHeader_   HB_GSUBHeader;
@@ -135,6 +139,9 @@ HB_Error  HB_GSUB_Register_Alternate_Function( HB_GSUBHeader*  gsub,
 HB_Error  HB_GSUB_Apply_String( HB_GSUBHeader*   gsub,
 				HB_Buffer        buffer );
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
index 73dd383..1f7b353 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open-private.h
@@ -69,7 +69,7 @@ _HB_OPEN_Load_EmptyOrClassDefinition( HB_ClassDefinition* cd,
 					       HB_UInt              base_offset,
 					       HB_Stream             input );
 HB_INTERNAL HB_Error
-_HB_OPEN_Load_Device( HB_Device* d,
+_HB_OPEN_Load_Device( HB_Device** d,
 		       HB_Stream    input );
 
 HB_INTERNAL void  _HB_OPEN_Free_ScriptList( HB_ScriptList*  sl );
@@ -79,7 +79,7 @@ HB_INTERNAL void  _HB_OPEN_Free_LookupList( HB_LookupList*  ll,
 
 HB_INTERNAL void  _HB_OPEN_Free_Coverage( HB_Coverage*  c );
 HB_INTERNAL void  _HB_OPEN_Free_ClassDefinition( HB_ClassDefinition*  cd );
-HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device*  d );
+HB_INTERNAL void  _HB_OPEN_Free_Device( HB_Device**  d );
 
 
 
@@ -93,7 +93,7 @@ _HB_OPEN_Get_Class( HB_ClassDefinition* cd,
 		    HB_UShort*          klass,
 		     HB_UShort*            index );
 HB_INTERNAL HB_Error
-_HB_OPEN_Get_Device( HB_Device* d,
+_HB_OPEN_Get_Device( HB_Device** d,
 		      HB_UShort    size,
 		      HB_Short*    value );
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open.c b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
index 0fe1e4d..255b7e6 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open.c
@@ -1282,9 +1282,10 @@ _HB_OPEN_Get_Class( HB_ClassDefinition* cd,
 
 
 HB_INTERNAL HB_Error
-_HB_OPEN_Load_Device( HB_Device* d,
+_HB_OPEN_Load_Device( HB_Device** device,
 		       HB_Stream    stream )
 {
+  HB_Device*  d;
   HB_Error   error;
 
   HB_UShort   n, count;
@@ -1295,6 +1296,14 @@ _HB_OPEN_Load_Device( HB_Device* d,
   if ( ACCESS_Frame( 6L ) )
     return error;
 
+  if ( ALLOC( *device, sizeof(HB_Device)) )
+  {
+    *device = 0;
+    return error;
+  }
+
+  d = *device;
+
   d->StartSize   = GET_UShort();
   d->EndSize     = GET_UShort();
   d->DeltaFormat = GET_UShort();
@@ -1318,11 +1327,17 @@ _HB_OPEN_Load_Device( HB_Device* d,
 	      ( 4 - d->DeltaFormat ) ) + 1;
 
   if ( ALLOC_ARRAY( d->DeltaValue, count, HB_UShort ) )
+  {
+    FREE( *device );
+    *device = 0;
     return error;
+  }
 
   if ( ACCESS_Frame( count * 2L ) )
   {
     FREE( d->DeltaValue );
+    FREE( *device );
+    *device = 0;
     return error;
   }
 
@@ -1338,9 +1353,13 @@ _HB_OPEN_Load_Device( HB_Device* d,
 
 
 HB_INTERNAL void
-_HB_OPEN_Free_Device( HB_Device* d )
+_HB_OPEN_Free_Device( HB_Device** d )
 {
-  FREE( d->DeltaValue );
+  if ( *d )
+  {
+    FREE( (*d)->DeltaValue );
+    FREE( *d );
+  }
 }
 
 
@@ -1380,12 +1399,21 @@ _HB_OPEN_Free_Device( HB_Device* d )
      mask = 0x00FF                                    */
 
 HB_INTERNAL HB_Error
-_HB_OPEN_Get_Device( HB_Device* d,
+_HB_OPEN_Get_Device( HB_Device** device,
 		      HB_UShort    size,
 		      HB_Short*    value )
 {
+  HB_Device* d;
   HB_UShort  byte, bits, mask, f, s;
+  HB_Error   error;
+
+  if ( ALLOC( *device, sizeof(HB_Device)) )
+  {
+    *device = 0;
+    return error;
+  }
 
+  d = *device;
 
   f = d->DeltaFormat;
 
@@ -1408,6 +1436,8 @@ _HB_OPEN_Get_Device( HB_Device* d,
   else
   {
     *value = 0;
+    FREE( *device );
+    *device = 0;
     return HB_Err_Not_Covered;
   }
 }
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-open.h b/src/3rdparty/harfbuzz/src/harfbuzz-open.h
index bdc6358..4ba6cf5 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-open.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-open.h
@@ -30,6 +30,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /* Use this if a feature applies to all glyphs */
 #define HB_ALL_GLYPHS                    0xFFFF
 
@@ -42,10 +46,10 @@ HB_BEGIN_HEADER
 
 struct  HB_LangSys_
 {
+  HB_UShort*  FeatureIndex;           /* array of Feature indices  */
   HB_UShort   LookupOrderOffset;      /* always 0 for TT Open 1.0  */
   HB_UShort   ReqFeatureIndex;        /* required FeatureIndex     */
   HB_UShort   FeatureCount;           /* number of Feature indices */
-  HB_UShort*  FeatureIndex;           /* array of Feature indices  */
 };
 
 typedef struct HB_LangSys_  HB_LangSys;
@@ -53,8 +57,8 @@ typedef struct HB_LangSys_  HB_LangSys;
 
 struct  HB_LangSysRecord_
 {
-  HB_UInt     LangSysTag;            /* LangSysTag identifier */
   HB_LangSys  LangSys;               /* LangSys table         */
+  HB_UInt     LangSysTag;            /* LangSysTag identifier */
 };
 
 typedef struct HB_LangSysRecord_  HB_LangSysRecord;
@@ -62,9 +66,9 @@ typedef struct HB_LangSysRecord_  HB_LangSysRecord;
 
 struct  HB_ScriptTable_
 {
+  HB_LangSysRecord*  LangSysRecord;  /* array of LangSysRecords  */
   HB_LangSys         DefaultLangSys; /* DefaultLangSys table     */
   HB_UShort           LangSysCount;   /* number of LangSysRecords */
-  HB_LangSysRecord*  LangSysRecord;  /* array of LangSysRecords  */
 };
 
 typedef struct HB_ScriptTable_  HB_ScriptTable;
@@ -81,8 +85,8 @@ typedef struct HB_ScriptRecord_  HB_ScriptRecord;
 
 struct  HB_ScriptList_
 {
-  HB_UShort          ScriptCount;     /* number of ScriptRecords */
   HB_ScriptRecord*  ScriptRecord;    /* array of ScriptRecords  */
+  HB_UShort          ScriptCount;     /* number of ScriptRecords */
 };
 
 typedef struct HB_ScriptList_  HB_ScriptList;
@@ -92,9 +96,9 @@ typedef struct HB_ScriptList_  HB_ScriptList;
 
 struct HB_Feature_
 {
+  HB_UShort*  LookupListIndex;        /* array of LookupList indices  */
   HB_UShort   FeatureParams;          /* always 0 for TT Open 1.0     */
   HB_UShort   LookupListCount;        /* number of LookupList indices */
-  HB_UShort*  LookupListIndex;        /* array of LookupList indices  */
 };
 
 typedef struct HB_Feature_  HB_Feature;
@@ -111,9 +115,9 @@ typedef struct HB_FeatureRecord_  HB_FeatureRecord;
 
 struct  HB_FeatureList_
 {
-  HB_UShort           FeatureCount;   /* number of FeatureRecords */
-  HB_FeatureRecord*  FeatureRecord;  /* array of FeatureRecords  */
   HB_UShort*		ApplyOrder;	/* order to apply features */
+  HB_FeatureRecord*  FeatureRecord;  /* array of FeatureRecords  */
+  HB_UShort           FeatureCount;   /* number of FeatureRecords */
   HB_UShort		ApplyCount;	/* number of elements in ApplyOrder */
 };
 
@@ -127,10 +131,10 @@ typedef struct HB_SubTable_  HB_SubTable;
 
 struct  HB_Lookup_
 {
+  HB_SubTable*  SubTable;            /* array of SubTables  */
   HB_UShort      LookupType;          /* Lookup type         */
   HB_UShort      LookupFlag;          /* Lookup qualifiers   */
   HB_UShort      SubTableCount;       /* number of SubTables */
-  HB_SubTable*  SubTable;            /* array of SubTables  */
 };
 
 typedef struct HB_Lookup_  HB_Lookup;
@@ -144,9 +148,9 @@ typedef struct HB_Lookup_  HB_Lookup;
 
 struct  HB_LookupList_
 {
-  HB_UShort    LookupCount;           /* number of Lookups       */
   HB_Lookup*  Lookup;                /* array of Lookup records */
   HB_UInt*     Properties;            /* array of flags          */
+  HB_UShort    LookupCount;           /* number of Lookups       */
 };
 
 typedef struct HB_LookupList_  HB_LookupList;
@@ -167,8 +171,8 @@ typedef struct HB_LookupList_  HB_LookupList;
 
 struct  HB_CoverageFormat1_
 {
-  HB_UShort   GlyphCount;             /* number of glyphs in GlyphArray */
   HB_UShort*  GlyphArray;             /* array of glyph IDs             */
+  HB_UShort   GlyphCount;             /* number of glyphs in GlyphArray */
 };
 
 typedef struct HB_CoverageFormat1_  HB_CoverageFormat1;
@@ -187,8 +191,8 @@ typedef struct HB_RangeRecord_  HB_RangeRecord;
 
 struct  HB_CoverageFormat2_
 {
-  HB_UShort         RangeCount;       /* number of RangeRecords */
   HB_RangeRecord*  RangeRecord;      /* array of RangeRecords  */
+  HB_UShort         RangeCount;       /* number of RangeRecords */
 };
 
 typedef struct HB_CoverageFormat2_  HB_CoverageFormat2;
@@ -196,7 +200,7 @@ typedef struct HB_CoverageFormat2_  HB_CoverageFormat2;
 
 struct  HB_Coverage_
 {
-  HB_UShort  CoverageFormat;          /* 1 or 2 */
+  HB_Byte    CoverageFormat;          /* 1 or 2 */
 
   union
   {
@@ -210,10 +214,10 @@ typedef struct HB_Coverage_  HB_Coverage;
 
 struct  HB_ClassDefFormat1_
 {
+  HB_UShort*  ClassValueArray;        /* array of class values       */
   HB_UShort   StartGlyph;             /* first glyph ID of the
 					 ClassValueArray             */
   HB_UShort   GlyphCount;             /* size of the ClassValueArray */
-  HB_UShort*  ClassValueArray;        /* array of class values       */
 };
 
 typedef struct HB_ClassDefFormat1_  HB_ClassDefFormat1;
@@ -231,10 +235,10 @@ typedef struct HB_ClassRangeRecord_  HB_ClassRangeRecord;
 
 struct  HB_ClassDefFormat2_
 {
-  HB_UShort              ClassRangeCount;
-				      /* number of ClassRangeRecords */
   HB_ClassRangeRecord*  ClassRangeRecord;
 				      /* array of ClassRangeRecords  */
+  HB_UShort              ClassRangeCount;
+				      /* number of ClassRangeRecords */
 };
 
 typedef struct HB_ClassDefFormat2_  HB_ClassDefFormat2;
@@ -242,15 +246,14 @@ typedef struct HB_ClassDefFormat2_  HB_ClassDefFormat2;
 
 struct  HB_ClassDefinition_
 {
-  HB_Bool    loaded;
-
-  HB_UShort  ClassFormat;             /* 1 or 2                      */
-
   union
   {
     HB_ClassDefFormat1  cd1;
     HB_ClassDefFormat2  cd2;
   } cd;
+
+  HB_Byte    ClassFormat;             /* 1 or 2                      */
+  HB_Bool    loaded;
 };
 
 typedef struct HB_ClassDefinition_  HB_ClassDefinition;
@@ -258,11 +261,11 @@ typedef struct HB_ClassDefinition_  HB_ClassDefinition;
 
 struct HB_Device_
 {
+  HB_UShort*  DeltaValue;             /* array of compressed data      */
   HB_UShort   StartSize;              /* smallest size to correct      */
   HB_UShort   EndSize;                /* largest size to correct       */
-  HB_UShort   DeltaFormat;            /* DeltaValue array data format:
+  HB_Byte     DeltaFormat;            /* DeltaValue array data format:
 					 1, 2, or 3                    */
-  HB_UShort*  DeltaValue;             /* array of compressed data      */
 };
 
 typedef struct HB_Device_  HB_Device;
@@ -276,6 +279,9 @@ enum  HB_Type_
 
 typedef enum HB_Type_  HB_Type;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index 4bc53c8..ce4d4ac 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -183,18 +183,15 @@ static void calcLineBreaks(const HB_UChar16 *uc, hb_uint32 len, HB_CharAttribute
         if (ncls >= HB_LineBreak_CR)
             goto next;
 
