From f40ec4700d0162f741d872996f65162968064496 Mon Sep 17 00:00:00 2001
From: Simon Hausmann <simon.hausmann@nokia.com>
Date: Mon, 29 Jun 2009 11:22:51 +0200
Subject: Updated WebKit from /home/shausman/src/webkit/trunk to
 origin/qtwebkit-4.6-staging ( 22aadba1b4356ad7d8e9446b95baccb6b2c037b0 )
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes in WebKit since the last update:

++ b/JavaScriptCore/ChangeLog
2009-06-26  Oliver Hunt  <oliver@apple.com>
        Reviewed by Dan Bernstein.
        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
        <https://bugs.webkit.org/show_bug.cgi?id=26746>
        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
        is less than correct.  This patch corrects that error.
        * interpreter/Interpreter.cpp:
        (JSC::Interpreter::tryCacheGetByID):
2009-06-26  Eric Seidel  <eric@webkit.org>
        No review, only rolling out r45259.
        Roll out r45259 after crash appeared on the bots:
        plugins/undefined-property-crash.html
        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>

        Reviewed by Simon Hausmann.

        Add support for QDataStream operators to Vector.

        * wtf/Vector.h:
        (WTF::operator<<):
        (WTF::operator>>):

++ b/LayoutTests/ChangeLog
2009-06-28  Dan Bernstein  <mitz@apple.com>

        Reviewed by Simon Fraser.

        - add a test case for https://bugs.webkit.org/show_bug.cgi?id=26783
          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
          in MobileMe iDisk Web App

        * fast/dom/Element/scrollWidth-expected.txt:
        * fast/dom/Element/scrollWidth.html:

2009-06-27  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26780

        Testcases for compositing and self-painting layers (for which we use
        video to make an element composited while being in the normal flow),
        and for moving layers inside an overflow:scroll div.

        * compositing/layers-inside-overflow-scroll.html: Added.
        * compositing/resources/video.mp4: Added.
        * compositing/self-painting-layers.html: Added.
        * platform/mac/compositing/layers-inside-overflow-scroll-expected.txt: Added.
        * platform/mac/compositing/self-painting-layers-expected.txt: Added.

2009-06-28  John Abd-El-Malek  <jam@chromium.org>

        https://bugs.webkit.org/show_bug.cgi?id=15457

        Layout tests to ensure that "src" paramater is added when it's missing
        but "data" is present.

        * plugins/netscape-plugin-map-data-to-src-expected.txt: Added.
        * plugins/netscape-plugin-map-data-to-src.html: Added.

2009-06-28  Eric Seidel  <eric@webkit.org>

        No review.  Just updating test results Kevin seems to have missed.

        Test failure started with:
        http://trac.webkit.org/changeset/45287
        The new results definitely look better.

        * fast/profiler/profile-with-no-title-expected.txt:

2009-06-27  Ryosuke Niwa  <rniwa@google.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26762

        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
        https://bugs.webkit.org/show_bug.cgi?id=21712

        The following test cases are intended for 21712, but included here
        since this patch already solved a lot of problems.

        * editing/execCommand/indent-nested-lists-1-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-1.html: Added.
        * editing/execCommand/indent-nested-lists-2-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-2.html: Added.
        * editing/execCommand/indent-nested-lists-3-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-3.html: Added.
        * editing/execCommand/indent-nested-lists-4-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-4.html: Added.
        * editing/execCommand/indent-nested-lists-5-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-5.html: Added.
        * editing/execCommand/indent-nested-lists-6-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-6.html: Added.
        * editing/execCommand/indent-nested-lists-7-expected.txt: Added.
        * editing/execCommand/indent-nested-lists-7.html: Added.
        * editing/execCommand/outdent-nested-lists-1-expected.txt: Added.
        * editing/execCommand/outdent-nested-lists-1.html: Added.
        * editing/execCommand/outdent-nested-lists-2-expected.txt: Added.
        * editing/execCommand/outdent-nested-lists-2.html: Added.
        * editing/execCommand/outdent-nested-lists-3-expected.txt: Added.
        * editing/execCommand/outdent-nested-lists-3.html: Added.
        * editing/execCommand/outdent-nested-lists-4-expected.txt: Added.
        * editing/execCommand/outdent-nested-lists-4.html: Added.

2009-06-27  Daniel Bates  <dbates@intudata.com>

        Reviewed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=26776

        More tests for the XSSAuditor.

        * http/tests/security/xssAuditor/anchor-url-dom-write-location-expected.txt: Added.
        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event-expected.txt: Added.
        * http/tests/security/xssAuditor/anchor-url-dom-write-location-inline-event.html: Added.
        * http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL-expected.txt: Added.
        * http/tests/security/xssAuditor/anchor-url-dom-write-location-javascript-URL.html: Added.
        * http/tests/security/xssAuditor/anchor-url-dom-write-location.html: Added.
        * http/tests/security/xssAuditor/dom-write-URL-expected.txt: Added.
        * http/tests/security/xssAuditor/dom-write-URL.html: Added.
        * http/tests/security/xssAuditor/dom-write-innerHTML-expected.txt: Added.
        * http/tests/security/xssAuditor/dom-write-innerHTML.html: Added.
        * http/tests/security/xssAuditor/dom-write-location-expected.txt: Added.
        * http/tests/security/xssAuditor/dom-write-location-inline-event-expected.txt: Added.
        * http/tests/security/xssAuditor/dom-write-location-inline-event.html: Added.
        * http/tests/security/xssAuditor/dom-write-location-javascript-URL-expected.txt: Added.
        * http/tests/security/xssAuditor/dom-write-location-javascript-URL.html: Added.
        * http/tests/security/xssAuditor/dom-write-location.html: Added.
        * http/tests/security/xssAuditor/faux-script1-expected.txt: Added.
        * http/tests/security/xssAuditor/faux-script1.html: Added.
        * http/tests/security/xssAuditor/faux-script2-expected.txt: Added.
        * http/tests/security/xssAuditor/faux-script2.html: Added.
        * http/tests/security/xssAuditor/faux-script3-expected.txt: Added.
        * http/tests/security/xssAuditor/faux-script3.html: Added.
        * http/tests/security/xssAuditor/get-from-iframe-expected.txt: Added.
        * http/tests/security/xssAuditor/get-from-iframe.html: Added.
        * http/tests/security/xssAuditor/malformed-HTML-expected.txt: Added.
        * http/tests/security/xssAuditor/malformed-HTML.html: Added.
        * http/tests/security/xssAuditor/post-from-iframe-expected.txt: Added.
        * http/tests/security/xssAuditor/post-from-iframe.html: Added.
        * http/tests/security/xssAuditor/resources/anchor-url-dom-write-location-click.html: Added.
        * http/tests/security/xssAuditor/resources/echo-dom-write-URL.html: Added.
        * http/tests/security/xssAuditor/resources/echo-dom-write-innerHTML.html: Added.
        * http/tests/security/xssAuditor/resources/echo-dom-write-location.html: Added.
        * http/tests/security/xssAuditor/resources/utilities.js: Added.
        (sendRequestFromIFrame):

2009-06-27  Daniel Bates  <dbates@intudata.com>

        Reviewed by Adam Barth.

        Tests for https://bugs.webkit.org/show_bug.cgi?id=26708

        Tests prevention of injected scripts with scheme relative paths, iFrame JavaScript URLs,
        and UTF-7 encoding.

        * http/tests/security/xssAuditor/http-equiv-utf-7-encoded-expected.txt: Added.
        * http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html: Added.
        * http/tests/security/xssAuditor/iframe-javascript-url-expected.txt: Added.
        * http/tests/security/xssAuditor/iframe-javascript-url.html: Added.
        * http/tests/security/xssAuditor/resources/echo-intertag-default-encode.pl: Added.
        * http/tests/security/xssAuditor/script-tag-utf-7-encoded-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-utf-7-encoded.html: Added.
        * http/tests/security/xssAuditor/script-tag-with-source-relative-scheme-expected.txt: Added.
        * http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html: Added.

2009-06-27  Oliver Hunt  <oliver@apple.com>

        Reviewed by Maciej Stachowiak.

        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements

        Add test to protect against incorrectly tainting the canvas.

        * media/video-canvas-source-expected.txt: Added.
        * media/video-canvas-source.html: Added.

2009-06-26  Alexey Proskuryakov  <ap@webkit.org>

        Updating Tiger results for a recently modified test.

        * platform/mac-tiger/fast/encoding/idn-security-expected.txt:

2009-06-26  Dan Bernstein  <mitz@apple.com>

        Reviewed by Oliver Hunt.

        * fast/dom/Element/scrollWidth-expected.txt: Added.
        * fast/dom/Element/scrollWidth.html: Added.

2009-06-26  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Tests for Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented

        * accessibility/aria-disabled-expected.txt: Added.
        * accessibility/aria-disabled.html: Added.
        * accessibility/aria-hidden-expected.txt: Added.
        * accessibility/aria-hidden.html: Added.
        * accessibility/aria-readonly-expected.txt: Added.
        * accessibility/aria-readonly.html: Added.

2009-06-26  Brady Eidson  <beidson@apple.com>

        OMG.

        * platform/mac-tiger/fast/loader/file-url-mimetypes-expected.txt: Removed.
        * platform/mac-tiger/platform: Added.
        * platform/mac-tiger/platform/mac: Added.
        * platform/mac-tiger/platform/mac/fast: Added.
        * platform/mac-tiger/platform/mac/fast/loader: Added.
        * platform/mac-tiger/platform/mac/fast/loader/file-url-mimetypes-expected.txt: Copied from platform/mac-tiger/fast/loader/file-url-mimetypes-expected.txt.

2009-06-26  Brady Eidson  <beidson@apple.com>

        Fix Tiger results for the new mime type layout test.

        * platform/mac-tiger/fast/loader: Added.
        * platform/mac-tiger/fast/loader/file-url-mimetypes-expected.txt: Added.

2009-06-26  Jessie _Berlin  <jberlin@apple.com>

        Reviewed by Mark Rowe.

        Fix the build bots.

        * editing/selection/drag-start-event-client-x-y-expected.txt:

2009-06-26  Brady Eidson  <beidson@apple.com>

        Step 2 (new Mac results)

        * platform/mac/fast/images/favicon-as-image-expected.checksum: Added.
        * platform/mac/fast/images/favicon-as-image-expected.png: Added.
        * platform/mac/fast/images/favicon-as-image-expected.txt: Added.

2009-06-26  Brady Eidson  <beidson@apple.com>

        1st step of fixing the layout test I broke on Mac platforms.

        * platform/mac-leopard/fast/images/favicon-as-image-expected.checksum: Removed.
        * platform/mac-leopard/fast/images/favicon-as-image-expected.png: Removed.
        * platform/mac-leopard/fast/images/favicon-as-image-expected.txt: Removed.
        * platform/mac-tiger/fast/images/favicon-as-image-expected.checksum: Removed.
        * platform/mac-tiger/fast/images/favicon-as-image-expected.png: Removed.
        * platform/mac-tiger/fast/images/favicon-as-image-expected.txt: Removed.
        * platform/mac/fast/images/favicon-as-image-expected.checksum: Removed.
        * platform/mac/fast/images/favicon-as-image-expected.png: Removed.
        * platform/mac/fast/images/favicon-as-image-expected.txt: Removed.
        * platform/win/fast/images: Added.
        * platform/win/fast/images/favicon-as-image-expected.checksum: Copied from platform/mac/fast/images/favicon-as-image-expected.checksum.
        * platform/win/fast/images/favicon-as-image-expected.png: Copied from platform/mac/fast/images/favicon-as-image-expected.png.
        * platform/win/fast/images/favicon-as-image-expected.txt: Copied from platform/mac/fast/images/favicon-as-image-expected.txt.

2009-06-26  Mark Rowe  <mrowe@apple.com>

        Land updated results after the test change.

        * editing/selection/user-drag-element-and-user-select-none-expected.txt:

2009-06-26  Jessie _Berlin  <jberlin@apple.com>

        Reviewed by Mark Rowe.

        Layout test for making sure the client X Y coordinates of the event
        in a dragstart handler are correct.

        https://bugs.webkit.org/show_bug.cgi?id=26723

        * editing/selection/drag-start-event-client-x-y-expected.txt: Added.
        * editing/selection/drag-start-event-client-x-y.html: Added.

2009-06-26  Mark Rowe  <mrowe@apple.com>

        Reviewed by Sam Weinig.

        Fix user-drag-element-and-user-select-none.html to not rely on a bug in Mac DRT.

        * editing/selection/user-drag-element-and-user-select-none.html:

2009-06-25  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam Weinig

        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails

        Add a test file for each of file extensions we think WebKit on Mac should know the MIME type for.

