4 files changed, 33 insertions, 7 deletions
diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index 82cb8f5..d290c0b 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-9c745c625c6d1112cec51d742ecc8c041cc090d7
+a096458b01a9387719308c99e5917a7b42196078
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSString.cpp
index da15997..a0ba3e2 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSString.cpp
@@ -41,9 +41,10 @@ void JSString::resolveRope(ExecState* exec) const
     ASSERT(isRope());
 
     UChar* buffer;
-    if (PassRefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer))
+    if (PassRefPtr<StringImpl> newImpl = StringImpl::tryCreateUninitialized(m_length, buffer)) {
+        Heap::heap(this)->reportExtraMemoryCost(newImpl->cost());
         m_value = newImpl;
-    else {
+    } else {
         outOfMemory(exec);
         return;
     }
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
index 8c3b809..5ba5410 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/OSAllocatorPosix.cpp
@@ -35,11 +35,21 @@ namespace WTF {
 
 void* OSAllocator::reserveUncommitted(size_t bytes, Usage usage, bool writable, bool executable)
 {
+#if OS(QNX)
+    // Reserve memory with PROT_NONE and MAP_LAZY so it isn't committed now.
+    void* result = mmap(0, bytes, PROT_NONE, MAP_LAZY | MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (result == MAP_FAILED)
+       CRASH();
+#else // OS(QNX)
+
     void* result = reserveAndCommit(bytes, usage, writable, executable);
 #if HAVE(MADV_FREE_REUSE)
     // To support the "reserve then commit" model, we have to initially decommit.
     while (madvise(result, bytes, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
 #endif
+
+#endif // OS(QNX)
+
     return result;
 }
 
@@ -98,20 +108,35 @@ void* OSAllocator::reserveAndCommit(size_t bytes, Usage usage, bool writable, bo
     return result;
 }
 
-void OSAllocator::commit(void* address, size_t bytes, bool, bool)
+void OSAllocator::commit(void* address, size_t bytes, bool writable, bool executable)
 {
-#if HAVE(MADV_FREE_REUSE)
+#if OS(QNX)
+    int protection = PROT_READ;
+    if (writable)
+        protection |= PROT_WRITE;
+    if (executable)
+        protection |= PROT_EXEC;
+    if (MAP_FAILED == mmap(address, bytes, protection, MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0))
+        CRASH();
+#elif HAVE(MADV_FREE_REUSE)
+    UNUSED_PARAM(writable);
+    UNUSED_PARAM(executable);
     while (madvise(address, bytes, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
 #else
     // Non-MADV_FREE_REUSE reservations automatically commit on demand.
     UNUSED_PARAM(address);
     UNUSED_PARAM(bytes);
+    UNUSED_PARAM(writable);
+    UNUSED_PARAM(executable);
 #endif
 }
 
 void OSAllocator::decommit(void* address, size_t bytes)
 {
-#if HAVE(MADV_FREE_REUSE)
+#if OS(QNX)
+    // Use PROT_NONE and MAP_LAZY to decommit the pages.
+    mmap(address, bytes, PROT_NONE, MAP_FIXED | MAP_LAZY | MAP_PRIVATE | MAP_ANON, -1, 0);
+#elif HAVE(MADV_FREE_REUSE)
     while (madvise(address, bytes, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
 #elif HAVE(MADV_FREE)
     while (madvise(address, bytes, MADV_FREE) == -1 && errno == EAGAIN) { }
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index b352b88..d8a9930 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        9c745c625c6d1112cec51d742ecc8c041cc090d7
+        a096458b01a9387719308c99e5917a7b42196078