-        // two complex chars (thai or lao), thai_attributes might override, but here we do a best guess
-	if (cls == HB_LineBreak_SA && ncls == HB_LineBreak_SA) {
-            lineBreakType = HB_Break;
-            goto next;
-        }
-
         {
             int tcls = ncls;
+            // for south east asian chars that require a complex (dictionary analysis), the unicode
+            // standard recommends to treat them as AL. thai_attributes and other attribute methods that
+            // do dictionary analysis can override
             if (tcls >= HB_LineBreak_SA)
-                tcls = HB_LineBreak_ID;
+                tcls = HB_LineBreak_AL;
             if (cls >= HB_LineBreak_SA)
-                cls = HB_LineBreak_ID;
+                cls = HB_LineBreak_AL;
 
             int brk = breakTable[cls][tcls];
             switch (brk) {
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
index 470e27b..ab5c07a 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.h
@@ -34,6 +34,10 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 /*
    using anything else than signed or unsigned for bitfields in C is non standard,
    but accepted by almost all compilers. And it gives a significant reduction in
@@ -254,6 +258,10 @@ typedef struct HB_Font_ {
     void *userData;
 } HB_FontRec;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
+
 typedef struct HB_ShaperItem_ HB_ShaperItem;
 
 struct HB_ShaperItem_ {
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-stream.h b/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
index 9991936..a155cc2 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-stream.h
@@ -30,15 +30,21 @@
 
 HB_BEGIN_HEADER
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(push, 1)
+#endif
+
 typedef struct HB_StreamRec_
 {
     HB_Byte*       base;
+    HB_Byte*       cursor;
     HB_UInt        size;
     HB_UInt        pos;
-    
-    HB_Byte*       cursor;
 } HB_StreamRec;
 
+#ifdef HB_USE_PACKED_STRUCTS
+#pragma pack(pop)
+#endif
 
 HB_END_HEADER
 
diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
index 1d1aa2f..fc2bdbf 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-thai.c
@@ -27,57 +27,79 @@
 #include "harfbuzz-external.h"
 
 #include <assert.h>
+#include <stdio.h>
+
+typedef int (*th_brk_def)(const char*, int[], int);
+static th_brk_def th_brk = 0;
+static int libthai_resolved = 0;
+
+static void resolve_libthai()
+{
+    if (!th_brk)
+        th_brk = (th_brk_def)HB_Library_Resolve("thai", 0, "th_brk");
+    libthai_resolved = 1;
+}
+
+static void to_tis620(const HB_UChar16 *string, hb_uint32 len, const char *cstr)
+{
+    hb_uint32 i;
+    unsigned char *result = (unsigned char *)cstr;
+
+    for (i = 0; i < len; ++i) {
+        if (string[i] <= 0xa0)
+            result[i] = (unsigned char)string[i];
+        if (string[i] >= 0xe01 && string[i] <= 0xe5b)
+            result[i] = (unsigned char)(string[i] - 0xe00 + 0xa0);
+        else
+            result[i] = '?';
+    }
+}
 
 static void thaiWordBreaks(const HB_UChar16 *string, hb_uint32 len, HB_CharAttributes *attributes)
 {
-    typedef int (*th_brk_def)(const char*, int[], int);
-    static void *thaiCodec = 0;
-    static th_brk_def th_brk = 0;
-    char *cstr = 0;
+    char s[128];
+    char *cstr = s;
     int brp[128];
     int *break_positions = brp;
     hb_uint32 numbreaks;
     hb_uint32 i;
 
-    if (!thaiCodec)
-        thaiCodec = HB_TextCodecForMib(2259);
-
-    /* load libthai dynamically */
-    if (!th_brk && thaiCodec) {
-        th_brk = (th_brk_def)HB_Library_Resolve("thai", "th_brk");
-        if (!th_brk)
-            thaiCodec = 0;
-    }
+    if (!libthai_resolved)
+        resolve_libthai();
 
     if (!th_brk)
         return;
 
-    cstr = HB_TextCodec_ConvertFromUnicode(thaiCodec, string, len, 0);
-    if (!cstr)
-        return;
+    if (len > 128)
+        cstr = (char *)malloc(len*sizeof(char));
+
+    to_tis620(string, len, cstr);
 
-    break_positions = brp;
     numbreaks = th_brk(cstr, break_positions, 128);
     if (numbreaks > 128) {
         break_positions = (int *)malloc(numbreaks * sizeof(int));
         numbreaks = th_brk(cstr, break_positions, numbreaks);
     }
 
-    for (i = 0; i < len; ++i)
+    for (i = 0; i < len; ++i) {
         attributes[i].lineBreakType = HB_NoBreak;
+        attributes[i].wordBoundary = FALSE;
+    }
 
     for (i = 0; i < numbreaks; ++i) {
-        if (break_positions[i] > 0)
+        if (break_positions[i] > 0) {
             attributes[break_positions[i]-1].lineBreakType = HB_Break;
+            attributes[i].wordBoundary = TRUE;
+        }
     }
 
     if (break_positions != brp)
         free(break_positions);
 
-    HB_TextCodec_FreeResult(cstr);
+    if (len > 128)
+        free(cstr);
 }
 
-
 void HB_ThaiAttributes(HB_Script script, const HB_UChar16 *text, hb_uint32 from, hb_uint32 len, HB_CharAttributes *attributes)
 {
     assert(script == HB_Script_Thai);
diff --git a/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc b/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc
new file mode 100644
index 0000000..133577a
--- /dev/null
+++ b/src/3rdparty/harfbuzz/tests/fuzzing/fuzz.cc
@@ -0,0 +1,124 @@
+// This is a fuzzing harness for Harfbuzz. Since Harfbuzz's input is generally
+// expected to be controlled by a remote party it's a possible vector for
+// security issues.
+//
+// Fuzzing is a black-box testing scheme where the black-box (Harfbuzz's shaping
+// engine in this case) is fed random input to see if it will misbehave.
+// Misbehaviours can often be turned into security or crash issues.
+//
+// It's expected that one will generally run this under valgrind in order to get
+// better detection of problems.
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#include "../../src/harfbuzz-shaper.h"
+#include "../../src/harfbuzz-global.h"
+#include "../../src/harfbuzz-gpos.h"
+
+extern "C" {
+#include "../../contrib/harfbuzz-unicode.h"
+#include "../../contrib/harfbuzz-freetype.h"
+}
+
+static FT_Library freetype;
+
+static FT_Face loadFace(const char *path)
+{
+  FT_Face face;
+
+  if (FT_New_Face(freetype, path, /* index */ 0, &face))
+      return 0;
+  return face;
+}
+
+static const int kWidth = 100;
+static const int kHeight = 100;
+
+static int
+usage(const char *argv0) {
+  fprintf(stderr, "Usage: %s <TTF file>\n", argv0);
+  return 1;
+}
+
+int
+main(int argc, char **argv) {
+  FT_Init_FreeType(&freetype);
+
+  if (argc != 2)
+    return usage(argv[0]);
+
+  FT_Face face;
+  if (FT_New_Face(freetype, argv[1], 0 /* face index */, &face)) {
+    fprintf(stderr, "Failed to load font file\n");
+    return 1;
+  }
+
+  HB_Face hbFace = HB_NewFace(face, hb_freetype_table_sfnt_get);
+
+  HB_FontRec hbFont;
+  hbFont.klass = &hb_freetype_class;
+  hbFont.userData = face;
+  hbFont.x_ppem  = face->size->metrics.x_ppem;
+  hbFont.y_ppem  = face->size->metrics.y_ppem;
+  hbFont.x_scale = face->size->metrics.x_scale;
+  hbFont.y_scale = face->size->metrics.y_scale;
+
+  // This is the maximum number of bytes of input which we'll feed to Harfbuzz
+  // in one shot. We also overload it and make it the size of the output arrays
+  // as well. (Must be a power of two.)
+  static const unsigned kMaxInputBytes = 1024;
+  uint8_t str[kMaxInputBytes];
+
+  HB_ShaperItem shaper_item;
+  shaper_item.kerning_applied = false;
+  shaper_item.string = (HB_UChar16 *) str;
+  shaper_item.stringLength = 0;
+  shaper_item.item.bidiLevel = 0;
+  shaper_item.shaperFlags = 0;
+  shaper_item.font = &hbFont;
+  shaper_item.face = hbFace;
+  shaper_item.glyphIndicesPresent = false;
+  shaper_item.initialGlyphCount = 0;
+
+  HB_Glyph out_glyphs[kMaxInputBytes];
+  HB_GlyphAttributes out_attrs[kMaxInputBytes];
+  HB_Fixed out_advs[kMaxInputBytes];
+  HB_FixedPoint out_offsets[kMaxInputBytes];
+  unsigned short out_logClusters[kMaxInputBytes];
+
+  shaper_item.glyphs = out_glyphs;
+  shaper_item.attributes = out_attrs;
+  shaper_item.advances = out_advs;
+  shaper_item.offsets = out_offsets;
+  shaper_item.log_clusters = out_logClusters;
+  shaper_item.num_glyphs = kMaxInputBytes;
+
+  FILE *urandom = fopen("/dev/urandom", "rb");
+  if (!urandom) {
+    fprintf(stderr, "Cannot open /dev/urandom\n");
+    return 1;
+  }
+
+  for (;;) {
+    uint16_t len;
+    fread(&len, sizeof(len), 1, urandom);
+    len &= (kMaxInputBytes - 1);
+    len &= ~1;
+    fread(str, len, 1, urandom);
+
+    ssize_t iterator = 0;
+
+    for (;;) {
+      if (!hb_utf16_script_run_next(NULL, &shaper_item.item, (uint16_t *) str, len >> 1, &iterator))
+        break;
+
+      HB_ShapeItem(&shaper_item);
+    }
+  }
+
+  HB_FreeFace(hbFace);
+}
diff --git a/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp b/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
index ea03052..f0048b7 100644
--- a/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
+++ b/src/3rdparty/harfbuzz/tests/linebreaking/harfbuzz-qt.cpp
@@ -79,30 +79,9 @@ void HB_GetGraphemeAndLineBreakClass(HB_UChar32 ch, HB_GraphemeClass *grapheme,
     *lineBreak = (HB_LineBreakClass) prop->line_break_class;
 }
 