        * platform/mac/fast/loader/file-url-mimetypes-expected.txt: Added.
        * platform/mac/fast/loader/file-url-mimetypes.html: Added.
        * platform/mac/fast/loader/resources: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-3g2.3g2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-3gp.3gp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-3gp2.3gp2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-3gpp.3gpp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-Z.Z: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ac3.ac3: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ai.ai: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-aif.aif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-aifc.aifc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-aiff.aiff: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-asc.asc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-asf.asf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-asx.asx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-au.au: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-avi.avi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-bcpio.bcpio: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-bin.bin: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-bmp.bmp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-bz.bz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-bz2.bz2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-cdf.cdf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-class.class: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-cpgz.cpgz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-cpio.cpio: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-cpt.cpt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-crw.crw: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-csh.csh: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-css.css: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dcr.dcr: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dif.dif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dir.dir: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dll.dll: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dls.dls: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dmg.dmg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dms.dms: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-doc.doc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-docm.docm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-docx.docx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dotm.dotm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dotx.dotx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dv.dv: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dvi.dvi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-dxr.dxr: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-efx.efx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-eps.eps: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-etx.etx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-exe.exe: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ez.ez: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fdf.fdf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fla.fla: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp.fp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp2.fp2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp3.fp3: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp4.fp4: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp5.fp5: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fp6.fp6: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-fpx.fpx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-gif.gif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-gtar.gtar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-gz.gz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-gzip.gzip: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-hdf.hdf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-hqx.hqx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-htm.htm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-html.html: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ice.ice: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ico.ico: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ics.ics: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ief.ief: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-iges.iges: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-igs.igs: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-iso.iso: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-j2k.j2k: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jar.jar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-javascript.javascript: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jhtml.jhtml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jnlp.jnlp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jp2.jp2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jpe.jpe: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jpeg.jpeg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jpf.jpf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jpg.jpg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jpx.jpx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-js.js: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-jscript.jscript: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-kar.kar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-latex.latex: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-lha.lha: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-lzh.lzh: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-m15.m15: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-m2v.m2v: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-m3u.m3u: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-m4p.m4p: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-m75.m75: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mac.mac: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-man.man: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-me.me: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mesh.mesh: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mid.mid: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-midi.midi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mif.mif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mov.mov: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-movie.movie: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mp2.mp2: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mp3.mp3: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mp4.mp4: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mpe.mpe: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mpeg.mpeg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mpg.mpg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mpga.mpga: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ms.ms: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-msh.msh: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-mxu.mxu: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-nc.nc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-oda.oda: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odc.odc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odf.odf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odg.odg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odi.odi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odm.odm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odp.odp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ods.ods: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-odt.odt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-otc.otc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-otf.otf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-otg.otg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-oth.oth: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-oti.oti: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-otp.otp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ots.ots: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ott.ott: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pbm.pbm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pct.pct: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pcx.pcx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pdb.pdb: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pdf.pdf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pgm.pgm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pgn.pgn: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ph3.ph3: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ph4.ph4: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-php.php: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-php3.php3: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-php4.php4: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-phtml.phtml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pic.pic: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pict.pict: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pl.pl: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pls.pls: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pm.pm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-png.png: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pnm.pnm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pnt.pnt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pntg.pntg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-potm.potm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-potx.potx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ppm.ppm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ppsm.ppsm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ppsx.ppsx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ppt.ppt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pptm.pptm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-pptx.pptx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ps.ps: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-psd.psd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-py.py: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-qif.qif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-qt.qt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-qti.qti: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-qtif.qtif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-qtz.qtz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ra.ra: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ram.ram: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ras.ras: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rb.rb: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rbw.rbw: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rgb.rgb: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rm.rm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-roff.roff: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rpm.rpm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rtf.rtf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-rtx.rtx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sgi.sgi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sgm.sgm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sgml.sgml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sh.sh: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-shar.shar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-shtm.shtm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-shtml.shtml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-silo.silo: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sit.sit: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sitx.sitx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-skd.skd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-skm.skm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-skp.skp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-skt.skt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-smf.smf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-smi.smi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-smil.smil: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-snd.snd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-so.so: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-spl.spl: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-src.src: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sv4cpio.sv4cpio: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-sv4crc.sv4crc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-svg.svg: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-svgz.svgz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-swf.swf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-t.t: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tar.tar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-targa.targa: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tcl.tcl: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tex.tex: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-texi.texi: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-texinfo.texinfo: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-text.text: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tga.tga: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tgz.tgz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tif.tif: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tiff.tiff: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-torrent.torrent: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tr.tr: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-tsv.tsv: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-txt.txt: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-ustar.ustar: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-vcard.vcard: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-vcd.vcd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-vcf.vcf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-vfw.vfw: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-vrml.vrml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wav.wav: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wave.wave: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wax.wax: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wbmp.wbmp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wbxml.wbxml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-webarchive.webarchive: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wm.wm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wma.wma: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmd.wmd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wml.wml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmlc.wmlc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmls.wmls: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmlsc.wmlsc: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmp.wmp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmv.wmv: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wmx.wmx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wrl.wrl: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-wvx.wvx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xbm.xbm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xdp.xdp: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xfd.xfd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xfdf.xfdf: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xht.xht: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xhtm.xhtm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xhtml.xhtml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xls.xls: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xlsb.xlsb: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xlsm.xlsm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xlsx.xlsx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xltm.xltm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xltx.xltx: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xml.xml: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xpm.xpm: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xsl.xsl: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xwd.xwd: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-xyz.xyz: Added.
        * platform/mac/fast/loader/resources/mimeTypeExamples/example-zip.zip: Added.

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=26659

        Update layout tests since the fullscreen button no longer has a renderer.

        * platform/mac/fast/layers/video-layer-expected.txt:
        * platform/mac/media/audio-controls-rendering-expected.txt:
        * platform/mac/media/video-controls-rendering-expected.txt:
        * platform/mac/media/video-display-toggle-expected.txt:
        * platform/mac/media/video-empty-source-expected.txt:
        * platform/mac/media/video-zoom-controls-expected.txt:

++ b/WebCore/ChangeLog
2009-06-26  John Sullivan  <sullivan@apple.com>

        Added Speech submenu to context menu on Mac when there's a non-editable selection
        (it was already present when there's an editable selection).
        Also added support for disabling "Stop Speaking" when there is no speaking to stop.

        Reviewed by Tim Hatcher.

        * loader/EmptyClients.h:
        (WebCore::EmptyContextMenuClient::isSpeaking):
        implemented this new virtual function to return false

        * page/ContextMenuClient.h:
        declared this new pure virtual function

        * platform/ContextMenu.cpp:
        (WebCore::ContextMenu::populate):
        insert Speech item (after a separator) on Mac when there's selected non-editable text
        (WebCore::ContextMenu::checkOrEnableIfNeeded):
        enable Stop Speaking item only if the context menu client returns true for isSpeaking()

2009-06-28  Dan Bernstein  <mitz@apple.com>

        Reviewed by Simon Fraser.

        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
          in MobileMe iDisk Web App

        Test: added a case to fast/dom/Element/scrollWidth.html

        Ensure that scroll{Width, Height} is greater or equal to
        client{Width, Height}.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollWidth):
        (WebCore::RenderBox::scrollHeight):

2009-06-27  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26780

        Do not make compositing layers for non-self-painting RenderLayers,
        since these exist only to push a clip onto the clipping stack. If such
        a layer gets compositied for some other reason, it should not paint.

        Also ensure that we update composited layer positions correctly
        inside overflow:scroll layers. We can't assume that the contents
        are child layers, so we have to go up to the compositing ancestor,
        and tell it to update all its child layer positions as we do
        after layout.

        Tests: compositing/layers-inside-overflow-scroll.html
               compositing/self-painting-layers.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollToOffset):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintIntoLayer):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
        (WebCore::RenderLayerCompositor::needsToBeComposited):

2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>

        Reviewed by Eric Seidel.

        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
        https://bugs.webkit.org/show_bug.cgi?id=23057

        Define these functions for Gtk as well.

        * platform/PurgeableBuffer.h:

2009-06-28  Nate Chapin  <japhet@chromium.org>

        Reviewed by Dimitri Glazkov.

        Update CodeGeneratorV8.pm to match the new api for V8Proxy.

        https://bugs.webkit.org/show_bug.cgi?id=26765

        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.

2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>

        Reviewed by Dimitri Glazkov.

        If loading a font fails because of the sandbox, we ask the browser process to
        try to load it by calling ensureFontLoaded. If it still fails after
        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.

        This case happens once in a while during browser shutdown. The browser will
        queue a message to the renderer to shutdown, and will then stop answering sync
        messages from the renderer. If the renderer is still loading a page during this
        time, it might try to call the browser process to ask to load a font. The
        browser process will ignore the request, and the font will fail to load, even
        after the second try.

        This is unfortunate, but there is no real risk here, since the renderer will be
        going away as soon as it processes another message.

        This can't be layout tested as it depends on the sandbox.

        https://bugs.webkit.org/show_bug.cgi?id=26743

        * platform/graphics/chromium/FontChromiumWin.cpp:
        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:

2009-06-28  John Abd-El-Malek  <jam@chromium.org>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=15457

        Test: plugins/netscape-plugin-map-data-to-src.html

        Fix problems with Real or WMP plugins not displaying because "data" was set
        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045

        * rendering/RenderPartObject.cpp:
        (WebCore::mapDataParamToSrc):
        (WebCore::RenderPartObject::updateWidget):

2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>

        Reviewed by Jan Alonzo.

        [Qt] Build fix after r45290
        https://bugs.webkit.org/show_bug.cgi?id=26769

        * WebCore.pro:

2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>

        Reviewed by Jan Alonzo.

        [GTK] Don't use deprecated GTK+ symbols.
        https://bugs.webkit.org/show_bug.cgi?id=26583

        * plugins/gtk/gtk2xtbin.c:
        (gtk_xtbin_class_init):
        (gtk_xtbin_new):
        (gtk_xtbin_destroy):

2009-06-27  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein.

        https://bugs.webkit.org/show_bug.cgi?id=26780

        Fix up previous change. When computeCompositingRequirements() determines
        that the current layer is composited, it needs to inform its parent
        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
        always happen after the previous patch. Clarified the logic here.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::CompositingState::CompositingState):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):

2009-06-27  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein.

        https://bugs.webkit.org/show_bug.cgi?id=26780

        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
        correctly.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
        that can clobber the value from an earlier sibling. Add some more comments.

        Remove a final use of Vector iterators.

        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
        Move the normalFlowList() processing outside the test for isStackingContext().

2009-06-27  Dan Bernstein  <mitz@apple.com>

        Reviewed by Simon Fraser and Antti Koivisto.

        - make paintFillLayerExtended() non-virtual and remove its clipY and
          clipH parameters

        These parameters were computed and passed along to
        paintFillLayerExtended in order to vertically constrain the rect fill to
        the damage rect, because Qt cannot paint tall rectangles (see
        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
        is passed along in the PaintInfo, the extra parameters are redundant,
        and the intersection can just take place in paintFillLayerExtended().

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::paintFillLayers):
        (WebCore::InlineFlowBox::paintFillLayer):
        (WebCore::InlineFlowBox::paintBoxDecorations):
        (WebCore::InlineFlowBox::paintMask):
        * rendering/InlineFlowBox.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::paintRootBoxDecorations):
        (WebCore::RenderBox::paintBoxDecorations):
        (WebCore::RenderBox::paintMask):
        (WebCore::RenderBox::paintMaskImages):
        (WebCore::RenderBox::paintFillLayers):
        (WebCore::RenderBox::paintFillLayer):
        * rendering/RenderBox.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderFieldset.cpp:
        (WebCore::RenderFieldset::paintBoxDecorations):
        (WebCore::RenderFieldset::paintMask):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintBoxDecorations):
        (WebCore::RenderTable::paintMask):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
        (WebCore::RenderTableCell::paintMask):

2009-06-27  Ryosuke Niwa  <rniwa@google.com>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26762

        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
        https://bugs.webkit.org/show_bug.cgi?id=21712

        Added few utility functions to htmlediting.h/cpp

        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
        i.e. there is no visible node between the first and second positions

        canMergeLists checks whether two lists can be merged.
        It checks the type of list, the editing boundary, and adjacency of the lists.

        Tests: editing/execCommand/indent-nested-lists-1.html
               editing/execCommand/indent-nested-lists-2.html
               editing/execCommand/indent-nested-lists-3.html
               editing/execCommand/indent-nested-lists-4.html
               editing/execCommand/indent-nested-lists-5.html
               editing/execCommand/indent-nested-lists-6.html
               editing/execCommand/indent-nested-lists-7.html
               editing/execCommand/outdent-nested-lists-1.html
               editing/execCommand/outdent-nested-lists-2.html
               editing/execCommand/outdent-nested-lists-3.html
               editing/execCommand/outdent-nested-lists-4.html

        * editing/IndentOutdentCommand.cpp:
        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
        (WebCore::IndentOutdentCommand::indentRegion):
        * editing/IndentOutdentCommand.h:
        * editing/htmlediting.cpp:
        (WebCore::enclosingListChild):
        (WebCore::canMergeLists):
        (WebCore::isVisibilyAdjacent):
        * editing/htmlediting.h:

2009-06-27  Pavel Feldman  <pfeldman@chromium.org>

        Reviewed by Timothy Hatcher.

        WebInspector: Fix completion when iterating options using Tab.

        https://bugs.webkit.org/show_bug.cgi?id=26722

        * inspector/front-end/TextPrompt.js:
        (WebInspector.TextPrompt.prototype._completionsReady):

2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=25889
        [GTK] scrollbar policy for main frame is not implementable

        Override visibleContentRect to handle GTK+'s case, in which
        scrollbars or equivalent decoration are painted by the parent
        widget.

        * platform/ScrollView.cpp:
        * platform/gtk/ScrollViewGtk.cpp:
        (WebCore::ScrollView::visibleContentRect):

2009-06-27  Daniel Bates  <dbates@intudata.com>

        Reviewed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=26708

        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
        and UTF-7 encoded payloads.

        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
               http/tests/security/xssAuditor/iframe-javascript-url.html
               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html

        * html/HTMLTokenizer.cpp:
        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
        (WebCore::HTMLTokenizer::parseTag):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
        as to compare against iFrame javascript URL.
        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
        isControlCharacter in ResourceResponseBase.cpp.
        (WebCore::XSSAuditor::XSSAuditor):
        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
        of iFrame javascript URL.
        * page/XSSAuditor.h: Added field m_parentFrame.
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::isControlCharacter):
        * platform/network/ResourceResponseBase.h:

2009-06-27  Oliver Hunt  <oliver@apple.com>

        Reviewed by Maciej Stachowiak.

        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements

        The drawImage(<video>) logic naively assumes that it just needs
        to check the src attribute of the video element when in fact it
        needs to look at the url that is being played instead.  Failure
        to do this means that video provided through source elements
        taints the canvas.

        Test: media/video-canvas-source.html

        * html/CanvasRenderingContext2D.cpp:
        (WebCore::CanvasRenderingContext2D::checkOrigin):
        (WebCore::CanvasRenderingContext2D::drawImage):
        * html/CanvasRenderingContext2D.h:

2009-06-26  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=26695

        Added the ability to do scrollbar hit testing in EventHandler, changed the
        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
        to scrollbarUnderPoint, and updated all calls to that function.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::hitTestResultAtPoint):
        (WebCore::EventHandler::handleMousePressEvent):
        (WebCore::EventHandler::handleMouseMoveEvent):
        * page/EventHandler.h:
        (WebCore::):
        * platform/PlatformWheelEvent.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::scrollbarUnderPoint):
        * platform/ScrollView.h:
        * platform/chromium/PopupMenuChromium.cpp:
        (WebCore::PopupListBox::handleMouseDownEvent):
        (WebCore::PopupListBox::handleMouseMoveEvent):
        * platform/win/WheelEventWin.cpp:
        (WebCore::PlatformWheelEvent::PlatformWheelEvent):

2009-06-26  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein.