-void *HB_Library_Resolve(const char *library, const char *symbol)
+void *HB_Library_Resolve(const char *library, int version, const char *symbol)
 {
-    return QLibrary::resolve(library, symbol);
-}
-
-void *HB_TextCodecForMib(int mib)
-{
-    return QTextCodec::codecForMib(mib);
-}
-
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength)
-{
-    QByteArray data = reinterpret_cast<QTextCodec *>(codec)->fromUnicode((const QChar *)unicode, length);
-    // ### suboptimal
-    char *output = (char *)malloc(data.length() + 1);
-    memcpy(output, data.constData(), data.length() + 1);
-    if (outputLength)
-        *outputLength = data.length();
-    return output;
-}
-
-void HB_TextCodec_FreeResult(char *string)
-{
-    free(string);
+    return QLibrary::resolve(library, version, symbol);
 }
 
 }
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
index fd6125f..b0873ab 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/ChangeLog
@@ -12,6 +12,23 @@
 
         * wtf/Platform.h:
 
+2010-04-28  Simon Hausmann  <simon.hausmann@nokia.com>, Kent Hansen <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JSC's currentThreadStackBase is not reentrant on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37195
+
+        This function needs to be reentrant to avoid memory corruption on platforms where
+        the implementation uses global variables.
+
+        This patch adds a mutex lock where necessary and makes the Symbian implementation
+        reentrant.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBaseMutex):
+        (JSC::currentThreadStackBase):
+
 2010-04-14  Kent Hansen  <kent.hansen@nokia.com>
 
         Reviewed by Maciej Stachowiak.
diff --git a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
index 57f2a92..eafcc23 100644
--- a/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/javascriptcore/JavaScriptCore/runtime/Collector.cpp
@@ -637,6 +637,8 @@ static inline void* currentThreadStackBase()
 #elif OS(HPUX)
     return hpux_get_stack_base();
 #elif OS(QNX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     return currentThreadStackBaseQNX();
 #elif OS(SOLARIS)
     stack_t s;
@@ -660,19 +662,17 @@ static inline void* currentThreadStackBase()
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
 #elif OS(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
-    }
-    return (void*)stackBase;
+    TThreadStackInfo info;
+    RThread thread;
+    thread.StackInfo(info);
+    return (void*)info.iBase;
 #elif OS(HAIKU)
     thread_info threadInfo;
     get_thread_info(find_thread(NULL), &threadInfo);
     return threadInfo.stack_end;
 #elif OS(UNIX)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     static void* stackBase = 0;
     static size_t stackSize = 0;
     static pthread_t stackThread;
@@ -695,6 +695,8 @@ static inline void* currentThreadStackBase()
     }
     return static_cast<char*>(stackBase) + stackSize;
 #elif OS(WINCE)
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    MutexLocker locker(mutex);
     if (g_stackBase)
         return g_stackBase;
     else {
diff --git a/src/3rdparty/javascriptcore/VERSION b/src/3rdparty/javascriptcore/VERSION
index 1b5109a..daecc37 100644
--- a/src/3rdparty/javascriptcore/VERSION
+++ b/src/3rdparty/javascriptcore/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of JavaScriptCore from
 
 The commit imported was from the
 
-        javascriptcore-snapshot-19052010 branch/tag
+        javascriptcore-snapshot-16062010 branch/tag
 
 and has the sha1 checksum
 
-        8039ba79702d6516cf6841c9f15b324ec499bbf3
+        8b2d3443afca194f8ac50a63151dc9d19a150582
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
index 910d39a..799055d 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/BitmapImage.cpp
@@ -404,7 +404,9 @@ bool BitmapImage::internalAdvanceAnimation(bool skippingFrames)
         // Get the repetition count again.  If we weren't able to get a
         // repetition count before, we should have decoded the whole image by
         // now, so it should now be available.
-        if (repetitionCount(true) && m_repetitionsComplete >= m_repetitionCount) {
+        // Note that we don't need to special-case cAnimationLoopOnce here
+        // because it is 0 (see comments on its declaration in ImageSource.h).
+        if (repetitionCount(true) != cAnimationLoopInfinite && m_repetitionsComplete > m_repetitionCount) {
             m_animationFinished = true;
             m_desiredFrameStartTime = 0;
             --m_currentFrame;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
index 258fd0f..0853d7b 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/ImageSource.h
@@ -86,7 +86,22 @@ typedef RefPtr<SharedBitmap> NativeImagePtr;
 #endif
 #endif
 
-const int cAnimationLoopOnce = -1;
+// Right now GIFs are the only recognized image format that supports animation.
+// The animation system and the constants below are designed with this in mind.
+// GIFs have an optional 16-bit unsigned loop count that describes how an
+// animated GIF should be cycled.  If the loop count is absent, the animation
+// cycles once; if it is 0, the animation cycles infinitely; otherwise the
+// animation plays n + 1 cycles (where n is the specified loop count).  If the
+// GIF decoder defaults to cAnimationLoopOnce in the absence of any loop count
+// and translates an explicit "0" loop count to cAnimationLoopInfinite, then we
+// get a couple of nice side effects:
+//   * By making cAnimationLoopOnce be 0, we allow the animation cycling code in
+//     BitmapImage.cpp to avoid special-casing it, and simply treat all
+//     non-negative loop counts identically.
+//   * By making the other two constants negative, we avoid conflicts with any
+//     real loop count values.
+const int cAnimationLoopOnce = 0;
+const int cAnimationLoopInfinite = -1;
 const int cAnimationNone = -2;
 
 class ImageSource : public Noncopyable {
diff --git a/src/corelib/io/qbuffer.cpp b/src/corelib/io/qbuffer.cpp
index c1ff353..73c71ea 100644
--- a/src/corelib/io/qbuffer.cpp
+++ b/src/corelib/io/qbuffer.cpp
@@ -62,6 +62,9 @@ public:
     QByteArray defaultBuf;
     int ioIndex;
 
+    virtual qint64 peek(char *data, qint64 maxSize);
+    virtual QByteArray peek(qint64 maxSize);
+
 #ifndef QT_NO_QOBJECT
     // private slots
     void _q_emitSignals();
@@ -83,6 +86,21 @@ void QBufferPrivate::_q_emitSignals()
 }
 #endif
 
+qint64 QBufferPrivate::peek(char *data, qint64 maxSize)
+{
+    qint64 readBytes = qMin(maxSize, static_cast<qint64>(buf->size()) - pos);
+    memcpy(data, buf->constData() + pos, readBytes);
+    return readBytes;
+}
+
+QByteArray QBufferPrivate::peek(qint64 maxSize)
+{
+    qint64 readBytes = qMin(maxSize, static_cast<qint64>(buf->size()) - pos);
+    if (pos == 0 && maxSize >= buf->size())
+        return *buf;
+    return QByteArray(buf->constData() + pos, readBytes);
+}
+
 /*!
     \class QBuffer
     \reentrant
diff --git a/src/corelib/io/qiodevice.cpp b/src/corelib/io/qiodevice.cpp
index 223df9b..ea60792 100644
--- a/src/corelib/io/qiodevice.cpp
+++ b/src/corelib/io/qiodevice.cpp
@@ -1442,6 +1442,35 @@ bool QIODevicePrivate::putCharHelper(char c)
     return q_func()->write(&c, 1) == 1;
 }
 
+/*!
+    \internal
+*/
+qint64 QIODevicePrivate::peek(char *data, qint64 maxSize)
+{
+    qint64 readBytes = q_func()->read(data, maxSize);
+    if (readBytes <= 0)
+        return readBytes;
+
+    buffer.ungetBlock(data, readBytes);
+    pos -= readBytes;
+    return readBytes;
+}
+
+/*!
+    \internal
+*/
+QByteArray QIODevicePrivate::peek(qint64 maxSize)
+{
+    QByteArray result = q_func()->read(maxSize);
+
+    if (result.isEmpty())
+        return result;
+
+    buffer.ungetBlock(result.constData(), result.size());
+    pos -= result.size();
+    return result;
+}
+
 /*! \fn bool QIODevice::getChar(char *c)
 
     Reads one character from the device and stores it in \a c. If \a c
@@ -1476,11 +1505,7 @@ bool QIODevice::getChar(char *c)
 */
 qint64 QIODevice::peek(char *data, qint64 maxSize)
 {
-    qint64 readBytes = read(data, maxSize);
-    int i = readBytes;
-    while (i > 0)
-        ungetChar(data[i-- - 1]);
-    return readBytes;
+    return d_func()->peek(data, maxSize);
 }
 
 /*!
@@ -1502,12 +1527,7 @@ qint64 QIODevice::peek(char *data, qint64 maxSize)
 */
 QByteArray QIODevice::peek(qint64 maxSize)
 {
-    QByteArray result = read(maxSize);
-    int i = result.size();
-    const char *data = result.constData();
-    while (i > 0)
-        ungetChar(data[i-- - 1]);
-    return result;
+    return d_func()->peek(maxSize);
 }
 
 /*!
diff --git a/src/corelib/io/qiodevice_p.h b/src/corelib/io/qiodevice_p.h
index 94dadca..4a25562 100644
--- a/src/corelib/io/qiodevice_p.h
+++ b/src/corelib/io/qiodevice_p.h
@@ -151,6 +151,15 @@ public:
         len++;
         *first = c;
     }
+    void ungetBlock(const char* block, int size) {
+        if ((first - buf) < size) {
+            // underflow, the existing valid data needs to move to the end of the (potentially bigger) buffer
+            makeSpace(len + size, freeSpaceAtStart);
+            memcpy(first - size, block, size);
+        }
+        first -= size;
+        len += size;
+    }
 
 private:
     enum FreeSpacePos {freeSpaceAtStart, freeSpaceAtEnd};
@@ -222,7 +231,9 @@ public:
             accessMode = q_func()->isSequential() ? Sequential : RandomAccess;
         return accessMode == Sequential;
     }
-    
+
+    virtual qint64 peek(char *data, qint64 maxSize);
+    virtual QByteArray peek(qint64 maxSize);
 
 #ifdef QT_NO_QOBJECT
     QIODevice *q_ptr;
diff --git a/src/corelib/tools/qharfbuzz.cpp b/src/corelib/tools/qharfbuzz.cpp
index 1b6d334..9166a14 100644
--- a/src/corelib/tools/qharfbuzz.cpp
+++ b/src/corelib/tools/qharfbuzz.cpp
@@ -102,45 +102,15 @@ HB_UChar16 HB_GetMirroredChar(HB_UChar16 ch)
     return QChar::mirroredChar(ch);
 }
 
-void *HB_Library_Resolve(const char *library, const char *symbol)
+void *HB_Library_Resolve(const char *library, int version, const char *symbol)
 {
 #ifdef QT_NO_LIBRARY
     return 0;
 #else
-    return QLibrary::resolve(QLatin1String(library), symbol);
+    return QLibrary::resolve(QLatin1String(library), version, symbol);
 #endif
 }
 
-void *HB_TextCodecForMib(int mib)
-{
-#ifndef QT_NO_TEXTCODEC
-    return QTextCodec::codecForMib(mib);
-#else
-    return 0;
-#endif
-}
-
-char *HB_TextCodec_ConvertFromUnicode(void *codec, const HB_UChar16 *unicode, hb_uint32 length, hb_uint32 *outputLength)
-{
-#ifndef QT_NO_TEXTCODEC
-    QByteArray data = reinterpret_cast<QTextCodec *>(codec)->fromUnicode((const QChar *)unicode, length);
-    // ### suboptimal
-    char *output = (char *)malloc(data.length() + 1);
-    Q_CHECK_PTR(output);
-    memcpy(output, data.constData(), data.length() + 1);
-    if (outputLength)
-        *outputLength = data.length();
-    return output;
-#else
-    return 0;
-#endif
-}
-
-void HB_TextCodec_FreeResult(char *string)
-{
-    free(string);
-}
-
 } // extern "C"
 
 QT_BEGIN_NAMESPACE
diff --git a/src/corelib/tools/qtextboundaryfinder.cpp b/src/corelib/tools/qtextboundaryfinder.cpp
index 9205297..bcddcb2 100644
--- a/src/corelib/tools/qtextboundaryfinder.cpp
+++ b/src/corelib/tools/qtextboundaryfinder.cpp
@@ -131,6 +131,11 @@ static void init(QTextBoundaryFinder::BoundaryType type, const QChar *chars, int
     Line break boundaries give possible places where a line break
     might happen and sentence boundaries will show the beginning and
     end of whole sentences.
+
+    The first position in a string is always a valid boundary and
+    refers to the position before the first character. The last
+    position at the length of the string is also valid and refers
+    to the position after the last character.
 */
 
 /*!
@@ -363,7 +368,8 @@ int QTextBoundaryFinder::toNextBoundary()
             ++pos;
         break;
     case Line:
-        while (pos < length && d->attributes[pos].lineBreakType < HB_Break)
+        Q_ASSERT(pos);
+        while (pos < length && d->attributes[pos-1].lineBreakType < HB_Break)
             ++pos;
         break;
     }
@@ -405,7 +411,7 @@ int QTextBoundaryFinder::toPreviousBoundary()
             --pos;
         break;
     case Line:
-        while (pos > 0 && d->attributes[pos].lineBreakType < HB_Break)
+        while (pos > 0 && d->attributes[pos-1].lineBreakType < HB_Break)
             --pos;
         break;
     }
@@ -430,7 +436,7 @@ bool QTextBoundaryFinder::isAtBoundary() const
     case Word:
         return d->attributes[pos].wordBoundary;
     case Line:
-        return d->attributes[pos].lineBreakType >= HB_Break;
+        return (pos > 0) ? d->attributes[pos-1].lineBreakType >= HB_Break : true;
     case Sentence:
         return d->attributes[pos].sentenceBoundary;
     }
diff --git a/src/declarative/graphicsitems/qdeclarativeflickable.cpp b/src/declarative/graphicsitems/qdeclarativeflickable.cpp
index fdc1444..6dfd4d9 100644
--- a/src/declarative/graphicsitems/qdeclarativeflickable.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeflickable.cpp
@@ -1214,6 +1214,7 @@ bool QDeclarativeFlickable::sendMouseEvent(QGraphicsSceneMouseEvent *event)
         default:
             break;
         }
+        stealThisEvent = d->stealMouse;   // Update stealThisEvent and grabber in case changed by function calls above
         grabber = qobject_cast<QDeclarativeItem*>(s->mouseGrabberItem());
         if (grabber && stealThisEvent && !grabber->keepMouseGrab() && grabber != this) {
             d->clearDelayedPress();
diff --git a/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp b/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
index 0be8dac..b198077 100644
--- a/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
+++ b/src/declarative/graphicsitems/qdeclarativeitemsmodule.cpp
@@ -79,8 +79,24 @@
 #endif
 #include "private/qdeclarativeanchors_p.h"
 
+static QDeclarativePrivate::AutoParentResult qgraphicsobject_autoParent(QObject *obj, QObject *parent)
+{
+    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(obj);
+    if (!gobj)
+        return QDeclarativePrivate::IncompatibleObject;
+
+    QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parent);
+    if (!gparent)
+        return QDeclarativePrivate::IncompatibleParent;
+
+    gobj->setParentItem(gparent);
+    return QDeclarativePrivate::Parented;
+}
+
 void QDeclarativeItemModule::defineModule()
 {
+    QDeclarativePrivate::registerAutoParentFunction(qgraphicsobject_autoParent);
+
 #ifdef QT_NO_MOVIE
     qmlRegisterTypeNotAvailable("Qt",4,7,"AnimatedImage",
         qApp->translate("QDeclarativeAnimatedImage","Qt was built without support for QMovie"));
diff --git a/src/declarative/graphicsitems/qdeclarativepositioners.cpp b/src/declarative/graphicsitems/qdeclarativepositioners.cpp
index ad61bab..b9231a1 100644
--- a/src/declarative/graphicsitems/qdeclarativepositioners.cpp
+++ b/src/declarative/graphicsitems/qdeclarativepositioners.cpp
@@ -358,6 +358,8 @@ Column {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Column.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Row, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -502,6 +504,8 @@ Row {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Row.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Column, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -657,6 +661,8 @@ Grid {
   positioner may exhibit strange behaviour. If you need to perform any of these
   actions, consider positioning the items without the use of a Grid.
 
+  Items with a width or height of 0 will not be positioned.
+
   \sa Flow, {declarative/positioners}{Positioners example}
 */
 /*!
@@ -913,6 +919,8 @@ void QDeclarativeGrid::reportConflictingAnchors()
   positioner may exhibit strange behaviour.  If you need to perform any of these
   actions, consider positioning the items without the use of a Flow.
 
+  Items with a width or height of 0 will not be positioned.
+
     \sa Grid, {declarative/positioners}{Positioners example}
 */
 /*!
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput.cpp b/src/declarative/graphicsitems/qdeclarativetextinput.cpp
index cba01ef..9e5dfb5 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput.cpp
+++ b/src/declarative/graphicsitems/qdeclarativetextinput.cpp
@@ -100,6 +100,7 @@ void QDeclarativeTextInput::setText(const QString &s)
     if(s == text())
         return;
     d->control->setText(s);
+    d->updateHorizontalScroll();
     //emit textChanged();
 }
 
@@ -337,6 +338,7 @@ void QDeclarativeTextInput::setHAlign(HAlignment align)
         return;
     d->hAlign = align;
     updateRect();
+    d->updateHorizontalScroll();
     emit horizontalAlignmentChanged(d->hAlign);
 }
 
@@ -554,7 +556,9 @@ void QDeclarativeTextInput::setAutoScroll(bool b)
         return;
 
     d->autoScroll = b;
-
+    d->updateHorizontalScroll();
+    //We need to repaint so that the scrolling is taking into account.
+    updateSize(true);
     emit autoScrollChanged(d->autoScroll);
 }
 
@@ -836,17 +840,23 @@ void QDeclarativeTextInput::moveCursor()
     Q_D(QDeclarativeTextInput);
     if(!d->cursorItem)
         return;
+    d->updateHorizontalScroll();
     d->cursorItem->setX(d->control->cursorToX() - d->hscroll);
 }
 
 /*!
-    \qmlmethod rect TextInput::positionToRectangle(int x)
+    \qmlmethod rect TextInput::positionToRectangle(int pos)
+
+    This function takes a character position and returns the rectangle that the
+    cursor would occupy, if it was placed at that character position.
+
+    This is similar to setting the cursorPosition, and then querying the cursor
+    rectangle, but the cursorPosition is not changed.
 */
-QRectF QDeclarativeTextInput::positionToRectangle(int x) const
+QRectF QDeclarativeTextInput::positionToRectangle(int pos) const
 {
     Q_D(const QDeclarativeTextInput);
-    QFontMetrics fm = QFontMetrics(d->font);
-    return QRectF(d->control->cursorToX(x)-d->hscroll,
+    return QRectF(d->control->cursorToX(pos)-d->hscroll,
         0.0,
         d->control->cursorWidth(),
         cursorRectangle().height());
@@ -1006,61 +1016,73 @@ void QDeclarativeTextInput::geometryChanged(const QRectF &newGeometry,
     QDeclarativePaintedItem::geometryChanged(newGeometry, oldGeometry);
 }
 
-void QDeclarativeTextInput::drawContents(QPainter *p, const QRect &r)
+void QDeclarativeTextInputPrivate::updateHorizontalScroll()
 {
-    Q_D(QDeclarativeTextInput);
-    p->setRenderHint(QPainter::TextAntialiasing, true);
-    p->save();
-    p->setPen(QPen(d->color));
-    int flags = QLineControl::DrawText;
-    if(!isReadOnly() && d->cursorVisible && !d->cursorItem)
-        flags |= QLineControl::DrawCursor;
-    if (d->control->hasSelectedText())
-            flags |= QLineControl::DrawSelections;
-    QPoint offset = QPoint(0,0);
-    QFontMetrics fm = QFontMetrics(d->font);
-    int cix = qRound(d->control->cursorToX());
-    QRect br(boundingRect().toRect());
+    Q_Q(QDeclarativeTextInput);
+    QFontMetrics fm = QFontMetrics(font);
+    int cix = qRound(control->cursorToX());
+    QRect br(q->boundingRect().toRect());
     //###Is this using bearing appropriately?
     int minLB = qMax(0, -fm.minLeftBearing());
     int minRB = qMax(0, -fm.minRightBearing());
-    int widthUsed = qRound(d->control->naturalTextWidth()) + 1 + minRB;
-    if (d->autoScroll) {
+    int widthUsed = qRound(control->naturalTextWidth()) + 1 + minRB;
+    if (autoScroll) {
         if ((minLB + widthUsed) <=  br.width()) {
             // text fits in br; use hscroll for alignment
-            switch (d->hAlign & ~(Qt::AlignAbsolute|Qt::AlignVertical_Mask)) {
+            switch (hAlign & ~(Qt::AlignAbsolute|Qt::AlignVertical_Mask)) {
             case Qt::AlignRight:
-                d->hscroll = widthUsed - br.width() + 1;
+                hscroll = widthUsed - br.width() + 1;
                 break;
             case Qt::AlignHCenter:
-                d->hscroll = (widthUsed - br.width()) / 2;
+                hscroll = (widthUsed - br.width()) / 2;
                 break;
             default:
                 // Left
-                d->hscroll = 0;
+                hscroll = 0;
                 break;
             }
-            d->hscroll -= minLB;
-        } else if (cix - d->hscroll >= br.width()) {
+            hscroll -= minLB;
+        } else if (cix - hscroll >= br.width()) {
             // text doesn't fit, cursor is to the right of br (scroll right)
-            d->hscroll = cix - br.width() + 1;
-        } else if (cix - d->hscroll < 0 && d->hscroll < widthUsed) {
+            hscroll = cix - br.width() + 1;
+        } else if (cix - hscroll < 0 && hscroll < widthUsed) {
             // text doesn't fit, cursor is to the left of br (scroll left)
-            d->hscroll = cix;
-        } else if (widthUsed - d->hscroll < br.width()) {
+            hscroll = cix;
+        } else if (widthUsed - hscroll < br.width()) {
             // text doesn't fit, text document is to the left of br; align
             // right
-            d->hscroll = widthUsed - br.width() + 1;
+            hscroll = widthUsed - br.width() + 1;
+        }
+    } else {
+        if(hAlign == QDeclarativeTextInput::AlignRight){
+            hscroll = q->width() - widthUsed;
+        }else if(hAlign == QDeclarativeTextInput::AlignHCenter){
+            hscroll = (q->width() - widthUsed) / 2;
+        } else {
+            hscroll = 0;
         }
+        hscroll -= minLB;
+    }
+}
+
+void QDeclarativeTextInput::drawContents(QPainter *p, const QRect &r)
+{
+    Q_D(QDeclarativeTextInput);
+    p->setRenderHint(QPainter::TextAntialiasing, true);
+    p->save();
+    p->setPen(QPen(d->color));
+    int flags = QLineControl::DrawText;
+    if(!isReadOnly() && d->cursorVisible && !d->cursorItem)
+        flags |= QLineControl::DrawCursor;
+    if (d->control->hasSelectedText())
+            flags |= QLineControl::DrawSelections;
+    QPoint offset = QPoint(0,0);
+    QFontMetrics fm = QFontMetrics(d->font);
+    QRect br(boundingRect().toRect());
+    if (d->autoScroll) {
         // the y offset is there to keep the baseline constant in case we have script changes in the text.
         offset = br.topLeft() - QPoint(d->hscroll, d->control->ascent() - fm.ascent());
     } else {
-        if(d->hAlign == AlignRight){
-            d->hscroll = width() - widthUsed;
-        }else if(d->hAlign == AlignHCenter){
-            d->hscroll = (width() - widthUsed) / 2;
-        }
-        d->hscroll -= minLB;
         offset = QPoint(d->hscroll, 0);
     }
     d->control->draw(p, offset, r, flags);
@@ -1230,6 +1252,7 @@ void QDeclarativeTextInput::moveCursorSelection(int position)
 {
     Q_D(QDeclarativeTextInput);
     d->control->moveCursor(position, true);
+    d->updateHorizontalScroll();
 }
 