        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode

        Don't go into compositing mode just for opacity transitions, but they will be
        hardware acclerated if we're already compositing.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
        * rendering/RenderLayerCompositor.h:

2009-06-26  Simon Fraser  <simon.fraser@apple.com>

        Rubber-stamped by Dave Levin

        Rename ioCompState to compositingState to better match WebCore coding style.

        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):

2009-06-26  Dan Bernstein  <mitz@apple.com>

        Reviewed by Mark Rowe.

        - revert unintentional project changes from r45277

        * WebCore.xcodeproj/project.pbxproj:

2009-06-26  Mark Rowe  <mrowe@apple.com>

        Fix the Windows build.

        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
        the file was deleted from SVN.

2009-06-26  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Dan Bernstein.

        https://bugs.webkit.org/show_bug.cgi?id=26766

        Change to use array indexing rather than Vector enumerators; the former
        are preferred style.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::hasNonCompositingContent):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
        (WebCore::RenderLayerCompositor::layerHas3DContent):

2009-06-26  Dan Bernstein  <mitz@apple.com>

        Reviewed by Oliver Hunt.

        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
          as 1 px

        Test: fast/dom/Element/scrollWidth.html

        Changed scrollWidth and scrollHeight to use the same logic for
        visible overflow boxes that is used for clipped overflow boxes. In
        particular, borders are not included and
        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::scrollWidth):
        (WebCore::RenderBox::scrollHeight):

2009-06-26  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
        https://bugs.webkit.org/show_bug.cgi?id=26725

        Tests: accessibility/aria-disabled.html
               accessibility/aria-hidden.html
               accessibility/aria-readonly.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::ariaIsHidden):
        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
        (WebCore::AccessibilityRenderObject::isEnabled):
        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
        * accessibility/AccessibilityRenderObject.h:
        * html/HTMLAttributeNames.in:

2009-06-26  Brett Wilson  <brettw@chromium.org>

        Reviewed by David Levin.

        https://bugs.webkit.org/show_bug.cgi?id=26759

        GIFImageDecoder is broken.

        Make the GIFImageDecoder.repetitionCount function const to match the
        base class. The mismatched definitions were causing the function to not
        get called.

        * platform/image-decoders/gif/GIFImageDecoder.cpp:
        (WebCore::GIFImageDecoder::repetitionCount):
        * platform/image-decoders/gif/GIFImageDecoder.h:

2009-06-26  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Simon Fraser  <simon.fraser@apple.com>.

        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651

        The flag should always default to true to avoid it getting set
        to false in a build with accelerated compositing turned off
        and then disabling accelerated compositing when subsequently
        running a build with it turned on.

        * page/Settings.cpp:
        (WebCore::Settings::Settings):

2009-06-26  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam Weinig.

        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails

        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!

        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
        * platform/network/mac/WebCoreURLResponse.h:

2009-06-26  Jeremy Orlow  <jorlow@chromium.org>

        Reviewed by Darin Fisher.

        https://bugs.webkit.org/show_bug.cgi?id=26732

        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
        combine LocalStorage and SessionStorage into StorageNamespace. The
        synching code (for LocalStorage) has already been removed, so these
        classes are now very similar.  All they do is essentially contain a
        logical grouping of origins that are attached to specific contexts
        (be it PageGroups for LocalStorage and Page for SessionStorage).

        * GNUmakefile.am:
        * WebCore.vcproj/WebCore.vcproj:
        * WebCore.xcodeproj/project.pbxproj:
        * WebCoreSources.bkl:
        * page/Chrome.cpp:
        (WebCore::Chrome::createWindow):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::localStorage):
        * page/DOMWindow.h:
        * page/Page.cpp:
        (WebCore::Page::sessionStorage):
        (WebCore::Page::setSessionStorage):
        * page/Page.h:
        * page/PageGroup.cpp:
        (WebCore::PageGroup::localStorage):
        * page/PageGroup.h:
        * storage/LocalStorage.cpp: Removed.
        * storage/LocalStorage.h: Removed.
        * storage/LocalStorageTask.cpp:
        * storage/LocalStorageThread.cpp:
        * storage/SessionStorage.cpp: Removed.
        * storage/SessionStorage.h: Removed.
        * storage/StorageArea.cpp:
        (WebCore::StorageArea::create):
        (WebCore::StorageArea::StorageArea):
        (WebCore::StorageArea::copy):
        (WebCore::StorageArea::length):
        (WebCore::StorageArea::key):
        (WebCore::StorageArea::getItem):
        (WebCore::StorageArea::setItem):
        (WebCore::StorageArea::removeItem):
        (WebCore::StorageArea::clear):
        (WebCore::StorageArea::contains):
        (WebCore::StorageArea::importItem):
        (WebCore::StorageArea::close):
        (WebCore::StorageArea::dispatchStorageEvent):
        * storage/StorageArea.h:
        (WebCore::):
        * storage/StorageAreaSync.cpp:
        (WebCore::StorageAreaSync::scheduleFinalSync):
        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
        (WebCore::localStorageNamespaceMap):
        (WebCore::StorageNamespace::localStorageNamespace):
        (WebCore::StorageNamespace::sessionStorageNamespace):
        (WebCore::StorageNamespace::StorageNamespace):
        (WebCore::StorageNamespace::~StorageNamespace):
        (WebCore::StorageNamespace::copy):
        (WebCore::StorageNamespace::storageArea):
        (WebCore::StorageNamespace::close):
        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.

2009-06-26  Nate Chapin  <japhet@chromium.org>

        Reviewed by David Levin.

        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.

        https://bugs.webkit.org/show_bug.cgi?id=26623

        * bindings/v8/ScheduledAction.cpp:
        (WebCore::ScheduledAction::ScheduledAction):
        (WebCore::ScheduledAction::~ScheduledAction):
        (WebCore::ScheduledAction::execute):
        * bindings/v8/ScriptCallStack.cpp:
        (WebCore::ScriptCallStack::ScriptCallStack):
        * bindings/v8/ScriptController.cpp:
        (WebCore::ScriptController::isSafeScript):
        (WebCore::ScriptController::gcProtectJSWrapper):
        (WebCore::ScriptController::gcUnprotectJSWrapper):
        (WebCore::ScriptController::processingUserGesture):
        (WebCore::ScriptController::evaluate):
        (WebCore::ScriptController::setEventHandlerLineNumber):
        (WebCore::ScriptController::bindToWindowObject):
        (WebCore::ScriptController::collectGarbage):
        (WebCore::ScriptController::haveInterpreter):
        (WebCore::createScriptObject):
        (WebCore::ScriptController::createScriptObjectForPluginElement):
        * bindings/v8/ScriptInstance.cpp:
        (WebCore::V8ScriptInstance::clear):
        (WebCore::V8ScriptInstance::set):
        * bindings/v8/ScriptObject.cpp:
        (WebCore::ScriptGlobalObject::set):
        * bindings/v8/ScriptObjectQuarantine.cpp:
        (WebCore::getQuarantinedScriptObject):
        * bindings/v8/ScriptScope.cpp:
        (WebCore::ScriptScope::ScriptScope):
        * bindings/v8/ScriptValue.h:
        (WebCore::ScriptValue::ScriptValue):
        (WebCore::ScriptValue::operator=):
        (WebCore::ScriptValue::clear):
        * bindings/v8/V8AbstractEventListener.cpp:
        (WebCore::V8AbstractEventListener::invokeEventHandler):
        (WebCore::V8AbstractEventListener::handleEvent):
        (WebCore::V8AbstractEventListener::disposeListenerObject):
        (WebCore::V8AbstractEventListener::getReceiverObject):
        * bindings/v8/V8Collection.cpp:
        (WebCore::toOptionsCollectionSetter):
        * bindings/v8/V8Collection.h:
        (WebCore::getV8Object):
        (WebCore::getNamedPropertyOfCollection):
        (WebCore::nodeCollectionNamedPropertyGetter):
        (WebCore::getIndexedPropertyOfCollection):
        (WebCore::nodeCollectionIndexedPropertyGetter):
        (WebCore::nodeCollectionIndexedPropertyEnumerator):
        (WebCore::collectionIndexedPropertyEnumerator):
        (WebCore::collectionStringOrNullIndexedPropertyGetter):
        * bindings/v8/V8DOMMap.cpp:
        (WebCore::weakDOMObjectCallback):
        (WebCore::DOMData::removeObjectsFromWrapperMap):
        * bindings/v8/V8Helpers.cpp:
        (WebCore::wrapNPObject):
        (WebCore::toV8Context):
        * bindings/v8/V8LazyEventListener.cpp:
        (WebCore::V8LazyEventListener::~V8LazyEventListener):
        (WebCore::V8LazyEventListener::getListenerFunction):
        (WebCore::V8LazyEventListener::callListenerFunction):
        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
        * bindings/v8/V8NodeFilterCondition.cpp:
        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
        (WebCore::V8NodeFilterCondition::acceptNode):
        * bindings/v8/V8ObjectEventListener.cpp:
        (WebCore::weakObjectEventListenerCallback):
        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
        * bindings/v8/V8Proxy.cpp: Added.
        * bindings/v8/V8Proxy.h:
        (WebCore::):
        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
        (WebCore::V8Proxy::):
        (WebCore::V8Proxy::V8Proxy):
        (WebCore::V8Proxy::frame):
        (WebCore::V8Proxy::inlineCode):
        (WebCore::V8Proxy::setInlineCode):
        (WebCore::V8Proxy::timerCallback):
        (WebCore::V8Proxy::setTimerCallback):
        (WebCore::V8Proxy::setEventHandlerLineNumber):
        (WebCore::V8Proxy::finishedWithEvent):
        (WebCore::V8Proxy::wrapCPointer):
        (WebCore::V8Proxy::extractCPointer):
        (WebCore::V8Proxy::convertDOMWrapperToNative):
        (WebCore::V8Proxy::convertDOMWrapperToNode):
        (WebCore::V8Proxy::convertToV8Object):
        (WebCore::V8Proxy::convertToNativeObject):
        (WebCore::V8Proxy::convertToNativeEvent):
        (WebCore::V8Proxy::context):
        (WebCore::V8Proxy::extractCPointerImpl):
        (WebCore::V8Proxy::utilityContext):
        (WebCore::V8Proxy::constructDOMObject):
        (WebCore::throwError):
        (WebCore::toV8):
        * bindings/v8/V8Utilities.h:
        * bindings/v8/WorkerContextExecutionProxy.cpp:
        (WebCore::WorkerContextExecutionProxy::retrieve):
        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
        (WebCore::WorkerContextExecutionProxy::GetConstructor):
        (WebCore::WorkerContextExecutionProxy::ToV8Object):
        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
        (WebCore::WorkerContextExecutionProxy::toV8):
        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
        (WebCore::WorkerContextExecutionProxy::evaluate):
        (WebCore::WorkerContextExecutionProxy::runScript):
        * bindings/v8/custom/V8AttrCustom.cpp:
        (WebCore::ACCESSOR_SETTER):
        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::NAMED_PROPERTY_SETTER):
        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::INDEXED_PROPERTY_SETTER):
        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
        (WebCore::toV8):
        (WebCore::toCanvasStyle):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8ClientRectListCustom.cpp:
        (WebCore::INDEXED_PROPERTY_GETTER):
        * bindings/v8/custom/V8ClipboardCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8CustomBinding.cpp:
        (WebCore::allowSettingFrameSrcToJavascriptUrl):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::INDEXED_ACCESS_CHECK):
        (WebCore::NAMED_ACCESS_CHECK):
        (WebCore::V8Custom::GetTargetFrame):
        * bindings/v8/custom/V8CustomEventListener.cpp:
        (WebCore::V8EventListener::V8EventListener):
        (WebCore::V8EventListener::~V8EventListener):
        (WebCore::V8EventListener::callListenerFunction):
        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
        (WebCore::V8CustomSQLStatementCallback::handleEvent):
        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
        * bindings/v8/custom/V8CustomVoidCallback.cpp:
        (WebCore::V8CustomVoidCallback::handleEvent):
        (WebCore::invokeCallback):
        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
        * bindings/v8/custom/V8DOMParserConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8Custom::WindowSetTimeoutImpl):
        (WebCore::convertBase64):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::createWindow):
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::V8Custom::ClearTimeoutImpl):
        (WebCore::NAMED_ACCESS_CHECK):
        (WebCore::INDEXED_ACCESS_CHECK):
        * bindings/v8/custom/V8DatabaseCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8DocumentCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        * bindings/v8/custom/V8ElementCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::ACCESSOR_GETTER):
        * bindings/v8/custom/V8EventCustom.cpp:
        (WebCore::ACCESSOR_SETTER):
        (WebCore::ACCESSOR_GETTER):
        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
        (WebCore::getNamedItems):
        (WebCore::getItem):
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::ACCESSOR_GETTER):
        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
        (WebCore::ACCESSOR_SETTER):
        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
        (WebCore::ACCESSOR_SETTER):
        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::INDEXED_PROPERTY_SETTER):
        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::NAMED_PROPERTY_SETTER):
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::INDEXED_PROPERTY_SETTER):
        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        (WebCore::INDEXED_PROPERTY_SETTER):
        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::removeElement):
        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8LocationCustom.cpp:
        (WebCore::ACCESSOR_SETTER):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::INDEXED_ACCESS_CHECK):
        (WebCore::NAMED_ACCESS_CHECK):
        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8MessagePortCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
        (WebCore::INDEXED_PROPERTY_GETTER):
        (WebCore::NAMED_PROPERTY_GETTER):
        * bindings/v8/custom/V8NavigatorCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        * bindings/v8/custom/V8NodeCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
        (WebCore::toV8):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8NodeListCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8SVGLengthCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
        (WebCore::NAMED_PROPERTY_GETTER):
        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
        (WebCore::toV8):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WorkerContextCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::SetTimeoutOrInterval):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        (WebCore::getEventListener):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
        (WebCore::getEventListener):
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
        (WebCore::ACCESSOR_GETTER):
        (WebCore::ACCESSOR_SETTER):
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):

2009-06-26  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Tim Hatcher.