 /*!
@@ -1420,6 +1443,7 @@ void QDeclarativeTextInput::selectionChanged()
 void QDeclarativeTextInput::q_textChanged()
 {
     Q_D(QDeclarativeTextInput);
+    d->updateHorizontalScroll();
     updateSize();
     emit textChanged();
     if(hasAcceptableInput() != d->oldValidity){
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput_p.h b/src/declarative/graphicsitems/qdeclarativetextinput_p.h
index c539bd3..03f55ae 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput_p.h
+++ b/src/declarative/graphicsitems/qdeclarativetextinput_p.h
@@ -112,7 +112,7 @@ public:
 
     //Auxilliary functions needed to control the TextInput from QML
     Q_INVOKABLE int positionAt(int x) const;
-    Q_INVOKABLE QRectF positionToRectangle(int x) const;
+    Q_INVOKABLE QRectF positionToRectangle(int pos) const;
     Q_INVOKABLE void moveCursorSelection(int pos);
 
     Q_INVOKABLE void openSoftwareInputPanel();
diff --git a/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h b/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
index 6865147..8b74bcc 100644
--- a/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
+++ b/src/declarative/graphicsitems/qdeclarativetextinput_p_p.h
@@ -99,6 +99,7 @@ public:
     void init();
     void startCreatingCursor();
     void focusChanged(bool hasFocus);
+    void updateHorizontalScroll();
 
     QLineControl* control;
 
diff --git a/src/declarative/qml/qdeclarativecomponent.cpp b/src/declarative/qml/qdeclarativecomponent.cpp
index 55ee783..b4919ff 100644
--- a/src/declarative/qml/qdeclarativecomponent.cpp
+++ b/src/declarative/qml/qdeclarativecomponent.cpp
@@ -60,7 +60,6 @@
 #include <QFileInfo>
 #include <QtCore/qdebug.h>
 #include <QApplication>
-#include <QGraphicsObject>
 
 QT_BEGIN_NAMESPACE
 
@@ -579,20 +578,26 @@ QScriptValue QDeclarativeComponent::createObject(QObject* parent)
     if (!ret)
         return QScriptValue(QScriptValue::NullValue);
 
-    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(ret);
-    bool needParent = (gobj != 0);
-    if(parent){
+
+    if (parent) {
         ret->setParent(parent);
-        if (gobj) {
-            QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parent);
-            if(gparent){
-                gobj->setParentItem(gparent);
+        QList<QDeclarativePrivate::AutoParentFunction> functions = QDeclarativeMetaType::parentFunctions();
+
+        bool needParent = false;
+
+        for (int ii = 0; ii < functions.count(); ++ii) {
+            QDeclarativePrivate::AutoParentResult res = functions.at(ii)(ret, parent);
+            if (res == QDeclarativePrivate::Parented) {
                 needParent = false;
+                break;
+            } else if (res == QDeclarativePrivate::IncompatibleParent) {
+                needParent = true;
             }
         }
+
+        if (needParent) 
+            qWarning("QDeclarativeComponent: Created graphical object was not placed in the graphics scene.");
     }
-    if(needParent)
-        qWarning("QDeclarativeComponent: Created graphical object was not placed in the graphics scene.");
 
     QDeclarativeEnginePrivate *priv = QDeclarativeEnginePrivate::get(d->engine);
     QDeclarativeData::get(ret, true)->setImplicitDestructible();
diff --git a/src/declarative/qml/qdeclarativeengine.cpp b/src/declarative/qml/qdeclarativeengine.cpp
index 0715624..5c4d229 100644
--- a/src/declarative/qml/qdeclarativeengine.cpp
+++ b/src/declarative/qml/qdeclarativeengine.cpp
@@ -93,7 +93,6 @@
 #include <QtGui/qcolor.h>
 #include <QtGui/qvector3d.h>
 #include <QtGui/qsound.h>
-#include <QGraphicsObject>
 #include <QtCore/qcryptographichash.h>
 
 #include <private/qobject_p.h>
@@ -1195,10 +1194,12 @@ QScriptValue QDeclarativeEnginePrivate::createQmlObject(QScriptContext *ctxt, QS
     Q_ASSERT(obj);
 
     obj->setParent(parentArg);
-    QGraphicsObject* gobj = qobject_cast<QGraphicsObject*>(obj);
-    QGraphicsObject* gparent = qobject_cast<QGraphicsObject*>(parentArg);
-    if(gobj && gparent)
-        gobj->setParentItem(gparent);
+
+    QList<QDeclarativePrivate::AutoParentFunction> functions = QDeclarativeMetaType::parentFunctions();
+    for (int ii = 0; ii < functions.count(); ++ii) {
+        if (QDeclarativePrivate::Parented == functions.at(ii)(obj, parentArg))
+            break;
+    }
 
     QDeclarativeData::get(obj, true)->setImplicitDestructible();
     return activeEnginePriv->objectClass->newQObject(obj, QMetaType::QObjectStar);
diff --git a/src/declarative/qml/qdeclarativemetatype.cpp b/src/declarative/qml/qdeclarativemetatype.cpp
index 5fcb7ee..c32cab6 100644
--- a/src/declarative/qml/qdeclarativemetatype.cpp
+++ b/src/declarative/qml/qdeclarativemetatype.cpp
@@ -112,6 +112,8 @@ struct QDeclarativeMetaTypeData
     QBitArray objects;
     QBitArray interfaces;
     QBitArray lists;
+
+    QList<QDeclarativePrivate::AutoParentFunction> parentFunctions;
 };
 Q_GLOBAL_STATIC(QDeclarativeMetaTypeData, metaTypeData)
 Q_GLOBAL_STATIC(QReadWriteLock, metaTypeDataLock)
@@ -483,6 +485,16 @@ int QDeclarativeType::index() const
     return d->m_index;
 }
 
+int QDeclarativePrivate::registerAutoParentFunction(AutoParentFunction function)
+{
+    QWriteLocker lock(metaTypeDataLock());
+    QDeclarativeMetaTypeData *data = metaTypeData();
+
+    data->parentFunctions.append(function);
+
+    return data->parentFunctions.count() - 1;
+}
+
 int QDeclarativePrivate::registerType(const QDeclarativePrivate::RegisterInterface &interface)
 {
     if (interface.version > 0) 
@@ -583,6 +595,13 @@ bool QDeclarativeMetaType::isModule(const QByteArray &module, int versionMajor,
                     ((*it).vmajor_min == versionMajor && (*it).vminor_min <= versionMinor))));
 }
 
+QList<QDeclarativePrivate::AutoParentFunction> QDeclarativeMetaType::parentFunctions()
+{
+    QReadLocker lock(metaTypeDataLock());
+    QDeclarativeMetaTypeData *data = metaTypeData();
+    return data->parentFunctions;
+}
+
 QObject *QDeclarativeMetaType::toQObject(const QVariant &v, bool *ok)
 {
     if (!isQObject(v.userType())) {
diff --git a/src/declarative/qml/qdeclarativemetatype_p.h b/src/declarative/qml/qdeclarativemetatype_p.h
index bf6a700..4c98b6f 100644
--- a/src/declarative/qml/qdeclarativemetatype_p.h
+++ b/src/declarative/qml/qdeclarativemetatype_p.h
@@ -99,6 +99,8 @@ public:
     static StringConverter customStringConverter(int);
 
     static bool isModule(const QByteArray &module, int versionMajor, int versionMinor);
+
+    static QList<QDeclarativePrivate::AutoParentFunction> parentFunctions();
 };
 
 class QDeclarativeTypePrivate;
diff --git a/src/declarative/qml/qdeclarativeprivate.h b/src/declarative/qml/qdeclarativeprivate.h
index e657dd5..cd859fe 100644
--- a/src/declarative/qml/qdeclarativeprivate.h
+++ b/src/declarative/qml/qdeclarativeprivate.h
@@ -214,6 +214,10 @@ namespace QDeclarativePrivate
         const char *iid;
     };
 
+    enum AutoParentResult { Parented, IncompatibleObject, IncompatibleParent };
+    typedef AutoParentResult (*AutoParentFunction)(QObject *object, QObject *parent);
+
+    int Q_DECLARATIVE_EXPORT registerAutoParentFunction(AutoParentFunction);
     int Q_DECLARATIVE_EXPORT registerType(const RegisterType &);
     int Q_DECLARATIVE_EXPORT registerType(const RegisterInterface &);
 
diff --git a/src/declarative/util/qdeclarativepackage.cpp b/src/declarative/util/qdeclarativepackage.cpp
index b149120..1e49ad9 100644
--- a/src/declarative/util/qdeclarativepackage.cpp
+++ b/src/declarative/util/qdeclarativepackage.cpp
@@ -74,7 +74,7 @@ QT_BEGIN_NAMESPACE
 */
 
 /*!
-    \qmlattachedproperty bool Package::name
+    \qmlattachedproperty string Package::name
     This attached property holds the name of an item within a Package.
 */
 
diff --git a/src/gui/graphicsview/qgraphicsgridlayout.cpp b/src/gui/graphicsview/qgraphicsgridlayout.cpp
index 6ca799d..83db3ec 100644
--- a/src/gui/graphicsview/qgraphicsgridlayout.cpp
+++ b/src/gui/graphicsview/qgraphicsgridlayout.cpp
@@ -572,6 +572,18 @@ void QGraphicsGridLayout::removeAt(int index)
         if (QGraphicsLayoutItem *layoutItem = gridItem->layoutItem())
             layoutItem->setParentLayoutItem(0);
         d->engine.removeItem(gridItem);
+
+        // recalculate rowInfo.count if we remove an item that is on the right/bottommost row
+        for (int j = 0; j < NOrientations; ++j) {
+            // 0: Hor, 1: Ver
+            const Qt::Orientation orient = (j == 0 ? Qt::Horizontal : Qt::Vertical);
+            const int oldCount = d->engine.rowCount(orient);
+            if (gridItem->lastRow(orient) == oldCount - 1) {
+                const int newCount = d->engine.effectiveLastRow(orient) + 1;
+                d->engine.removeRows(newCount, oldCount - newCount, orient);
+            }
+        }
+
         delete gridItem;
         invalidate();
     }
diff --git a/src/gui/graphicsview/qgraphicsitem.cpp b/src/gui/graphicsview/qgraphicsitem.cpp
index 51acf9b..2de3638 100644
--- a/src/gui/graphicsview/qgraphicsitem.cpp
+++ b/src/gui/graphicsview/qgraphicsitem.cpp
@@ -3277,7 +3277,8 @@ void QGraphicsItemPrivate::setFocusHelper(Qt::FocusReason focusReason, bool clim
 */
 void QGraphicsItem::clearFocus()
 {
-    d_ptr->clearFocusHelper(/* giveFocusToParent = */ true);
+    if (hasFocus())
+        d_ptr->clearFocusHelper(/* giveFocusToParent = */ true);
 }
 
 /*!
diff --git a/src/gui/graphicsview/qgraphicslinearlayout.cpp b/src/gui/graphicsview/qgraphicslinearlayout.cpp
index 9722683..b828722 100644
--- a/src/gui/graphicsview/qgraphicslinearlayout.cpp
+++ b/src/gui/graphicsview/qgraphicslinearlayout.cpp
@@ -147,7 +147,7 @@ void QGraphicsLinearLayoutPrivate::removeGridItem(QGridLayoutItem *gridItem)
 {
     int index = gridItem->firstRow(orientation);
     engine.removeItem(gridItem);
-    engine.removeRow(index, orientation);
+    engine.removeRows(index, 1, orientation);
 }
 
 void QGraphicsLinearLayoutPrivate::fixIndex(int *index) const
diff --git a/src/gui/graphicsview/qgraphicsscene.cpp b/src/gui/graphicsview/qgraphicsscene.cpp
index 6c5623e..ca3b56f 100644
--- a/src/gui/graphicsview/qgraphicsscene.cpp
+++ b/src/gui/graphicsview/qgraphicsscene.cpp
@@ -6277,7 +6277,8 @@ void QGraphicsScenePrivate::cancelGesturesForChildren(QGesture *original)
 {
     Q_ASSERT(original);
     QGraphicsItem *originalItem = gestureTargets.value(original);
-    Q_ASSERT(originalItem);
+    if (originalItem == 0) // we only act on accepted gestures, which implies it has a target.
+        return;
 
     // iterate over all active gestures and for each find the owner
     // if the owner is part of our sub-hierarchy, cancel it.
diff --git a/src/gui/graphicsview/qgridlayoutengine_p.h b/src/gui/graphicsview/qgridlayoutengine_p.h
index cbf704e..9ac9a8e 100644
--- a/src/gui/graphicsview/qgridlayoutengine_p.h
+++ b/src/gui/graphicsview/qgridlayoutengine_p.h
@@ -363,8 +363,8 @@ public:
     QGridLayoutItem *itemAt(int row, int column, Qt::Orientation orientation = Qt::Vertical) const;
     inline void insertRow(int row, Qt::Orientation orientation = Qt::Vertical)
         { insertOrRemoveRows(row, +1, orientation); }
-    inline void removeRow(int row, Qt::Orientation orientation = Qt::Vertical)
-        { insertOrRemoveRows(row, -1, orientation); }
+    inline void removeRows(int row, int count, Qt::Orientation orientation)
+        { insertOrRemoveRows(row, -count, orientation); }
 
     void invalidate();
     void setGeometries(const QLayoutStyleInfo &styleInfo, const QRectF &contentsGeometry);
diff --git a/src/gui/kernel/qapplication_s60.cpp b/src/gui/kernel/qapplication_s60.cpp
index a50fd95..d5d4be6 100644
--- a/src/gui/kernel/qapplication_s60.cpp
+++ b/src/gui/kernel/qapplication_s60.cpp
@@ -2196,4 +2196,29 @@ void QApplication::restoreOverrideCursor()
 
 #endif // QT_NO_CURSOR
 
+QS60ThreadLocalData::QS60ThreadLocalData()
+{
+    CCoeEnv *env = CCoeEnv::Static();
+    if (env) {
+        //if this is the UI thread, share objects owned by CONE
+        usingCONEinstances = true;
+        wsSession = env->WsSession();
+        screenDevice = env->ScreenDevice();
+    }
+    else {
+        usingCONEinstances = false;
+        qt_symbian_throwIfError(wsSession.Connect(qt_s60GetRFs()));
+        screenDevice = new CWsScreenDevice(wsSession);
+        screenDevice->Construct();
+    }
+}
+
+QS60ThreadLocalData::~QS60ThreadLocalData()
+{
+    if (!usingCONEinstances) {
+        delete screenDevice;
+        wsSession.Close();
+    }
+}
+
 QT_END_NAMESPACE
diff --git a/src/gui/kernel/qclipboard_x11.cpp b/src/gui/kernel/qclipboard_x11.cpp
index 3bdc971..9fcc718 100644
--- a/src/gui/kernel/qclipboard_x11.cpp
+++ b/src/gui/kernel/qclipboard_x11.cpp
@@ -1518,7 +1518,7 @@ bool qt_xfixes_selection_changed(Window selectionOwner, Time timestamp)
           (unsigned int)(d ? d->timestamp : 0), (unsigned int)timestamp);
 #endif
     if (!owner || (selectionOwner && selectionOwner != owner->internalWinId()) ||
-        (!selectionOwner && d->timestamp != CurrentTime && d->timestamp < timestamp))
+        (!selectionOwner && (d->timestamp == CurrentTime || d->timestamp < timestamp)))
         return qt_check_selection_sentinel();
     return false;
 }
@@ -1532,7 +1532,7 @@ bool qt_xfixes_clipboard_changed(Window clipboardOwner, Time timestamp)
           (unsigned int)(d ? d->timestamp : 0), (unsigned int)timestamp);
 #endif
     if (!owner || (clipboardOwner && clipboardOwner != owner->internalWinId()) ||
-        (!clipboardOwner && d->timestamp != CurrentTime && d->timestamp < timestamp))
+        (!clipboardOwner && (d->timestamp == CurrentTime || d->timestamp < timestamp)))
         return qt_check_clipboard_sentinel();
     return false;
 }
diff --git a/src/gui/kernel/qt_s60_p.h b/src/gui/kernel/qt_s60_p.h
index fe3fa57..ed53ccf 100644
--- a/src/gui/kernel/qt_s60_p.h
+++ b/src/gui/kernel/qt_s60_p.h
@@ -63,6 +63,7 @@
 #include "qpointer.h"
 #include "qapplication.h"
 #include "qelapsedtimer.h"
+#include "QtCore/qthreadstorage.h"
 #include <w32std.h>
 #include <coecntrl.h>
 #include <eikenv.h>
@@ -86,10 +87,21 @@ const TInt KInternalStatusPaneChange = 0x50000000;
 //this macro exists because EColor16MAP enum value doesn't exist in Symbian OS 9.2
 #define Q_SYMBIAN_ECOLOR16MAP TDisplayMode(13)
 
+class QS60ThreadLocalData
+{
+public:
+    QS60ThreadLocalData();
+    ~QS60ThreadLocalData();
+    bool usingCONEinstances;
+    RWsSession wsSession;
+    CWsScreenDevice *screenDevice;
+};
+
 class QS60Data
 {
 public:
     QS60Data();
+    QThreadStorage<QS60ThreadLocalData *> tls;
     TUid uid;
     int screenDepth;
     QPoint lastCursorPos;
@@ -132,9 +144,9 @@ public:
     int memoryLimitForHwRendering;
     QApplication::QS60MainApplicationFactory s60ApplicationFactory; // typedef'ed pointer type
     static inline void updateScreenSize();
-    static inline RWsSession& wsSession();
+    inline RWsSession& wsSession();
     static inline RWindowGroup& windowGroup();
-    static inline CWsScreenDevice* screenDevice();
+    inline CWsScreenDevice* screenDevice();
     static inline CCoeAppUi* appUi();
     static inline CEikMenuBar* menuBar();
 #ifdef Q_WS_S60
@@ -265,7 +277,10 @@ inline void QS60Data::updateScreenSize()
 
 inline RWsSession& QS60Data::wsSession()
 {
-    return CCoeEnv::Static()->WsSession();
+    if(!tls.hasLocalData()) {
+        tls.setLocalData(new QS60ThreadLocalData);
+    }
+    return tls.localData()->wsSession;
 }
 
 inline RWindowGroup& QS60Data::windowGroup()
@@ -275,7 +290,10 @@ inline RWindowGroup& QS60Data::windowGroup()
 
 inline CWsScreenDevice* QS60Data::screenDevice()
 {
-    return CCoeEnv::Static()->ScreenDevice();
+    if(!tls.hasLocalData()) {
+        tls.setLocalData(new QS60ThreadLocalData);
+    }
+    return tls.localData()->screenDevice;
 }
 
 inline CCoeAppUi* QS60Data::appUi()
diff --git a/src/gui/painting/qoutlinemapper.cpp b/src/gui/painting/qoutlinemapper.cpp
index 1b01960..bf03545 100644
--- a/src/gui/painting/qoutlinemapper.cpp
+++ b/src/gui/painting/qoutlinemapper.cpp
@@ -234,12 +234,12 @@ void QOutlineMapper::endOutline()
 
 
     // Check for out of dev bounds...
-    const bool do_clip = (controlPointRect.left() < -QT_RASTER_COORD_LIMIT
+    const bool do_clip = !m_in_clip_elements && ((controlPointRect.left() < -QT_RASTER_COORD_LIMIT
                           || controlPointRect.right() > QT_RASTER_COORD_LIMIT
                           || controlPointRect.top() < -QT_RASTER_COORD_LIMIT
                           || controlPointRect.bottom() > QT_RASTER_COORD_LIMIT
                           || controlPointRect.width() > QT_RASTER_COORD_LIMIT
-                          || controlPointRect.height() > QT_RASTER_COORD_LIMIT);
+                          || controlPointRect.height() > QT_RASTER_COORD_LIMIT));
 
     if (do_clip) {
         clipElements(elements, elementTypes(), element_count);
@@ -353,7 +353,13 @@ void QOutlineMapper::clipElements(const QPointF *elements,
     // instead of going through convenience functionallity, but since
     // this part of code hardly every used, it shouldn't matter.
 
+    m_in_clip_elements = true;
+
     QPainterPath path;
+
+    if (!(m_outline.flags & QT_FT_OUTLINE_EVEN_ODD_FILL))
+        path.setFillRule(Qt::WindingFill);
+
     if (types) {
         for (int i=0; i<element_count; ++i) {
             switch (types[i]) {
@@ -389,6 +395,8 @@ void QOutlineMapper::clipElements(const QPointF *elements,
     else
         convertPath(clippedPath);
     m_txop = old_txop;
+
+    m_in_clip_elements = false;
 }
 
 QT_END_NAMESPACE
diff --git a/src/gui/painting/qoutlinemapper_p.h b/src/gui/painting/qoutlinemapper_p.h
index 39b7593..f64d03b 100644
--- a/src/gui/painting/qoutlinemapper_p.h
+++ b/src/gui/painting/qoutlinemapper_p.h
@@ -95,7 +95,8 @@ public:
         m_tags(0),
         m_contours(0),
         m_polygon_dev(0),
-        m_round_coords(false)
+        m_round_coords(false),
+        m_in_clip_elements(false)
     {
     }
 
@@ -235,6 +236,7 @@ public:
     qreal m_dy;
 
     bool m_valid;
+    bool m_in_clip_elements;
 
 private:
     bool m_round_coords;
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index f10f12f..a212718 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -459,13 +459,12 @@ bool QRasterPaintEngine::begin(QPaintDevice *device)
 
     QRasterPaintEngineState *s = state();
     ensureOutlineMapper();
-    d->outlineMapper->m_clip_rect = d->deviceRect.adjusted(-10, -10, 10, 10);
-
-    // This is the upp
-    QRect bounds(-QT_RASTER_COORD_LIMIT, -QT_RASTER_COORD_LIMIT,
-                 QT_RASTER_COORD_LIMIT*2 - 1, QT_RASTER_COORD_LIMIT * 2 - 1);
-    d->outlineMapper->m_clip_rect = bounds.intersected(d->outlineMapper->m_clip_rect);
+    d->outlineMapper->m_clip_rect = d->deviceRect;
 