        <rdar://problem/7011047> Profiler shows the record button 'on' even
        though it's finished

        I consolidated the creation of the user initiated profile name into
        its own function and then called it from console::profile instead of
        calling startUserInitiatedProfiling().  This way we don't call
        toggleRecordButton() which turns on the record button.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::didCommitLoad):
        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
        (WebCore::InspectorController::startUserInitiatedProfiling):
        (WebCore::InspectorController::stopUserInitiatedProfiling):
        * inspector/InspectorController.h:
        * page/Console.cpp:
        (WebCore::Console::profile):
        (WebCore::Console::profileEnd):

2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>

        Reviewed by Eric Seidel.

        https://bugs.webkit.org/show_bug.cgi?id=26691

        Cleanup: Move focusRingColor to RenderTheme.

        Most of this CL involves deleting files and removing dead code.

        focusRingColor() is now defined in RenderTheme rather than in
        misc. places on each port.  The default color is specified as
        black in renderTheme and ports can override it in their own
        custom renderThemes.

        Behavior should be identical except for the following cases,
        this lists platform and what the focus ring color used to be
        before this cl and the file where it used to be defined:

        Android - red
        WebCore/platform/android/TemporaryLinkStubs.cpp

        Cairo - aqua focus ring color - 0xFF7DADD9
        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp

        wx - red
        WebCore/platform/wx/TemporaryLinkStubs.cpp

        QT - black
        WebCore/platform/graphics/qt/GraphicsContextQt.cpp

        Manual test: manual-tests/focusringcolor-change-on-theme-change.html

        * css/CSSStyleSelector.cpp:
        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
        * platform/android/TemporaryLinkStubs.cpp:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        * platform/graphics/chromium/ColorChromium.cpp: Removed.
        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
        * platform/graphics/mac/ColorMac.h:
        * platform/graphics/mac/ColorMac.mm:
        (WebCore::oldAquaFocusRingColor):
        (WebCore::setUsesTestModeFocusRingColor):
        (WebCore::usesTestModeFocusRingColor):
        * platform/graphics/qt/GraphicsContextQt.cpp:
        * platform/graphics/skia/GraphicsContextSkia.cpp:
        (WebCore::GraphicsContext::drawFocusRing):
        * platform/graphics/win/ColorSafari.cpp: Removed.
        * platform/wx/TemporaryLinkStubs.cpp:
        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::focusRingColor):
        * rendering/RenderTheme.h:
        * rendering/RenderThemeChromiumMac.h:
        * rendering/RenderThemeChromiumMac.mm:
        (WebCore::RenderThemeChromiumMac::focusRingColor):
        (WebCore::RenderThemeChromiumMac::systemColor):
        * rendering/RenderThemeChromiumSkia.cpp:
        (WebCore::RenderThemeChromiumSkia::focusRingColor):
        * rendering/RenderThemeChromiumSkia.h:
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::focusRingColor):
        (WebCore::RenderThemeMac::systemColor):
        * rendering/RenderThemeSafari.cpp:
        (WebCore::makeRGBAFromCGColor):
        (WebCore::RenderThemeSafari::focusRingColor):
        * rendering/RenderThemeSafari.h:

2009-06-26  Dmitry Titov  <dimich@chromium.org>

        Reviewed by David Levin.

        https://bugs.webkit.org/show_bug.cgi?id=26761
        [Chromium] Enable Dedicated Workers in Chromium.

        * bindings/v8/custom/V8WorkerCustom.cpp:
        (WebCore::CALLBACK_FUNC_DECL):
        Remove the check that prevented workers from being created w/o a command-line switch.
        The flag itself and methods will be removed in a subsequent patch, after
        corresponding change in Chromium.

2009-06-26  Jessie _Berlin  <jberlin@apple.com>

        Reviewed by Mark Rowe.

        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
        Where the m_mouseDown event was never being set on windows, so the
        client X and Y coordinates were always being reported as zero in a
        dragstart handler.

        Test: editing/selection/drag-start-event-client-x-y.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMousePressEvent):
        Set the m_mouseDown event when the mouse press is handled.
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::mouseDown):
        Removed now redundant setting of m_mouseDown.

2009-06-26  Brady Eidson  <beidson@apple.com>

        Tiger build fix

        * WebCore.xcodeproj/project.pbxproj:
        * platform/network/mac/WebCoreURLResponse.mm:
        (swizzleMIMETypeMethodIfNecessary):

2009-06-26  Alexey Proskuryakov  <ap@webkit.org>

        Reviewed by Sam Weinig.

        https://bugs.webkit.org/show_bug.cgi?id=26681
        Problem updating applicationCache when server returns 304

        Improve the fix, make the test pass on Tiger.

        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
        current item from list.

        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
        conditional requests that cannot be cached by network layer cause errors with default cache
        policy.

2009-06-26  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam Weinig

        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails

        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
        knew about.

        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
        type mappings that are missing in CoreType's database.

        Test: platform/mac/fast/loader/file-url-mimetypes.html

        * platform/network/mac/ResourceHandleMac.mm:
        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
          WebCoreURLResponse.

        * platform/network/mac/ResourceResponseMac.mm:
        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
          where we do all MIMEType correction.

        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
          implementation of MIMEType.
        * platform/network/mac/WebCoreURLResponse.mm:
        (createBinaryExtensionsSet):
        (createExtensionToMIMETypeMap):
        (swizzleMIMETypeMethodIfNecessary):
        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the
          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
          implemented in _webcore_MIMEType.

        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Simon Fraser.

        Show the fullscreen button only if the backend has support for it.

        https://bugs.webkit.org/show_bug.cgi?id=26661

        No test since this is not reachable via the DOM.

        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::supportsFullscreen): new
        * html/HTMLVideoElement.h:
        (WebCore::HTMLVideoElement::supportsFullscreen): new
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
        (WebCore::MediaPlayer::supportsFullscreen): new
        * platform/graphics/MediaPlayer.h: new
        * platform/graphics/MediaPlayerPrivate.h: new
        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
        * rendering/MediaControlElements.cpp:
        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
        * rendering/MediaControlElements.h:

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Simon Fraser.

        <rdar://problem/7007776> Controller doesn't automatically update counters when file
        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )

        Update the time display when the movie time changes.

        * rendering/RenderMedia.cpp:
        (WebCore::RenderMedia::updateControls):

2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=26659

        Support hidding a control bar element from the Media element controller.

        Update layout tests since the fullscreen button no longer has a renderer.

        * rendering/MediaControlElements.cpp:
        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
        is updated properly.
        (WebCore::MediaControlInputElement::MediaControlInputElement):
        (WebCore::MediaControlInputElement::update): call updateStyle()
        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
        or not depending on what rendererIsNeeded() return.
        * rendering/MediaControlElements.h:

2009-06-26  Kevin McCullough  <kmccullough@apple.com>

        Reviewed by Oliver Hunt.

        <rdar://problem/6968137> Profiler title numbers increment even after a
        reload.

        - Now the numbers are reset when the profiles are.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::didCommitLoad):

++ b/WebKit/gtk/ChangeLog
2009-06-28  Xan Lopez  <xlopez@igalia.com>

        Fix the GTK+ build.

        * WebCoreSupport/ContextMenuClientGtk.cpp:
        (WebKit::ContextMenuClient::isSpeaking):
        * WebCoreSupport/ContextMenuClientGtk.h:

++ b/WebKit/gtk/po/ChangeLog
2009-06-28  Miloš Popović  <gpopac@gmail.com>

        Rubber-stamped by Jan Alonzo.

        New Serbian translation.

        * sr.po: Added.
        * sr@latin.po: Added.

++ b/WebKit/mac/ChangeLog
2009-06-26  John Sullivan  <sullivan@apple.com>

        Added support for disabling Stop Speaking when there is no speaking to stop.
        Also fixed Stop Speaking so that it works (formerly it would throw an exception, and
        selecting it from the menu would perform a web search instead (!)).

        Reviewed by Tim Hatcher.

        * WebCoreSupport/WebContextMenuClient.h:
        declare isSpeaking()

        * WebCoreSupport/WebContextMenuClient.mm:
        (WebContextMenuClient::isSpeaking):
        implement by calling through to NSApplication
        (WebContextMenuClient::stopSpeaking):
        fixed implementation by correcting the signature of the NSApplication method

2009-06-26  Chris Marrin  <cmarrin@apple.com>

        Reviewed by Simon Fraser  <simon.fraser@apple.com>.

        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651

        The flag should always default to true to avoid it getting set
        to false in a build with accelerated compositing turned off
        and then disabling accelerated compositing when subsequently
        running a build with it turned on.

        * WebView/WebPreferences.mm:
        (+[WebPreferences initialize]):

2009-06-26  Brady Eidson  <beidson@apple.com>

        Fix SnowLeopard build.

        * Plugins/Hosted/HostedNetscapePluginStream.mm:
        (WebKit::HostedNetscapePluginStream::didReceiveResponse):

2009-06-26  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam Weinig

        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails

        Replace all usage of the now obsolete [NSURLResponse _webcore_MIMEType].

        * Plugins/WebBaseNetscapePluginStream.mm:
        (WebNetscapePluginStream::didReceiveResponse):
        * Plugins/WebNetscapePluginView.mm:
        (-[WebNetscapePluginView pluginView:receivedData:]):
        * Plugins/WebPluginController.mm:
        (-[WebPluginController pluginView:receivedResponse:]):
        * WebView/WebDataSource.mm:
        (-[WebDataSource _responseMIMEType]):
        * WebView/WebResource.mm:
        (-[WebResource _initWithData:URL:response:]):

++ b/WebKit/qt/ChangeLog
2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>

        Fix the Qt build, add missing isSpeaking() implementation to
        ContextMenuClient.

        * WebCoreSupport/ContextMenuClientQt.cpp:
        (WebCore::ContextMenuClientQt::isSpeaking):
        * WebCoreSupport/ContextMenuClientQt.h:

2009-06-28  Sriram Yadavalli  <sriram.yadavalli@nokia.com>

        Reviewed by Eric Seidel.

        [Qt] Fix build break for Qt
        https://bugs.webkit.org/show_bug.cgi?id=26779

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-27  Simon Hausmann  <simon.hausmann@nokia.com>

        Build fix for Qt under Windows.

        * Api/qwebhistory.h: Use consistent export linkage for the datastream operators.

2009-06-26  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Simon Fraser.

        Changed call of scrollbarUnderMouse to scrollbarUnderPoint to match new API.

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

++ b/WebKit/win/ChangeLog
2009-06-26  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Simon Fraser.

        https://bugs.webkit.org/show_bug.cgi?id=26695

        Added hit testing on scrollbars, so if you start a gesture over a scrollbar,
        it isn't counted, and lets the user drag the scrollbar itself instead of a
        panning gesture. Also cleaned up code in gesture.

        * WebView.cpp:
        (WebView::gestureNotify):
        (WebView::gesture):

2009-06-26  Jeremy Orlow  <jorlow@chromium.org>

        Reviewed by Adam Barth.

        https://bugs.webkit.org/show_bug.cgi?id=26767

        Fix a build break due to LocalStorage.h being included in WebKitDLL.cpp
        despite it being deleted from the repo by the following patch/commit:
        https://bugs.webkit.org/show_bug.cgi?id=26732
        http://trac.webkit.org/changeset/45290

        * WebKitDLL.cpp:

++ b/WebKitTools/ChangeLog
2009-06-28  Jan Michael Alonzo  <jmalonzo@webkit.org>

        Gtk build fix - include stdarg.h for va_start/va_end.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:

2009-06-28  John Abd-El-Malek  <jam@chromium.org>

        https://bugs.webkit.org/show_bug.cgi?id=15457

        Modify NPAPI test plugin to verify that "src" paramater is added when
        it's missing but "data" is present.

        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
        (pluginLog):
        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp:
        (NPP_New):
        (NPP_Destroy):
        (NPP_SetWindow):
        (handleEventCarbon):
        (handleEventCocoa):
        * DumpRenderTree/win/TestNetscapePlugin/main.cpp:
        (NPP_New):

2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>

        Reviewed by Jan Alonzo.

        [GTK] Don't use deprecated GTK+ symbols.
        https://bugs.webkit.org/show_bug.cgi?id=26583

        * GtkLauncher/main.c:
        (create_toolbar):

2009-06-26  Adam Barth  <abarth@webkit.org>

        Reviewed by Eric Seidel.

        Make SVN work (again?).

        * Scripts/modules/scm.py:

2009-06-26  Chris Fleizach  <cfleizach@apple.com>

        Reviewed by Oliver Hunt.

        Add ability to query isEnabled

        * DumpRenderTree/AccessibilityUIElement.cpp:
        (getIsEnabledCallback):
        (AccessibilityUIElement::getJSClass):
        * DumpRenderTree/AccessibilityUIElement.h:
        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
        (AccessibilityUIElement::isEnabled):
        * DumpRenderTree/win/AccessibilityUIElementWin.cpp:
        (AccessibilityUIElement::isEnabled):

2009-06-26  Brady Eidson  <beidson@apple.com>

        Reviewed by Sam Weinig

        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails

        Add a dumpResourceResponseMIMETypes() mode so the ResourceLoadDelegate will dump the mime type from
        the NSURLResponse.  Needed for the test for this bug fix.

        * DumpRenderTree/LayoutTestController.cpp:
        (LayoutTestController::LayoutTestController):
        (dumpResourceResponseMIMETypesCallback):
        (LayoutTestController::staticFunctions):
        * DumpRenderTree/LayoutTestController.h:
        (LayoutTestController::dumpResourceResponseMIMETypes):
        (LayoutTestController::setDumpResourceResponseMIMETypes):

        * DumpRenderTree/mac/ResourceLoadDelegate.mm:
        (-[ResourceLoadDelegate webView:resource:didReceiveResponse:fromDataSource:]):

2009-06-26  David Kilzer  <ddkilzer@apple.com>

        Update build-dumprendertree to use buildXCodeProject()

        Reviewed by Adam Roben.