+    if (d->outlineMapper->m_clip_rect.width() > QT_RASTER_COORD_LIMIT)
+        d->outlineMapper->m_clip_rect.setWidth(QT_RASTER_COORD_LIMIT);
+    if (d->outlineMapper->m_clip_rect.height() > QT_RASTER_COORD_LIMIT)
+        d->outlineMapper->m_clip_rect.setHeight(QT_RASTER_COORD_LIMIT);
 
     d->rasterizer->setClipRect(d->deviceRect);
 
diff --git a/src/gui/painting/qpaintengineex.cpp b/src/gui/painting/qpaintengineex.cpp
index ff82d59..e0746fb 100644
--- a/src/gui/painting/qpaintengineex.cpp
+++ b/src/gui/painting/qpaintengineex.cpp
@@ -494,11 +494,9 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
         } else {
             d->activeStroker->moveTo(points[0], points[1]);
             points += 2;
-            ++types;
             while (points < lastPoint) {
                 d->activeStroker->lineTo(points[0], points[1]);
                 points += 2;
-                ++types;
             }
             if (path.hasImplicitClose())
                 d->activeStroker->lineTo(path.points()[0], path.points()[1]);
@@ -561,12 +559,10 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &pen)
                 QPointF p = ((QPointF *)points)[0] * state()->matrix;
                 d->activeStroker->moveTo(p.x(), p.y());
                 points += 2;
-                ++types;
                 while (points < lastPoint) {
                     QPointF p = ((QPointF *)points)[0] * state()->matrix;
                     d->activeStroker->lineTo(p.x(), p.y());
                     points += 2;
-                    ++types;
                 }
                 if (path.hasImplicitClose())
                     d->activeStroker->lineTo(p.x(), p.y());
diff --git a/src/gui/text/qfontdatabase.cpp b/src/gui/text/qfontdatabase.cpp
index 4c058ce..139139f 100644
--- a/src/gui/text/qfontdatabase.cpp
+++ b/src/gui/text/qfontdatabase.cpp
@@ -289,7 +289,7 @@ QtFontSize *QtFontStyle::pixelSize(unsigned short size, bool add)
         QtFontSize *newPixelSizes = (QtFontSize *)malloc(sizeof(QtFontSize));
         Q_CHECK_PTR(newPixelSizes);
         pixelSizes = newPixelSizes;
-    } else if (!(count % 8)) {
+    } else if (!(count % 8) || count == 1) {
         QtFontSize *newPixelSizes = (QtFontSize *)
                      realloc(pixelSizes,
                               (((count+8) >> 3) << 3) * sizeof(QtFontSize));
diff --git a/src/gui/text/qfontdatabase_s60.cpp b/src/gui/text/qfontdatabase_s60.cpp
index 943df7f..cdfba3d 100644
--- a/src/gui/text/qfontdatabase_s60.cpp
+++ b/src/gui/text/qfontdatabase_s60.cpp
@@ -118,7 +118,7 @@ public:
         {
             if (!font)
                 return;
-            QS60Data::screenDevice()->ReleaseFont(font);
+            S60->screenDevice()->ReleaseFont(font);
         }
     };
 
@@ -205,7 +205,7 @@ const QSymbianTypeFaceExtras *QSymbianFontDatabaseExtrasImplementation::extras(c
 
         CFont* font = NULL;
 #ifdef Q_SYMBIAN_HAS_FONTTABLE_API
-        const TInt err = QS60Data::screenDevice()->GetNearestFontToDesignHeightInPixels(font, searchSpec);
+        const TInt err = S60->screenDevice()->GetNearestFontToDesignHeightInPixels(font, searchSpec);
         Q_ASSERT(err == KErrNone && font);
         QScopedPointer<CFont, CFontFromScreenDeviceReleaser> sFont(font);
         QSymbianTypeFaceExtras *extras = new QSymbianTypeFaceExtras(font);
@@ -260,17 +260,19 @@ QFontEngineFTS60::QFontEngineFTS60(const QFontDef &fd)
 */
 qreal QFontEngineS60::pixelsToPoints(qreal pixels, Qt::Orientation orientation)
 {
+    CWsScreenDevice* device = S60->screenDevice();
     return (orientation == Qt::Horizontal?
-        S60->screenDevice()->HorizontalPixelsToTwips(pixels)
-        :S60->screenDevice()->VerticalPixelsToTwips(pixels)) / KTwipsPerPoint;
+        device->HorizontalPixelsToTwips(pixels)
+        :device->VerticalPixelsToTwips(pixels)) / KTwipsPerPoint;
 }
 
 qreal QFontEngineS60::pointsToPixels(qreal points, Qt::Orientation orientation)
 {
+    CWsScreenDevice* device = S60->screenDevice();
     const int twips = points * KTwipsPerPoint;
     return orientation == Qt::Horizontal?
-        S60->screenDevice()->HorizontalTwipsToPixels(twips)
-        :S60->screenDevice()->VerticalTwipsToPixels(twips);
+        device->HorizontalTwipsToPixels(twips)
+        :device->VerticalTwipsToPixels(twips);
 }
 
 QFontEngineMultiS60::QFontEngineMultiS60(QFontEngine *first, int script, const QStringList &fallbackFamilies)
@@ -309,16 +311,16 @@ static void initializeDb()
 
     QSymbianFbsHeapLock lock(QSymbianFbsHeapLock::Unlock);
 
-    const int numTypeFaces = QS60Data::screenDevice()->NumTypefaces();
+    const int numTypeFaces = S60->screenDevice()->NumTypefaces();
     const QSymbianFontDatabaseExtrasImplementation *dbExtras =
             static_cast<const QSymbianFontDatabaseExtrasImplementation*>(db->symbianExtras);
     bool fontAdded = false;
     for (int i = 0; i < numTypeFaces; i++) {
         TTypefaceSupport typefaceSupport;
-        QS60Data::screenDevice()->TypefaceSupport(typefaceSupport, i);
+        S60->screenDevice()->TypefaceSupport(typefaceSupport, i);
         CFont *font; // We have to get a font instance in order to know all the details
         TFontSpec fontSpec(typefaceSupport.iTypeface.iName, 11);
-        if (QS60Data::screenDevice()->GetNearestFontInPixels(font, fontSpec) != KErrNone)
+        if (S60->screenDevice()->GetNearestFontInPixels(font, fontSpec) != KErrNone)
             continue;
         QScopedPointer<CFont, QSymbianFontDatabaseExtrasImplementation::CFontFromScreenDeviceReleaser> sFont(font);
         if (font->TypeUid() == KCFbsFontUid) {
diff --git a/src/gui/text/qfontengine_mac.mm b/src/gui/text/qfontengine_mac.mm
index 3be6d28..7ceed61 100644
--- a/src/gui/text/qfontengine_mac.mm
+++ b/src/gui/text/qfontengine_mac.mm
@@ -237,7 +237,8 @@ bool QCoreTextFontEngineMulti::stringToCMap(const QChar *str, int len, QGlyphLay
         *nglyphs = len;
         for (int i = 0; i < len; ++i) {
             outGlyphs[i] = 0;
-            logClusters[i] = i;
+            if (logClusters)
+                logClusters[i] = i;
             outAdvances_x[i] = QFixed();
             outAdvances_y[i] = QFixed();
             outAttributes[i].clusterStart = true;
diff --git a/src/gui/text/qfontengine_s60.cpp b/src/gui/text/qfontengine_s60.cpp
index 925b3bf..f691413 100644
--- a/src/gui/text/qfontengine_s60.cpp
+++ b/src/gui/text/qfontengine_s60.cpp
@@ -66,7 +66,7 @@ QSymbianTypeFaceExtras::QSymbianTypeFaceExtras(CFont* cFont, COpenFont *openFont
 
 QSymbianTypeFaceExtras::~QSymbianTypeFaceExtras()
 {
-    QS60Data::screenDevice()->ReleaseFont(m_cFont);
+    S60->screenDevice()->ReleaseFont(m_cFont);
 }
 
 QByteArray QSymbianTypeFaceExtras::getSfntTable(uint tag) const
diff --git a/src/network/socket/qlocalserver_p.h b/src/network/socket/qlocalserver_p.h
index feaaae0..4f92b64 100644
--- a/src/network/socket/qlocalserver_p.h
+++ b/src/network/socket/qlocalserver_p.h
@@ -99,6 +99,7 @@ public:
     struct Listener {
         HANDLE handle;
         OVERLAPPED overlapped;
+        bool connected;
     };
 
     void setError(const QString &function);
diff --git a/src/network/socket/qlocalserver_win.cpp b/src/network/socket/qlocalserver_win.cpp
index 07baf1e..61220e4 100644
--- a/src/network/socket/qlocalserver_win.cpp
+++ b/src/network/socket/qlocalserver_win.cpp
@@ -85,8 +85,10 @@ bool QLocalServerPrivate::addListener()
     if (!ConnectNamedPipe(listener.handle, &listener.overlapped)) {
         switch (GetLastError()) {
         case ERROR_IO_PENDING:
+            listener.connected = false;
             break;
         case ERROR_PIPE_CONNECTED:
+            listener.connected = true;
             SetEvent(eventHandle);
             break;
         default:
@@ -155,7 +157,9 @@ void QLocalServerPrivate::_q_onNewConnection()
     // a client connection first, so there is no way around polling all of them.
     for (int i = 0; i < listeners.size(); ) {
         HANDLE handle = listeners[i].handle;
-        if (GetOverlappedResult(handle, &listeners[i].overlapped, &dummy, FALSE)) {
+        if (listeners[i].connected
+            || GetOverlappedResult(handle, &listeners[i].overlapped, &dummy, FALSE))
+        {
             listeners.removeAt(i);
 
             addListener();
diff --git a/src/network/socket/qlocalsocket_p.h b/src/network/socket/qlocalsocket_p.h
index 0f1c23c..57ca3c2 100644
--- a/src/network/socket/qlocalsocket_p.h
+++ b/src/network/socket/qlocalsocket_p.h
@@ -135,7 +135,7 @@ public:
     void _q_canWrite();
     void _q_pipeClosed();
     void _q_emitReadyRead();
-    DWORD bytesAvailable();
+    DWORD checkPipeState();
     void startAsyncRead();
     bool completeAsyncRead();
     void checkReadyRead();
diff --git a/src/network/socket/qlocalsocket_win.cpp b/src/network/socket/qlocalsocket_win.cpp
index 5f46ecb..5486f47 100644
--- a/src/network/socket/qlocalsocket_win.cpp
+++ b/src/network/socket/qlocalsocket_win.cpp
@@ -192,6 +192,9 @@ qint64 QLocalSocket::readData(char *data, qint64 maxSize)
 {
     Q_D(QLocalSocket);
 
+    if (d->pipeClosed && d->actualReadBufferSize == 0)
+        return -1;  // signal EOF
+
     qint64 readSoFar;
     // If startAsyncRead() read data, copy it to its destination.
     if (maxSize == 1 && d->actualReadBufferSize > 0) {
@@ -213,10 +216,8 @@ qint64 QLocalSocket::readData(char *data, qint64 maxSize)
     }
 
     if (d->pipeClosed) {
-        if (readSoFar == 0) {
+        if (d->actualReadBufferSize == 0)
             QTimer::singleShot(0, this, SLOT(_q_pipeClosed()));
-            return -1;  // signal EOF
-        }
     } else {
         if (!d->readSequenceStarted)
             d->startAsyncRead();
@@ -250,7 +251,10 @@ void QLocalSocketPrivate::checkReadyRead()
 void QLocalSocketPrivate::startAsyncRead()
 {
     do {
-        DWORD bytesToRead = bytesAvailable();
+        DWORD bytesToRead = checkPipeState();
+        if (pipeClosed)
+            return;
+
         if (bytesToRead == 0) {
             // There are no bytes in the pipe but we need to
             // start the overlapped read with some buffer size.
@@ -333,9 +337,11 @@ void QLocalSocket::abort()
 }
 
 /*!
-    The number of bytes available from the pipe
-  */
-DWORD QLocalSocketPrivate::bytesAvailable()
+    \internal
+    Returns the number of available bytes in the pipe.
+    Sets QLocalSocketPrivate::pipeClosed to true if the connection is broken.
+ */
+DWORD QLocalSocketPrivate::checkPipeState()
 {
     Q_Q(QLocalSocket);
     DWORD bytes;
@@ -345,7 +351,8 @@ DWORD QLocalSocketPrivate::bytesAvailable()
         if (!pipeClosed) {
             pipeClosed = true;
             emit q->readChannelFinished();
-            QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
+            if (actualReadBufferSize == 0)
+                QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
         }
     }
     return 0;
@@ -478,6 +485,8 @@ void QLocalSocketPrivate::_q_notified()
     if (!completeAsyncRead()) {
         pipeClosed = true;
         emit q->readChannelFinished();
+        if (actualReadBufferSize == 0)
+            QTimer::singleShot(0, q, SLOT(_q_pipeClosed()));
         return;
     }
     startAsyncRead();
@@ -529,7 +538,7 @@ bool QLocalSocket::waitForDisconnected(int msecs)
     }
     QIncrementalSleepTimer timer(msecs);
     forever {
-        d->bytesAvailable();    // to check if PeekNamedPipe fails
+        d->checkPipeState();
         if (d->pipeClosed)
             close();
         if (state() == UnconnectedState)
@@ -561,11 +570,22 @@ bool QLocalSocket::waitForReadyRead(int msecs)
     if (d->state != QLocalSocket::ConnectedState)
         return false;
 
+    // We already know that the pipe is gone, but did not enter the event loop yet.
+    if (d->pipeClosed) {
+        close();
+        return false;
+    }
+
     Q_ASSERT(d->readSequenceStarted);
     DWORD result = WaitForSingleObject(d->overlapped.hEvent, msecs == -1 ? INFINITE : msecs);
     switch (result) {
         case WAIT_OBJECT_0:
             d->_q_notified();
+            // We just noticed that the pipe is gone.
+            if (d->pipeClosed) {
+                close();
+                return false;
+            }
             return true;
         case WAIT_TIMEOUT:
             return false;
diff --git a/src/opengl/qgl_wince.cpp b/src/opengl/qgl_wince.cpp
index 47a19b5..054a8d1 100644
--- a/src/opengl/qgl_wince.cpp
+++ b/src/opengl/qgl_wince.cpp
@@ -57,7 +57,6 @@
 #include <private/qeglproperties_p.h>
 #include <private/qeglcontext_p.h>
 #include <private/qgl_egl_p.h>
-#include <private/qgl_cl_p.h>
 
 
 QT_BEGIN_NAMESPACE
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index 5e2157e..129a11b 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -132,8 +132,8 @@ private:
 
     int code_size, clear_code, end_code, max_code_size, max_code;
     int firstcode, oldcode, incode;
-    short table[2][1<< max_lzw_bits];
-    short stack[(1<<(max_lzw_bits))*2];
+    short* table[2];
+    short* stack;
     short *sp;
     bool needfirst;
     int x, y;
@@ -162,6 +162,9 @@ QGIFFormat::QGIFFormat()
     lcmap = false;
     newFrame = false;
     partialNewFrame = false;
+    table[0] = 0;
+    table[1] = 0;
+    stack = 0;
 }
 
 /*!
@@ -171,6 +174,7 @@ QGIFFormat::~QGIFFormat()
 {
     if (globalcmap) delete[] globalcmap;
     if (localcmap) delete[] localcmap;
+    delete [] stack;
 }
 
 void QGIFFormat::disposePrevious(QImage *image)
@@ -237,6 +241,12 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
     //    CompuServe Incorporated. GIF(sm) is a Service Mark property of
     //    CompuServe Incorporated."
 
+    if (!stack) {
+        stack = new short[(1 << max_lzw_bits) * 4];
+        table[0] = &stack[(1 << max_lzw_bits) * 2];
+        table[1] = &stack[(1 << max_lzw_bits) * 3];
+    }
+
     image->detach();
     int bpl = image->bytesPerLine();
     unsigned char *bits = image->bits();
@@ -1026,7 +1036,7 @@ inline QRgb QGIFFormat::color(uchar index) const
 QGifHandler::QGifHandler()
 {
     gifFormat = new QGIFFormat;
-    nextDelay = 0;
+    nextDelay = 100;
     loopCnt = 1;
     frameNumber = -1;
     scanIsCached = false;
@@ -1061,7 +1071,7 @@ bool QGifHandler::imageIsComing() const
 
 bool QGifHandler::canRead() const
 {
-    if (!nextDelay && canRead(device()) || imageIsComing()) {
+    if (canRead(device()) || imageIsComing()) {
         setFormat("gif");
         return true;
     }
diff --git a/src/plugins/imageformats/mng/qmnghandler.cpp b/src/plugins/imageformats/mng/qmnghandler.cpp
index c134fd6..ec442a1 100644
--- a/src/plugins/imageformats/mng/qmnghandler.cpp
+++ b/src/plugins/imageformats/mng/qmnghandler.cpp
@@ -271,7 +271,6 @@ bool QMngHandlerPrivate::getNextImage(QImage *result)
     }
     if ((MNG_NOERROR == ret) || (MNG_NEEDTIMERWAIT == ret)) {
         *result = image;
-        image.fill(0);
         frameIndex = nextIndex++;
         if (haveReadAll && (frameCount == 0))
             frameCount = nextIndex;
diff --git a/src/script/api/qscriptengine.cpp b/src/script/api/qscriptengine.cpp
index f02ea52..e2999c1 100644
--- a/src/script/api/qscriptengine.cpp
+++ b/src/script/api/qscriptengine.cpp
@@ -1011,12 +1011,17 @@ JSC::JSValue QScriptEnginePrivate::arrayFromVariantList(JSC::ExecState *exec, co
     return arr;
 }
 
-QVariantList QScriptEnginePrivate::variantListFromArray(JSC::ExecState *exec, JSC::JSValue arr)
+QVariantList QScriptEnginePrivate::variantListFromArray(JSC::ExecState *exec, JSC::JSArray *arr)
 {
+    QScriptEnginePrivate *eng = QScript::scriptEngineFromExec(exec);
+    if (eng->visitedConversionObjects.contains(arr))
+        return QVariantList(); // Avoid recursion.
+    eng->visitedConversionObjects.insert(arr);
     QVariantList lst;
     uint len = toUInt32(exec, property(exec, arr, exec->propertyNames().length));
     for (uint i = 0; i < len; ++i)
         lst.append(toVariant(exec, property(exec, arr, i)));
+    eng->visitedConversionObjects.remove(arr);
     return lst;
 }
 
@@ -1029,14 +1034,19 @@ JSC::JSValue QScriptEnginePrivate::objectFromVariantMap(JSC::ExecState *exec, co
     return obj;
 }
 
-QVariantMap QScriptEnginePrivate::variantMapFromObject(JSC::ExecState *exec, JSC::JSValue obj)
+QVariantMap QScriptEnginePrivate::variantMapFromObject(JSC::ExecState *exec, JSC::JSObject *obj)
 {
+    QScriptEnginePrivate *eng = QScript::scriptEngineFromExec(exec);
+    if (eng->visitedConversionObjects.contains(obj))
+        return QVariantMap(); // Avoid recursion.
+    eng->visitedConversionObjects.insert(obj);
     JSC::PropertyNameArray propertyNames(exec);
-    JSC::asObject(obj)->getOwnPropertyNames(exec, propertyNames, JSC::IncludeDontEnumProperties);
+    obj->getOwnPropertyNames(exec, propertyNames, JSC::IncludeDontEnumProperties);
     QVariantMap vmap;
     JSC::PropertyNameArray::const_iterator it = propertyNames.begin();
     for( ; it != propertyNames.end(); ++it)
         vmap.insert(it->ustring(), toVariant(exec, property(exec, obj, *it)));
+    eng->visitedConversionObjects.remove(obj);
     return vmap;
 }
 
@@ -1661,16 +1671,10 @@ QVariant QScriptEnginePrivate::toVariant(JSC::ExecState *exec, JSC::JSValue valu
             return QVariant(toRegExp(exec, value));
 #endif
         else if (isArray(value))
-            return variantListFromArray(exec, value);
+            return variantListFromArray(exec, JSC::asArray(value));
         else if (QScriptDeclarativeClass *dc = declarativeClass(value))
             return dc->toVariant(declarativeObject(value));
-        // try to convert to primitive
-        JSC::JSValue savedException;
-        saveException(exec, &savedException);
-        JSC::JSValue prim = value.toPrimitive(exec);
-        restoreException(exec, savedException);
-        if (!prim.isObject())
-            return toVariant(exec, prim);
+        return variantMapFromObject(exec, JSC::asObject(value));
     } else if (value.isNumber()) {
         return QVariant(toNumber(exec, value));
     } else if (value.isString()) {
@@ -3129,12 +3133,12 @@ bool QScriptEnginePrivate::convertValue(JSC::ExecState *exec, JSC::JSValue value
         } break;
     case QMetaType::QVariantList:
         if (isArray(value)) {
-            *reinterpret_cast<QVariantList *>(ptr) = variantListFromArray(exec, value);
+            *reinterpret_cast<QVariantList *>(ptr) = variantListFromArray(exec, JSC::asArray(value));
             return true;
         } break;
     case QMetaType::QVariantMap:
         if (isObject(value)) {
-            *reinterpret_cast<QVariantMap *>(ptr) = variantMapFromObject(exec, value);
+            *reinterpret_cast<QVariantMap *>(ptr) = variantMapFromObject(exec, JSC::asObject(value));
             return true;
         } break;
     case QMetaType::QVariant:
diff --git a/src/script/api/qscriptengine_p.h b/src/script/api/qscriptengine_p.h
index fd47208..56366e2 100644
--- a/src/script/api/qscriptengine_p.h
+++ b/src/script/api/qscriptengine_p.h
@@ -215,10 +215,10 @@ public:
     static QStringList stringListFromArray(JSC::ExecState*, JSC::JSValue arr);
 
     static JSC::JSValue arrayFromVariantList(JSC::ExecState*, const QVariantList &lst);
-    static QVariantList variantListFromArray(JSC::ExecState*, JSC::JSValue arr);
+    static QVariantList variantListFromArray(JSC::ExecState*, JSC::JSArray *arr);
 
     static JSC::JSValue objectFromVariantMap(JSC::ExecState*, const QVariantMap &vmap);
-    static QVariantMap variantMapFromObject(JSC::ExecState*, JSC::JSValue obj);
+    static QVariantMap variantMapFromObject(JSC::ExecState*, JSC::JSObject *obj);
 
     JSC::JSValue defaultPrototype(int metaTypeId) const;
     void setDefaultPrototype(int metaTypeId, JSC::JSValue prototype);
@@ -378,6 +378,8 @@ public:
     QHash<intptr_t, QScript::UStringSourceProviderWithFeedback*> loadedScripts;
     QScriptValue m_currentException;
 
+    QSet<JSC::JSObject*> visitedConversionObjects;
+
 #ifndef QT_NO_QOBJECT
     QHash<QObject*, QScript::QObjectData*> m_qobjectData;
 #endif
diff --git a/src/script/api/qscriptvalue.cpp b/src/script/api/qscriptvalue.cpp
index 1310c8c..451d1b0 100644
--- a/src/script/api/qscriptvalue.cpp
+++ b/src/script/api/qscriptvalue.cpp
@@ -1215,8 +1215,8 @@ qsreal QScriptValue::toInteger() const
     \row    \o QObject Object \o A QVariant containing a pointer to the QObject.
     \row    \o Date Object \o A QVariant containing the date value (toDateTime()).
     \row    \o RegExp Object \o A QVariant containing the regular expression value (toRegExp()).
-    \row    \o Array Object \o The array is converted to a QVariantList.
-    \row    \o Object     \o If the value is primitive, then the result is converted to a QVariant according to the above rules; otherwise, an invalid QVariant is returned.
+    \row    \o Array Object \o The array is converted to a QVariantList. Each element is converted to a QVariant, recursively; cyclic references are not followed.
+    \row    \o Object     \o The object is converted to a QVariantMap. Each property is converted to a QVariant, recursively; cyclic references are not followed.
     \endtable
 
   \sa isVariant()
diff --git a/src/tools/moc/main.cpp b/src/tools/moc/main.cpp
index ebe1834..4997690 100644
--- a/src/tools/moc/main.cpp
+++ b/src/tools/moc/main.cpp
@@ -359,11 +359,10 @@ int runMoc(int _argc, char **_argv)
 
 
     if (autoInclude) {
+        int spos = filename.lastIndexOf(QDir::separator().toLatin1());
         int ppos = filename.lastIndexOf('.');
-        moc.noInclude = (ppos >= 0
-                         && tolower(filename[ppos + 1]) != 'h'
-                         && tolower(filename[ppos + 1]) != QDir::separator().toLatin1()
-                        );
+        // spos >= -1 && ppos > spos => ppos >= 0
+        moc.noInclude = (ppos > spos && tolower(filename[ppos + 1]) != 'h');
     }
     if (moc.includeFiles.isEmpty()) {
         if (moc.includePath.isEmpty()) {