        * Scripts/build-dumprendertree: Updated to use
        buildXCodeProject() when building for isAppleMacWebKit().  This
        provides additional command-line switch parsing for free.  Also
        added --clean and --help switches.  Updated copyright.
---
 src/3rdparty/webkit/JavaScriptCore/ChangeLog       |   44 +-
 .../JavaScriptCore/interpreter/Interpreter.cpp     |    2 +-
 .../webkit/JavaScriptCore/runtime/DateInstance.cpp |    2 +-
 .../webkit/JavaScriptCore/runtime/Identifier.cpp   |    2 +-
 .../webkit/JavaScriptCore/runtime/Lookup.h         |    2 +-
 .../JavaScriptCore/runtime/RegExpConstructor.cpp   |    2 +-
 .../webkit/JavaScriptCore/runtime/RegExpObject.h   |    2 +-
 .../webkit/JavaScriptCore/runtime/ScopeChain.h     |    2 +-
 .../webkit/JavaScriptCore/runtime/UString.h        |    2 +-
 src/3rdparty/webkit/VERSION                        |    2 +-
 src/3rdparty/webkit/WebCore/ChangeLog              | 1121 ++++++++++++++++++++
 src/3rdparty/webkit/WebCore/WebCore.pro            |   19 +-
 .../accessibility/AccessibilityRenderObject.cpp    |   26 +
 .../accessibility/AccessibilityRenderObject.h      |    1 +
 .../WebCore/bindings/scripts/CodeGeneratorV8.pm    |   94 +-
 .../webkit/WebCore/css/CSSStyleSelector.cpp        |    2 +-
 .../WebCore/editing/IndentOutdentCommand.cpp       |  117 +-
 .../webkit/WebCore/editing/IndentOutdentCommand.h  |    4 +-
 .../webkit/WebCore/editing/htmlediting.cpp         |   21 +-
 src/3rdparty/webkit/WebCore/editing/htmlediting.h  |    5 +-
 .../webkit/WebCore/generated/HTMLNames.cpp         |   14 +-
 src/3rdparty/webkit/WebCore/generated/HTMLNames.h  |    3 +
 .../WebCore/html/CanvasRenderingContext2D.cpp      |    9 +-
 .../webkit/WebCore/html/CanvasRenderingContext2D.h |    1 +
 .../webkit/WebCore/html/HTMLAttributeNames.in      |    3 +
 .../webkit/WebCore/html/HTMLMediaElement.h         |    4 +-
 src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp |   18 +-
 .../webkit/WebCore/html/HTMLVideoElement.h         |    1 +
 .../WebCore/inspector/InspectorController.cpp      |   23 +-
 .../webkit/WebCore/inspector/InspectorController.h |    1 +
 .../WebCore/inspector/front-end/TextPrompt.js      |    2 +-
 src/3rdparty/webkit/WebCore/loader/EmptyClients.h  |    1 +
 .../loader/appcache/ApplicationCacheGroup.cpp      |    1 +
 src/3rdparty/webkit/WebCore/page/Chrome.cpp        |    6 +-
 src/3rdparty/webkit/WebCore/page/Console.cpp       |   28 +-
 .../webkit/WebCore/page/ContextMenuClient.h        |    1 +
 src/3rdparty/webkit/WebCore/page/DOMWindow.cpp     |    5 +-
 src/3rdparty/webkit/WebCore/page/DOMWindow.h       |    1 -
 src/3rdparty/webkit/WebCore/page/EventHandler.cpp  |   14 +-
 src/3rdparty/webkit/WebCore/page/EventHandler.h    |    4 +-
 src/3rdparty/webkit/WebCore/page/Page.cpp          |   10 +-
 src/3rdparty/webkit/WebCore/page/Page.h            |   10 +-
 src/3rdparty/webkit/WebCore/page/PageGroup.cpp     |    7 +-
 src/3rdparty/webkit/WebCore/page/PageGroup.h       |    6 +-
 src/3rdparty/webkit/WebCore/page/Settings.cpp      |    8 +-
 src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp    |   63 +-
 src/3rdparty/webkit/WebCore/page/XSSAuditor.h      |   10 +-
 .../webkit/WebCore/platform/ContextMenu.cpp        |   16 +-
 .../webkit/WebCore/platform/PlatformWheelEvent.h   |    5 +-
 .../webkit/WebCore/platform/PurgeableBuffer.h      |    2 +-
 .../webkit/WebCore/platform/ScrollView.cpp         |    6 +-
 src/3rdparty/webkit/WebCore/platform/ScrollView.h  |    2 +-
 .../platform/android/TemporaryLinkStubs.cpp        |    9 -
 .../WebCore/platform/graphics/MediaPlayer.cpp      |    7 +
 .../webkit/WebCore/platform/graphics/MediaPlayer.h |    1 +
 .../WebCore/platform/graphics/MediaPlayerPrivate.h |    2 +
 .../platform/graphics/qt/GraphicsContextQt.cpp     |    1 -
 .../platform/network/ResourceResponseBase.cpp      |    2 +-
 .../platform/network/ResourceResponseBase.h        |    2 +
 .../webkit/WebCore/plugins/win/PluginViewWin.cpp   |   17 +-
 .../webkit/WebCore/rendering/InlineFlowBox.cpp     |   33 +-
 .../webkit/WebCore/rendering/InlineFlowBox.h       |    6 +-
 .../WebCore/rendering/MediaControlElements.cpp     |   42 +-
 .../WebCore/rendering/MediaControlElements.h       |    3 +-
 .../webkit/WebCore/rendering/RenderBox.cpp         |   50 +-
 src/3rdparty/webkit/WebCore/rendering/RenderBox.h  |    6 +-
 .../WebCore/rendering/RenderBoxModelObject.cpp     |    6 +-
 .../WebCore/rendering/RenderBoxModelObject.h       |    3 +-
 .../webkit/WebCore/rendering/RenderFieldset.cpp    |   12 +-
 .../webkit/WebCore/rendering/RenderLayer.cpp       |    6 +-
 .../WebCore/rendering/RenderLayerBacking.cpp       |   30 +-
 .../WebCore/rendering/RenderLayerCompositor.cpp    |  249 ++---
 .../WebCore/rendering/RenderLayerCompositor.h      |    4 +-
 .../webkit/WebCore/rendering/RenderMedia.cpp       |    4 +
 .../webkit/WebCore/rendering/RenderPartObject.cpp  |   20 +
 .../webkit/WebCore/rendering/RenderTable.cpp       |   18 +-
 .../webkit/WebCore/rendering/RenderTableCell.cpp   |   12 +-
 .../webkit/WebCore/rendering/RenderTheme.cpp       |    5 +
 .../webkit/WebCore/rendering/RenderTheme.h         |    2 +
 .../WebCore/rendering/RenderThemeChromiumMac.h     |    2 +
 .../WebCore/rendering/RenderThemeChromiumMac.mm    |   13 +
 .../WebCore/rendering/RenderThemeChromiumSkia.cpp  |    6 +
 .../WebCore/rendering/RenderThemeChromiumSkia.h    |    1 +
 .../webkit/WebCore/rendering/RenderThemeMac.h      |    1 +
 .../webkit/WebCore/rendering/RenderThemeSafari.cpp |   27 +
 .../webkit/WebCore/rendering/RenderThemeSafari.h   |    2 +
 .../webkit/WebCore/storage/LocalStorage.cpp        |  115 --
 src/3rdparty/webkit/WebCore/storage/LocalStorage.h |   65 --
 .../webkit/WebCore/storage/LocalStorageTask.cpp    |    1 -
 .../webkit/WebCore/storage/LocalStorageThread.cpp  |    1 -
 .../webkit/WebCore/storage/SessionStorage.cpp      |   80 --
 .../webkit/WebCore/storage/SessionStorage.h        |   67 --
 .../webkit/WebCore/storage/StorageArea.cpp         |   71 +-
 src/3rdparty/webkit/WebCore/storage/StorageArea.h  |   19 +-
 .../webkit/WebCore/storage/StorageAreaSync.cpp     |    2 +
 .../webkit/WebCore/storage/StorageNamespace.cpp    |  129 +++
 .../webkit/WebCore/storage/StorageNamespace.h      |   74 ++
 .../webkit/WebCore/svg/graphics/SVGImage.cpp       |    2 +-
 src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp     |    2 +-
 src/3rdparty/webkit/WebKit/qt/ChangeLog            |   34 +
 .../qt/WebCoreSupport/ContextMenuClientQt.cpp      |    6 +
 .../WebKit/qt/WebCoreSupport/ContextMenuClientQt.h |    1 +
 102 files changed, 2114 insertions(+), 916 deletions(-)
 delete mode 100644 src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
 delete mode 100644 src/3rdparty/webkit/WebCore/storage/LocalStorage.h
 delete mode 100644 src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
 delete mode 100644 src/3rdparty/webkit/WebCore/storage/SessionStorage.h
 create mode 100644 src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
 create mode 100644 src/3rdparty/webkit/WebCore/storage/StorageNamespace.h

diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index ce36bdf..c8bba0f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,29 +1,25 @@
-2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+2009-06-26  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Dan Bernstein.
 
-        Add support for QDataStream operators to Vector.
-
-        * wtf/Vector.h:
-        (WTF::operator<<):
-        (WTF::operator>>):
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
 
-2009-06-26  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
 
-        Reviewed by Eric Seidel.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
 
-        https://bugs.webkit.org/show_bug.cgi?id=26750        
+2009-06-26  Eric Seidel  <eric@webkit.org>
 
-        Allow custom memory allocation control for JavaScriptCore/runtime
-        directory's classes which instantiated by new:
+        No review, only rolling out r45259.
 
-        class  IdentifierTable
-        struct RegExpObjectData
-        class  HashEntry
-        struct DataInstance::Cache 
-        class  UString
-        struct RegExpConstructorPrivate
-        class  ScopeChain
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
 
         * runtime/DateInstance.cpp:
         * runtime/Identifier.cpp:
@@ -33,6 +29,16 @@
         * runtime/ScopeChain.h:
         * runtime/UString.h:
 
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to Vector.
+
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
+
 2009-06-24  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Gavin Barraclough.
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index fa7ec0b..7b1e547 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1085,7 +1085,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
 
     StructureChain* protoChain = structure->prototypeChain(callFrame);
     if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
+        vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index a11967e..62791ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -30,7 +30,7 @@ using namespace WTF;
 
 namespace JSC {
 
-struct DateInstance::Cache : public FastAllocBase {
+struct DateInstance::Cache {
     double m_gregorianDateTimeCachedForMS;
     GregorianDateTime m_cachedGregorianDateTime;
     double m_gregorianDateTimeUTCCachedForMS;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 7db723b..040c123 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -32,7 +32,7 @@ namespace JSC {
 
 typedef HashMap<const char*, RefPtr<UString::Rep>, PtrHash<const char*> > LiteralIdentifierTable;
 
-class IdentifierTable : public FastAllocBase {
+class IdentifierTable {
 public:
     ~IdentifierTable()
     {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index fe94b16..3b7353d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -44,7 +44,7 @@ namespace JSC {
     typedef PropertySlot::GetValueFunc GetFunction;
     typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
-    class HashEntry : public FastAllocBase {
+    class HashEntry {
     public:
         void initialize(UString::Rep* key, unsigned char attributes, intptr_t v1, intptr_t v2)
         {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index 82481a4..bcd0d07 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -88,7 +88,7 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate : public FastAllocBase {
+struct RegExpConstructorPrivate {
     // Global search cache / settings
     RegExpConstructorPrivate()
         : lastNumSubPatterns(0)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index f62b7e1..fac9978 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -56,7 +56,7 @@ namespace JSC {
 
         virtual CallType getCallData(CallData&);
 
-        struct RegExpObjectData : public FastAllocBase {
+        struct RegExpObjectData {
             RegExpObjectData(PassRefPtr<RegExp> regExp, double lastIndex)
                 : regExp(regExp)
                 , lastIndex(lastIndex)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index d7cd257..17aff24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -154,7 +154,7 @@ namespace JSC {
 
     class NoScopeChain {};
 
-    class ScopeChain : public FastAllocBase {
+    class ScopeChain {
         friend class JIT;
     public:
         ScopeChain(NoScopeChain)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index 288d271..d01b75d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -73,7 +73,7 @@ namespace JSC {
 
     typedef Vector<char, 32> CStringBuffer;
 
-    class UString : public FastAllocBase {
+    class UString {
         friend class JIT;
 
     public:
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index ae6b09d..7d347be 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        6b0744eab3f993b9c2bd44e3e79d7664040fd003
+        22aadba1b4356ad7d8e9446b95baccb6b2c037b0
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 051af27..8991528 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,1124 @@
+2009-06-26  John Sullivan  <sullivan@apple.com>
+
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
+
+        Reviewed by Tim Hatcher.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
+        
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
+        
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
+
+2009-06-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
+
+        Test: added a case to fast/dom/Element/scrollWidth.html
+
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
+        
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
+
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by Eric Seidel.
+
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
+
+        Define these functions for Gtk as well.
+
+        * platform/PurgeableBuffer.h:
+
+2009-06-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26765
+
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
+
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
+
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
+
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
+
+        This can't be layout tested as it depends on the sandbox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15457
+
+        Test: plugins/netscape-plugin-map-data-to-src.html
+
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
+
+        * WebCore.pro:
+
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] Don't use deprecated GTK+ symbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26780
+        
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
+        
+        Remove a final use of Vector iterators.
+        
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
+
+2009-06-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
+
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
+
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26762
+
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
+
+        Added few utility functions to htmlediting.h/cpp
+
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
+
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
+
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
+
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix completion when iterating options using Tab.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26722
+
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
+
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2009-06-27  Daniel Bates  <dbates@intudata.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
+
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
+
+2009-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
+
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
+
+        Test: media/video-canvas-source.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26695
+        
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderPoint):
+        * platform/ScrollView.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
+        
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stamped by Dave Levin
+
+        Rename ioCompState to compositingState to better match WebCore coding style.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - revert unintentional project changes from r45277
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
+
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26766
+
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-06-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
+
+        Test: fast/dom/Element/scrollWidth.html
+
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
+
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
+
+2009-06-26  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26759
+
+        GIFImageDecoder is broken.
+
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
+
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26732
+
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
+        * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
+
+2009-06-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26623
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
+
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26691
+
+        Cleanup: Move focusRingColor to RenderTheme.
+
+        Most of this CL involves deleting files and removing dead code.
+
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
+
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
+
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
+
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
+
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
+
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
+
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
+
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
+
+        Test: editing/selection/drag-start-event-client-x-y.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Tiger build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
+
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
+        
+        Improve the fix, make the test pass on Tiger.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
+
+2009-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
+
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
+
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
+
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
+
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Show the fullscreen button only if the backend has support for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26661
+
+        No test since this is not reachable via the DOM.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
+
+        Update the time display when the movie time changes.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26659
+
+        Support hidding a control bar element from the Media element controller.
+
+        Update layout tests since the fullscreen button no longer has a renderer.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
+
+        - Now the numbers are reset when the profiles are.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
 2009-06-26  Adele Peterson  <adele@apple.com>
 
         Reviewed by Darin Adler.
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index ce65958..486c9d0 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -1364,24 +1364,27 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
 
     HEADERS += \
+        storage/LocalStorageTask.h \
+        storage/LocalStorageThread.h \
         storage/Storage.h \
+        storage/StorageArea.h \
+        storage/StorageAreaSync.h \
         storage/StorageEvent.h \
-        storage/SessionStorage.h \
-        storage/StorageSyncManager.h \
-        storage/StorageAreaSync.h
+        storage/StorageMap.h \
+        storage/StorageNamespace.h \
+        storage/StorageSyncManager.h
 
     SOURCES += \
-        storage/LocalStorage.cpp \
+        bindings/js/JSStorageCustom.cpp \
         storage/LocalStorageTask.cpp \
         storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
         storage/StorageArea.cpp \
         storage/StorageAreaSync.cpp \
-        storage/StorageMap.cpp \
         storage/StorageEvent.cpp \
-        storage/SessionStorage.cpp \
-        storage/StorageSyncManager.cpp \
-        bindings/js/JSStorageCustom.cpp
+        storage/StorageMap.cpp \
+        storage/StorageNamespace.cpp \
+        storage/StorageSyncManager.cpp
 
     IDL_BINDINGS += \
         storage/Storage.idl \
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index 663d643..7d4cb39 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1186,12 +1186,31 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     return 0;   
 }
     
+bool AccessibilityRenderObject::ariaIsHidden() const
+{
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+        return true;
+    
+    // aria-hidden hides this object and any children
+    AccessibilityObject* object = parentObject();
+    while (object) {
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+            return true;
+        object = object->parentObject();
+    }
+
+    return false;
+}
+
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
     // ignore invisible element
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
         return true;
 
+    if (ariaIsHidden())
+        return true;
+    
     if (isPresentationalChildOfAriaRole())
         return true;
         
@@ -1531,6 +1550,10 @@ void AccessibilityRenderObject::setValue(const String& string)
 bool AccessibilityRenderObject::isEnabled() const
 {
     ASSERT(m_renderer);
+    
+    if (equalIgnoringCase(getAttribute(aria_disabledAttr).string(), "true"))
+        return false;
+    
     Node* node = m_renderer->node();
     if (!node || !node->isElementNode())
         return true;
@@ -2342,6 +2365,9 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
+    if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
+        return false;
+
     if (isWebArea()) 
         return !isReadOnly();
 
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index dd1d583..4fa325f 100644
--- a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -227,6 +227,7 @@ protected:
 private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
+    bool ariaIsHidden() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const; 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 2a7a81a..088668e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -320,7 +320,7 @@ sub GenerateSetDOMException
     my $result = "";
 
     $result .= $indent . "if (ec) {\n";
-    $result .= $indent . "    V8Proxy::SetDOMException(ec);\n";
+    $result .= $indent . "    V8Proxy::setDOMException(ec);\n";
     $result .= $indent . "    return v8::Handle<v8::Value>();\n";
     $result .= $indent . "}\n";
 
@@ -346,12 +346,12 @@ sub HolderToNative
 
     if (IsNodeSubType($dataNode)) {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8Proxy::DOMWrapperToNode<$implClassName>(holder);
+    $implClassName* imp = V8Proxy::convertDOMWrapperToNode<$implClassName>(holder);
 END
 
     } else {
         push(@implContentDecls, <<END);
-    $implClassName* imp = V8Proxy::ToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
+    $implClassName* imp = V8Proxy::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
 END
 
   }
@@ -374,14 +374,14 @@ sub GenerateDomainSafeFunctionGetter
 
     my $newTemplateString = GenerateNewFunctionTemplate($function, $dataNode, $signature);
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls, <<END);
   static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
     INC_STATS(\"DOM.$implClassName.$funcName._get\");
     static v8::Persistent<v8::FunctionTemplate> private_template =
         v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) {
       // can only reach here by 'object.__proto__.func', and it should passed
       // domain security check already
@@ -393,7 +393,7 @@ END
   HolderToNative($dataNode, $implClassName, $classIndex);
 
     push(@implContentDecls, <<END);
-    if (!V8Proxy::CanAccessFrame(imp->frame(), false)) {
+    if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
       static v8::Persistent<v8::FunctionTemplate> shared_template =
         v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
       return shared_template->GetFunction();
@@ -421,13 +421,13 @@ END
 
     if ($classIndex eq "DOMWINDOW") {
         push(@implContentDecls, <<END);
-    DOMWindow* window = V8Proxy::ToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    DOMWindow* window = V8Proxy::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     Frame* frame = window->frame();
     if (frame) {
       // Get the proxy corresponding to the DOMWindow if possible to
       // make sure that the constructor function is constructed in the
       // context of the DOMWindow and not in the context of the caller.
-      return V8Proxy::retrieve(frame)->GetConstructor(type);
+      return V8Proxy::retrieve(frame)->getConstructor(type);
     }
 END
   }
@@ -458,7 +458,7 @@ sub GenerateNormalAttrGetter
     my $attrExt = $attribute->signature->extendedAttributes;
 
     my $attrName = $attribute->signature->name;
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     my $attrType = $codeGenerator->StripModule($attribute->signature->type);
     my $attrIsPodType = IsPodType($attrType);
@@ -500,7 +500,7 @@ END
 
     if ($isPodType) {
         push(@implContentDecls, <<END);
-    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
     $implClassName imp_instance = *imp_wrapper;
 END
         if ($getterStringUsesImp) {
@@ -512,7 +512,7 @@ END
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
         HolderToNative($dataNode, $implClassName, $classIndex);
@@ -525,9 +525,9 @@ END
 
     # Generate security checks if necessary
     if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::CheckNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
     } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
-        push(@implContentDecls, "    if (!V8Proxy::CheckNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
     }
 
     my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
@@ -624,7 +624,7 @@ END
 
     if ($attrIsPodType) {
         my $classIndex = uc($attrType);
-        push(@implContentDecls, "    return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);\n");
+        push(@implContentDecls, "    return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n");
     } else {
         push(@implContentDecls, "    return ".NativeToJSValue($attribute->signature, $result).";\n");
     }
@@ -637,7 +637,7 @@ sub GenerateReplaceableAttrSetter
 {
     my $implClassName = shift;
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls,
        "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
@@ -661,7 +661,7 @@ sub GenerateNormalAttrSetter
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls,
        "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
@@ -674,14 +674,14 @@ sub GenerateNormalAttrSetter
     if ($isPodType) {
         $implClassName = GetNativeType($implClassName);
         $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
         push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
         # perform lookup first
         push(@implContentDecls, <<END);
-    v8::Handle<v8::Object> holder = V8Proxy::LookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
         HolderToNative($dataNode, $implClassName, $classIndex);
@@ -724,11 +724,11 @@ END
     }
 
     if ($useExceptions) {
-        push(@implContentDecls, "    V8Proxy::SetDOMException(ec);\n");
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
     }
 
     if ($isPodType) {
-        push(@implContentDecls, "    wrapper->commitChange(*imp, V8Proxy::GetSVGContext(wrapper));\n");
+        push(@implContentDecls, "    wrapper->commitChange(*imp, V8Proxy::svgContext(wrapper));\n");
     } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
         $implIncludes{"SVGElement.h"} = 1;
 
@@ -737,7 +737,7 @@ END
             $currentObject = "wrapper";
         }
 
-        push(@implContentDecls, "    if (SVGElement* context = V8Proxy::GetSVGContext($currentObject)) {\n");
+        push(@implContentDecls, "    if (SVGElement* context = V8Proxy::svgContext($currentObject)) {\n");
         push(@implContentDecls, "        context->svgAttributeChanged(imp->associatedAttributeName());\n");
         push(@implContentDecls, "    }\n");
     }
@@ -795,7 +795,7 @@ sub GenerateFunctionCallback
 
     if (IsPodType($implClassName)) {
         my $nativeClassName = GetNativeType($implClassName);
-        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8Proxy::ToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
         push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
         push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
     } else {
@@ -811,7 +811,7 @@ END
        && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
     # We have not find real use cases yet.
     push(@implContentDecls,
-"    if (!V8Proxy::CanAccessFrame(imp->frame(), true)) {\n".
+"    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
 "      return v8::Undefined();\n" .
 "    }\n");
     }
@@ -853,7 +853,7 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if (!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ") {\n" .
-"      V8Proxy::SetDOMException(TYPE_MISMATCH_ERR);\n" .
+"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
         }
@@ -862,7 +862,7 @@ END
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
 "    if ($parameterName < 0) {\n" .
-"      V8Proxy::SetDOMException(INDEX_SIZE_ERR);\n" .
+"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
         }
@@ -1052,7 +1052,7 @@ sub GenerateImplementation
 
     push(@implFixedHeader,
          "#include \"config.h\"\n" .
-         "#include \"v8_proxy.h\"\n" .
+         "#include \"V8Proxy.h\"\n" .
          "#include \"v8_binding.h\"\n\n" .
          "#undef LOG\n\n");
 
@@ -1069,7 +1069,7 @@ sub GenerateImplementation
     $implIncludes{"${className}.h"} = 1;
 
     AddIncludesForType($interfaceName);
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
 
     push(@implContentDecls, "namespace WebCore {\n");
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
@@ -1211,7 +1211,7 @@ END
     if ($implClassName eq "DOMWindow") {
         push(@implContent, <<END);
 static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ) {
-  BatchConfigureAttributes(templ,
+  batchConfigureAttributes(templ,
                            v8::Handle<v8::ObjectTemplate>(),
                            shadow_attrs,
                            sizeof(shadow_attrs)/sizeof(*shadow_attrs));
@@ -1234,7 +1234,7 @@ END
     # Set up our attributes if we have them
     if ($has_attributes) {
         push(@implContent, <<END);
-  BatchConfigureAttributes(instance, proto, attrs, sizeof(attrs)/sizeof(*attrs));
+  batchConfigureAttributes(instance, proto, attrs, sizeof(attrs)/sizeof(*attrs));
 END
     }
 
@@ -1319,7 +1319,7 @@ END
         if ($parent eq "EventTarget") { next; }
         $implIncludes{"V8${parent}.h"} = 1;
         my $parentClassIndex = uc($codeGenerator->StripModule($parent));
-        push(@implContent, "  desc->Inherit(V8Proxy::GetTemplate(V8ClassIndex::${parentClassIndex}));\n");
+        push(@implContent, "  desc->Inherit(V8Proxy::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
         last;
     }
 
@@ -1328,7 +1328,7 @@ END
 
     if ($has_constants) {
         push(@implContent, <<END);
-  BatchConfigureConstants(desc, proto, consts, sizeof(consts)/sizeof(*consts));
+  batchConfigureConstants(desc, proto, consts, sizeof(consts)/sizeof(*consts));
 END
     }
 
@@ -1340,7 +1340,7 @@ v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
   static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
   if (${className}_raw_cache_.IsEmpty()) {
     v8::HandleScope scope;
-    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::CheckNewLegal);
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
     ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
   }
   return ${className}_raw_cache_;
@@ -1482,7 +1482,7 @@ sub GenerateFunctionCallString()
         }
         $result .= $indent . "if (success)\n";
         $result .= $indent . "    " .
-            "return V8Proxy::NodeToV8Object($nodeToReturn);\n";
+            "return V8Proxy::convertNodeToV8Object($nodeToReturn);\n";
         $result .= $indent . "return v8::Null();\n";
         return $result;
     } elsif ($returnType eq "void") {
@@ -1547,7 +1547,7 @@ sub GenerateFunctionCallString()
 
     if ($returnsPodType) {
         my $classIndex = uc($returnType);
-        $result .= $indent . "return V8Proxy::ToV8Object(V8ClassIndex::$classIndex, wrapper);\n";
+        $result .= $indent . "return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n";
     } else {
         $result .= $indent . "return " . NativeToJSValue($function->signature, $return) . ";\n";
     }
@@ -1811,7 +1811,7 @@ sub JSValueToNative
     }
 
     if ($type eq "NodeFilter") {
-        return "V8Proxy::ToNativeNodeFilter($value)";
+        return "V8Proxy::wrapNativeNodeFilter($value)";
     }
 
     if ($type eq "SVGRect") {
@@ -1823,12 +1823,12 @@ sub JSValueToNative
     }
 
     # Default, assume autogenerated type conversion routines
-    $implIncludes{"v8_proxy.h"} = 1;
+    $implIncludes{"V8Proxy.h"} = 1;
     if ($type eq "EventTarget") {
         $implIncludes{"V8Node.h"} = 1;
 
         # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
-        return "V8Node::HasInstance($value) ? V8Proxy::DOMWrapperToNode<Node>($value) : 0";
+        return "V8Node::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<Node>($value) : 0";
     }
 
     AddIncludesForType($type);
@@ -1839,7 +1839,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8Proxy::DOMWrapperToNode<${type}>($value) : 0";
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<${type}>($value) : 0";
     } else {
         # TODO: Temporary to avoid Window name conflict.
         my $classIndex = uc($type);
@@ -1858,7 +1858,7 @@ sub JSValueToNative
 
         # Perform type checks on the parameter, if it is expected Node type,
         # return NULL.
-        return "V8${type}::HasInstance($value) ? V8Proxy::ToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, $value) : 0";
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, $value) : 0";
     }
 }
 
@@ -2012,23 +2012,23 @@ sub NativeToJSValue
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        return "V8Proxy::NodeToV8Object($value)";
+        return "V8Proxy::convertNodeToV8Object($value)";
     }
 
     if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
-        return "V8Proxy::EventTargetToV8Object($value)";
+        return "V8Proxy::convertEventTargetToV8Object($value)";
     }
 
     if ($type eq "Event") {
-        return "V8Proxy::EventToV8Object($value)";
+        return "V8Proxy::convertEventToV8Object($value)";
     }
 
     if ($type eq "EventListener") {
-        return "V8Proxy::EventListenerToV8Object($value)";
+        return "V8Proxy::convertEventListenerToV8Object($value)";
     }
 
     if ($type eq "RGBColor") {
-        return "V8Proxy::ToV8Object(V8ClassIndex::RGBCOLOR, new RGBColor($value))";
+        return "V8Proxy::convertToV8Object(V8ClassIndex::RGBCOLOR, new RGBColor($value))";
     }
 
     if ($type eq "WorkerContext" or $type eq "WorkerLocation" or $type eq "WorkerNavigator") {
@@ -2047,7 +2047,7 @@ sub NativeToJSValue
             $value = GenerateSVGStaticPodTypeWrapper($type, $value);
         }
 
-        return "V8Proxy::ToV8Object(V8ClassIndex::$classIndex, $value)";
+        return "V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
     }
 }
 
@@ -2119,7 +2119,7 @@ sub GenerateSVGContextAssignment
     my $indent = shift;
 
     $result = GenerateSVGContextRetrieval($srcType, $indent);
-    $result .=   $indent . "V8Proxy::SetSVGContext($value, context);\n";
+    $result .=   $indent . "V8Proxy::setSVGContext($value, context);\n";
 
     return $result;
 }
@@ -2139,7 +2139,7 @@ sub GenerateSVGContextRetrieval
     my $contextDecl;
 
     if (IsSVGTypeNeedingContextParameter($srcType)) {
-        $contextDecl = "V8Proxy::GetSVGContext($srcObject)";
+        $contextDecl = "V8Proxy::svgContext($srcObject)";
     } else {
         $contextDecl = $srcObject;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 2aadeb9..ce4c343 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -5718,7 +5718,7 @@ Color CSSStyleSelector::getColorFromPrimitiveValue(CSSPrimitiveValue* primitiveV
         } else if (ident == CSSValueWebkitActivelink)
             col = m_element->document()->activeLinkColor();
         else if (ident == CSSValueWebkitFocusRingColor)
-            col = focusRingColor();
+            col = RenderTheme::defaultTheme()->focusRingColor();
         else if (ident == CSSValueCurrentcolor)
             col = m_style->color();
         else
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 0f9b106..3922367 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -78,7 +78,7 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 
 // This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
 // correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
-PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
+PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
 {
     int currentBlockquoteLevel = 0;
     int lastBlockquoteLevel = 0;
@@ -107,6 +107,62 @@ PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(Vis
     return placeholder.release();
 }
 
+bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
+{
+    // If our selection is not inside a list, bail out.
+    Node* lastNodeInSelectedParagraph = endOfCurrentParagraph.deepEquivalent().node();
+    RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph);
+    if (!listNode)
+        return false;
+
+    HTMLElement* selectedListItem = enclosingListChild(lastNodeInSelectedParagraph);
+
+    // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
+    Element* previousList = selectedListItem->previousElementSibling();
+    Element* nextList = selectedListItem->nextElementSibling();
+
+    RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
+    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
+    RefPtr<Element> placeholder = createBreakElement(document());
+    insertNodeBefore(newList, selectedListItem);
+    appendNode(newListItem, newList);
+    appendNode(placeholder, newListItem);
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
+
+    if (canMergeLists(previousList, newList.get()))
+        mergeIdenticalElements(previousList, newList);
+    if (canMergeLists(newList.get(), nextList))
+        mergeIdenticalElements(newList, nextList);
+
+    return true;
+}
+    
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
+{
+    Node* enclosingCell = 0;
+
+    if (!targetBlockquote) {
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
+        // this by splitting all parents of the current paragraph up to that point.
+        targetBlockquote = createIndentBlockquoteElement(document());
+        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+        enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
+        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+        insertNodeBefore(targetBlockquote, startOfNewBlock);
+    }
+
+    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
+
+    // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
+    // the next paragraph is in the same cell.
+    if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
+        targetBlockquote = 0;
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
+}
+
 void IndentOutdentCommand::indentRegion()
 {
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
@@ -117,7 +173,7 @@ void IndentOutdentCommand::indentRegion()
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    
+
     // Special case empty root editable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -129,58 +185,21 @@ void IndentOutdentCommand::indentRegion()
         setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
         return;
     }
-    
-    RefPtr<Element> previousListNode;
-    RefPtr<Element> newListNode;
-    RefPtr<Element> newBlockquote;
+
+    RefPtr<Element> blockquoteForNextIndent;
     VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
     while (endOfCurrentParagraph != endAfterSelection) {
         // Iterate across the selected paragraphs...
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-        RefPtr<Element> listNode = enclosingList(endOfCurrentParagraph.deepEquivalent().node());
-        RefPtr<Element> insertionPoint;
-        if (listNode) {
-            RefPtr<Element> placeholder = createBreakElement(document());
-            insertionPoint = placeholder;
-            newBlockquote = 0;
-            RefPtr<Element> listItem = createListItemElement(document());
-            if (listNode == previousListNode) {
-                // The previous paragraph was inside the same list, so add this list item to the list we already created
-                appendNode(listItem, newListNode);
-                appendNode(placeholder, listItem);
-            } else {
-                // Clone the list element, insert it before the current paragraph, and move the paragraph into it.
-                RefPtr<Element> clonedList = listNode->cloneElementWithoutChildren();
-                insertNodeBefore(clonedList, enclosingListChild(endOfCurrentParagraph.deepEquivalent().node()));
-                appendNode(listItem, clonedList);
-                appendNode(placeholder, listItem);
-                newListNode = clonedList;
-                previousListNode = listNode;
-            }
-        } else if (newBlockquote)
-            // The previous paragraph was put into a new blockquote, so move this paragraph there as well
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-        else {
-            // Create a new blockquote and insert it as a child of the root editable element. We accomplish
-            // this by splitting all parents of the current paragraph up to that point.
-            RefPtr<Element> blockquote = createIndentBlockquoteElement(document());
-            Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-            
-            Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
-            Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
-            RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
-            insertNodeBefore(blockquote, startOfNewBlock);
-            newBlockquote = blockquote;
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-            // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
-            // the next paragraph is in the same cell.
-            if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
-                newBlockquote = 0;
-        }
-        moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
-        // moveParagraph should not destroy content that contains endOfNextParagraph, but if it does, return here
-        // to avoid a crash.
+        if (tryIndentingAsListItem(endOfCurrentParagraph))
+            blockquoteForNextIndent = 0;
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+            // blockquoteForNextIndent maybe updated
+            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
+        // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
+        // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
             ASSERT_NOT_REACHED();
             return;
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index bb1a1d2..419f832f 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -49,7 +49,9 @@ private:
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
-    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(VisiblePosition&, RefPtr<Element>&);
+    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
+    bool tryIndentingAsListItem(const VisiblePosition&);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index a4c1f83..c0bf009 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -665,7 +665,7 @@ HTMLElement* enclosingList(Node* node)
     return 0;
 }
 
-Node* enclosingListChild(Node *node)
+HTMLElement* enclosingListChild(Node *node)
 {
     if (!node)
         return 0;
@@ -676,7 +676,7 @@ Node* enclosingListChild(Node *node)
     // FIXME: This function is inappropriately named if it starts with node instead of node->parentNode()
     for (Node* n = node; n && n->parentNode(); n = n->parentNode()) {
         if (n->hasTagName(liTag) || isListElement(n->parentNode()))
-            return n;
+            return static_cast<HTMLElement*>(n);
         if (n == root || isTableCell(n))
             return 0;
     }
@@ -738,6 +738,18 @@ HTMLElement* outermostEnclosingList(Node* node)
     return list;
 }
 
+bool canMergeLists(Element* firstList, Element* secondList)
+{
+    if (!firstList || !secondList)
+        return false;
+
+    return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
+    && isContentEditable(firstList) && isContentEditable(secondList)// both lists are editable
+    && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
+    && isVisibilyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    // Make sure there is no visible content between this li and the previous list
+}
+
 Node* highestAncestor(Node* node)
 {
     ASSERT(node);
@@ -971,6 +983,11 @@ int indexForVisiblePosition(VisiblePosition& visiblePosition)
     return TextIterator::rangeLength(range.get(), true);
 }
 
+bool isVisibilyAdjacent(const Position& first, const Position& second)
+{
+    return VisiblePosition(first) == VisiblePosition(second.upstream());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index 374b512..25ff847 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -123,7 +123,8 @@ Node* enclosingAnchorElement(const Position&);
 bool isListElement(Node*);
 HTMLElement* enclosingList(Node*);
 HTMLElement* outermostEnclosingList(Node*);
-Node* enclosingListChild(Node*);
+HTMLElement* enclosingListChild(Node*);
+bool canMergeLists(Element* firstList, Element* secondList);
 Node* highestAncestor(Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
@@ -134,7 +135,7 @@ bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
 
 int indexForVisiblePosition(VisiblePosition&);
-
+bool isVisibilyAdjacent(const Position& first, const Position& second);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 7e8c9f7..4e23159 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -290,10 +290,13 @@ DEFINE_GLOBAL(QualifiedName, archiveAttr, nullAtom, "archive", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, aria_activedescendantAttr, nullAtom, "aria_activedescendant", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_checkedAttr, nullAtom, "aria_checked", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_describedbyAttr, nullAtom, "aria_describedby", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_disabledAttr, nullAtom, "aria_disabled", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_hiddenAttr, nullAtom, "aria_hidden", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labeledbyAttr, nullAtom, "aria_labeledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
@@ -524,10 +527,13 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&aria_activedescendantAttr,
         (WebCore::QualifiedName*)&aria_checkedAttr,
         (WebCore::QualifiedName*)&aria_describedbyAttr,
+        (WebCore::QualifiedName*)&aria_disabledAttr,
+        (WebCore::QualifiedName*)&aria_hiddenAttr,
         (WebCore::QualifiedName*)&aria_labeledbyAttr,
         (WebCore::QualifiedName*)&aria_labelledbyAttr,
         (WebCore::QualifiedName*)&aria_levelAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
+        (WebCore::QualifiedName*)&aria_readonlyAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
@@ -742,7 +748,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 229;
+    *size = 232;
     return HTMLAttr;
 }
 
@@ -1002,10 +1008,13 @@ void init()
     const char *aria_activedescendantAttrString = "aria-activedescendant";
     const char *aria_checkedAttrString = "aria-checked";
     const char *aria_describedbyAttrString = "aria-describedby";
+    const char *aria_disabledAttrString = "aria-disabled";
+    const char *aria_hiddenAttrString = "aria-hidden";
     const char *aria_labeledbyAttrString = "aria-labeledby";
     const char *aria_labelledbyAttrString = "aria-labelledby";
     const char *aria_levelAttrString = "aria-level";
     const char *aria_pressedAttrString = "aria-pressed";
+    const char *aria_readonlyAttrString = "aria-readonly";
     const char *aria_valuemaxAttrString = "aria-valuemax";
     const char *aria_valueminAttrString = "aria-valuemin";
     const char *aria_valuenowAttrString = "aria-valuenow";
@@ -1230,10 +1239,13 @@ void init()
     new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, aria_activedescendantAttrString, nullAtom);
     new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, aria_checkedAttrString, nullAtom);
     new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, aria_describedbyAttrString, nullAtom);
+    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, aria_disabledAttrString, nullAtom);
+    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, aria_hiddenAttrString, nullAtom);
     new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, aria_labeledbyAttrString, nullAtom);
     new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, aria_labelledbyAttrString, nullAtom);
     new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
     new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
+    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
     new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
     new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
     new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index ad0bd4f..fba6088 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -165,10 +165,13 @@ extern const WebCore::QualifiedName archiveAttr;
 extern const WebCore::QualifiedName aria_activedescendantAttr;
 extern const WebCore::QualifiedName aria_checkedAttr;
 extern const WebCore::QualifiedName aria_describedbyAttr;
+extern const WebCore::QualifiedName aria_disabledAttr;
+extern const WebCore::QualifiedName aria_hiddenAttr;
 extern const WebCore::QualifiedName aria_labeledbyAttr;
 extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
+extern const WebCore::QualifiedName aria_readonlyAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
index 7ab0da5..37f4799 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
@@ -937,6 +937,13 @@ void CanvasRenderingContext2D::checkOrigin(const KURL& url)
         m_canvas->setOriginTainted();
 }
 
+void CanvasRenderingContext2D::checkOrigin(const String& url)
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
+    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+        m_canvas->setOriginTainted();
+}
+
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y)
 {
     ASSERT(image);
@@ -1082,7 +1089,7 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
         return;
 
     if (m_canvas->originClean())
-        checkOrigin(video->src());
+        checkOrigin(video->currentSrc());
 
     if (m_canvas->originClean() && !video->hasSingleSecurityOrigin())
         m_canvas->setOriginTainted();
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
index 0b000a3..f6baa70 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
@@ -260,6 +260,7 @@ namespace WebCore {
         
         void prepareGradientForDashboard(CanvasGradient* gradient) const;
         void checkOrigin(const KURL&);
+        void checkOrigin(const String&);
 
         HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index d148998..a29d6d2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -15,10 +15,13 @@ archive
 aria-activedescendant
 aria-checked
 aria-describedby
+aria-disabled
+aria-hidden
 aria-labeledby
 aria-labelledby
 aria-level
 aria-pressed
+aria-readonly
 aria-valuemax
 aria-valuemin
 aria-valuenow
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index f85700c..8d238d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -65,7 +65,9 @@ public:
     
     virtual bool isVideo() const { return false; }
     virtual bool hasVideo() const { return false; }
-    
+
+    virtual bool supportsFullscreen() const { return false; }
+
     void scheduleLoad();
     
     virtual void defaultEventHandler(Event*);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 0fd503c..6966351 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -437,14 +437,11 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
                 if (!m_doc->ownerElement())
                     printf("Requesting script at time %d\n", m_doc->elapsedTime());
 #endif
-                if (m_XSSAuditor && m_XSSAuditor->canLoadExternalScriptFromSrc(m_scriptTagSrcAttrValue)) {
-                    // The parser might have been stopped by for example a window.close call in an earlier script.
-                    // If so, we don't want to load scripts.
-                    if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
-                        m_pendingScripts.append(cs);
-                    else
-                        m_scriptNode = 0;
-                } else
+                // The parser might have been stopped by for example a window.close call in an earlier script.
+                // If so, we don't want to load scripts.
+                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                    m_pendingScripts.append(cs);
+                else
                     m_scriptNode = 0;
             } else
                 m_scriptNode = 0;
@@ -1476,8 +1473,11 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                 m_scriptTagCharsetAttrValue = String();
                 if (m_currentToken.attrs && !m_fragment) {
                     if (m_doc->frame() && m_doc->frame()->script()->isEnabled()) {
-                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr)))
+                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr))) {
                             m_scriptTagSrcAttrValue = m_doc->completeURL(parseURL(a->value())).string();
+                            if (m_XSSAuditor && !m_XSSAuditor->canLoadExternalScriptFromSrc(a->value()))
+                                m_scriptTagSrcAttrValue = String();
+                        }
                     }
                 }
             }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index 5b59edb..830e72e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -50,6 +50,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
+    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 7617020..7e0cf31 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -729,6 +729,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_counts.clear();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         m_profiles.clear();
+        m_currentUserInitiatedProfileNumber = 1;
+        m_nextUserInitiatedProfileNumber = 1;
 #endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
@@ -1116,6 +1118,18 @@ void InspectorController::addScriptProfile(Profile* profile)
     m_frontend->addProfile(toJS(m_scriptState, profile));
 }
 
+UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
+{
+    if (incrementProfileNumber)
+        m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;        
+
+    UString title = UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+    
+    return title;
+}
+
 void InspectorController::startUserInitiatedProfilingSoon()
 {
     m_startProfiling.startOneShot(0);
@@ -1132,11 +1146,8 @@ void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>
     }
 
     m_recordingUserInitiatedProfile = true;
-    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
 
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
+    UString title = getCurrentUserInitiatedProfileName(true);
 
     ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
     Profiler::profiler()->startProfiling(scriptState, title);
@@ -1153,9 +1164,7 @@ void InspectorController::stopUserInitiatedProfiling()
 
     m_recordingUserInitiatedProfile = false;
 
-    UString title =  UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
+    UString title = getCurrentUserInitiatedProfileName();
 
     ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
     RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index 0cb2093..8ba8669 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -249,6 +249,7 @@ public:
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
+    JSC::UString getCurrentUserInitiatedProfileName(bool incrementProfileNumber);
     void startUserInitiatedProfilingSoon();
     void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
     void stopUserInitiatedProfiling();
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index c58cf64..30772f7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -165,7 +165,7 @@ WebInspector.TextPrompt.prototype = {
         fullWordRange.setStart(wordPrefixRange.startContainer, wordPrefixRange.startOffset);
         fullWordRange.setEnd(selectionRange.endContainer, selectionRange.endOffset);
 
-        if (originalWordPrefixRange.toString() != fullWordRange.toString())
+        if (originalWordPrefixRange.toString() + selectionRange.toString() != fullWordRange.toString())
             return;
 
         if (completions.length === 1 || selection.isCollapsed || auto) {
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index e1a92d5..2abd54f 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -413,6 +413,7 @@ public:
     virtual void copyImageToClipboard(const HitTestResult&) { }
     virtual void searchWithGoogle(const Frame*) { }
     virtual void lookUpInDictionary(Frame*) { }
+    virtual bool isSpeaking() { return false; }
     virtual void speak(const String&) { }
     virtual void stopSpeaking() { }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 006f3b5..642ec61 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -479,6 +479,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
             m_currentHandle->cancel();
             m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
             // Load the next resource, if any.
             startLoadingEntry();
         }
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 86de82e..2170723 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -46,7 +46,7 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(DOM_STORAGE)
-#include "SessionStorage.h"
+#include "StorageNamespace.h"
 #endif
 
 namespace WebCore {
@@ -147,8 +147,8 @@ Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const
 
 #if ENABLE(DOM_STORAGE)
     if (newPage) {
-        if (SessionStorage* oldSessionStorage = m_page->sessionStorage(false))
-            newPage->setSessionStorage(oldSessionStorage->copy(newPage));
+        if (StorageNamespace* oldSessionStorage = m_page->sessionStorage(false))
+            newPage->setSessionStorage(oldSessionStorage->copy());
     }
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 1384236..1a654ab 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -277,19 +277,19 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    // FIXME: log a console message when profiling is disabled.
-    if (!page->inspectorController()->profilerEnabled())
+    InspectorController* controller = page->inspectorController();
+    // FIXME: log a console message when profiling is disabled. 
+    if (!controller->profilerEnabled())
         return;
 
-    if (title.isNull()) {   // no title so give it the next user initiated profile title.
-        page->inspectorController()->startUserInitiatedProfiling(0);
-        return;
-    }
+    JSC::UString resolvedTitle = title;
+    if (title.isNull())   // no title so give it the next user initiated profile title.
+        resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
 
-    JSC::Profiler::profiler()->startProfiling(callStack->state(), title);
+    JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
-    page->inspectorController()->addStartProfilingMessageToConsole(title, lastCaller.lineNumber(), lastCaller.sourceURL());
+    controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -298,7 +298,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    if (!page->inspectorController()->profilerEnabled())
+    if (!this->page())
+        return;
+
+    InspectorController* controller = page->inspectorController();
+    if (!controller->profilerEnabled())
         return;
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
@@ -307,10 +311,8 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
-    if (Page* page = this->page()) {
-        const ScriptCallFrame& lastCaller = callStack->at(0);
-        page->inspectorController()->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
-    }
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
index 775adc5..1997cd0 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
@@ -47,6 +47,7 @@ namespace WebCore {
         virtual void downloadURL(const KURL& url) = 0;
         virtual void searchWithGoogle(const Frame*) = 0;
         virtual void lookUpInDictionary(Frame*) = 0;
+        virtual bool isSpeaking() = 0;
         virtual void speak(const String&) = 0;
         virtual void stopSpeaking() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index 9c3bfce..eb1981c 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -70,10 +70,9 @@
 #endif
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "SessionStorage.h"
 #include "Storage.h"
 #include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -578,7 +577,7 @@ Storage* DOMWindow::localStorage() const
     if (!settings || !settings->localStorageEnabled())
         return 0;
 
-    LocalStorage* localStorage = page->group().localStorage();
+    StorageNamespace* localStorage = page->group().localStorage();
     RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
     if (storageArea) {
         page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index 6862cdc..eac936f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -61,7 +61,6 @@ namespace WebCore {
     class WebKitPoint;
 
 #if ENABLE(DOM_STORAGE)
-    class SessionStorage;
     class Storage;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 329c3a7..8f0b420 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -354,6 +354,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     m_mouseDownWasSingleClickInSelection = false;
 
+    m_mouseDown = event.event();
+
     if (event.isOverWidget() && passWidgetMouseDownEventToWidget(event))
         return true;
 
@@ -735,7 +737,7 @@ void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
     
-HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping)
+HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
     HitTestResult result(point);
     if (!m_frame->contentRenderer())
@@ -762,6 +764,12 @@ HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool all
         HitTestResult widgetHitTestResult(widgetPoint);
         frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), widgetHitTestResult);
         result = widgetHitTestResult;
+
+        if (testScrollbars == ShouldHitTestScrollbars) {
+            Scrollbar* eventScrollbar = view->scrollbarUnderPoint(point);
+            if (eventScrollbar)
+                result.setScrollbar(eventScrollbar);
+        }
     }
     
     // If our HitTestResult is not visible, then we started hit testing too far down the frame chain. 
@@ -1197,7 +1205,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         }
 
         FrameView* view = m_frame->view();
-        Scrollbar* scrollbar = view ? view->scrollbarUnderMouse(mouseEvent) : 0;
+        Scrollbar* scrollbar = view ? view->scrollbarUnderPoint(mouseEvent.pos()) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1311,7 +1319,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
         if (FrameView* view = m_frame->view())
-            scrollbar = view->scrollbarUnderMouse(mouseEvent);
+            scrollbar = view->scrollbarUnderPoint(mouseEvent.pos());
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 583122c..f76716e 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -67,6 +67,8 @@ extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
 
+enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
+
 class EventHandler : Noncopyable {
 public:
     EventHandler(Frame*);
@@ -86,7 +88,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
-    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false);
+    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false, HitTestScrollbars scrollbars = DontHitTestScrollbars);
 
     bool mousePressed() const { return m_mousePressed; }
     void setMousePressed(bool pressed) { m_mousePressed = pressed; }
diff --git a/src/3rdparty/webkit/WebCore/page/Page.cpp b/src/3rdparty/webkit/WebCore/page/Page.cpp
index a49ee4a..6494707 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Page.cpp
@@ -58,9 +58,8 @@
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "SessionStorage.h"
 #include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -550,17 +549,16 @@ void Page::setDebugger(JSC::Debugger* debugger)
 }
 
 #if ENABLE(DOM_STORAGE)
-SessionStorage* Page::sessionStorage(bool optionalCreate)
+StorageNamespace* Page::sessionStorage(bool optionalCreate)
 {
     if (!m_sessionStorage && optionalCreate)
-        m_sessionStorage = SessionStorage::create(this);
+        m_sessionStorage = StorageNamespace::sessionStorageNamespace();
 
     return m_sessionStorage.get();
 }
 
-void Page::setSessionStorage(PassRefPtr<SessionStorage> newStorage)
+void Page::setSessionStorage(PassRefPtr<StorageNamespace> newStorage)
 {
-    ASSERT(newStorage->page() == this);
     m_sessionStorage = newStorage;
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/Page.h b/src/3rdparty/webkit/WebCore/page/Page.h
index 32adcac..b5d6f4b 100644
--- a/src/3rdparty/webkit/WebCore/page/Page.h
+++ b/src/3rdparty/webkit/WebCore/page/Page.h
@@ -63,10 +63,10 @@ namespace WebCore {
     class RenderTheme;
     class VisibleSelection;
     class SelectionController;
+    class Settings;
 #if ENABLE(DOM_STORAGE)
-    class SessionStorage;
+    class StorageNamespace;
 #endif
-    class Settings;
 #if ENABLE(WML)
     class WMLPageState;
 #endif
@@ -179,8 +179,8 @@ namespace WebCore {
         static void visitedStateChanged(PageGroup*, LinkHash visitedHash);
 
 #if ENABLE(DOM_STORAGE)
-        SessionStorage* sessionStorage(bool optionalCreate = true);
-        void setSessionStorage(PassRefPtr<SessionStorage>);
+        StorageNamespace* sessionStorage(bool optionalCreate = true);
+        void setSessionStorage(PassRefPtr<StorageNamespace>);
 #endif
 
 #if ENABLE(WML)
@@ -253,7 +253,7 @@ namespace WebCore {
         int m_customHTMLTokenizerChunkSize;
 
 #if ENABLE(DOM_STORAGE)
-        RefPtr<SessionStorage> m_sessionStorage;
+        RefPtr<StorageNamespace> m_sessionStorage;
 #endif
 
 #if PLATFORM(WIN) || (PLATFORM(WX) && defined(__WXMSW__)) || (PLATFORM(QT) && defined(Q_WS_WIN))
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
index f098211..5155be1 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.cpp
@@ -32,8 +32,7 @@
 #include "Settings.h"
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if PLATFORM(CHROMIUM)
@@ -181,13 +180,13 @@ void PageGroup::setShouldTrackVisitedLinks(bool shouldTrack)
 }
 
 #if ENABLE(DOM_STORAGE)
-LocalStorage* PageGroup::localStorage()
+StorageNamespace* PageGroup::localStorage()
 {
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
         ASSERT(page);
-        m_localStorage = LocalStorage::localStorage(page->settings()->localStorageDatabasePath());
+        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
     }
 
     return m_localStorage.get();
diff --git a/src/3rdparty/webkit/WebCore/page/PageGroup.h b/src/3rdparty/webkit/WebCore/page/PageGroup.h
index 4da2251..cbde1c3 100644
--- a/src/3rdparty/webkit/WebCore/page/PageGroup.h
+++ b/src/3rdparty/webkit/WebCore/page/PageGroup.h
@@ -34,8 +34,8 @@
 namespace WebCore {
 
     class KURL;
-    class LocalStorage;
     class Page;
+    class StorageNamespace;
 
     class PageGroup : Noncopyable {
     public:
@@ -63,7 +63,7 @@ namespace WebCore {
         unsigned identifier() { return m_identifier; }
 
 #if ENABLE(DOM_STORAGE)
-        LocalStorage* localStorage();
+        StorageNamespace* localStorage();
 #endif
 
     private:
@@ -80,7 +80,7 @@ namespace WebCore {
 
         unsigned m_identifier;
 #if ENABLE(DOM_STORAGE)
-        RefPtr<LocalStorage> m_localStorage;
+        RefPtr<StorageNamespace> m_localStorage;
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index a476099..7a15163 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -38,7 +38,7 @@ using namespace std;
 
 namespace WebCore {
 
-static void setNeedsReapplyStylesInAllFrames(Page* page, bool /*updateCompositingLayers*/ = false)
+static void setNeedsReapplyStylesInAllFrames(Page* page)
 {
     for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
         frame->setNeedsReapplyStyles();
@@ -105,11 +105,7 @@ Settings::Settings(Page* page)
     // they can't use by. Leaving enabled for now to not change existing behavior.
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
-#if USE(ACCELERATED_COMPOSITING)
     , m_acceleratedCompositingEnabled(true)
-#else
-    , m_acceleratedCompositingEnabled(false)
-#endif
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -476,7 +472,7 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
         return;
         
     m_acceleratedCompositingEnabled = enabled;
-    setNeedsReapplyStylesInAllFrames(m_page, true);
+    setNeedsReapplyStylesInAllFrames(m_page);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index 19c6e4e..f8a2f40 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -35,18 +35,15 @@
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "KURL.h"
+#include "ResourceResponseBase.h"
 #include "ScriptSourceCode.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 
+using namespace WTF;
+
 namespace WebCore {
-  
-// This method also appears in file ResourceResponseBase.cpp.
-static bool isControlCharacter(UChar c)
-{
-    return c < ' ' || c == 127;
-}
-  
+
 XSSAuditor::XSSAuditor(Frame* frame)
     : m_frame(frame)
 {
@@ -55,18 +52,18 @@ XSSAuditor::XSSAuditor(Frame* frame)
 XSSAuditor::~XSSAuditor()
 {
 }
-    
+
 bool XSSAuditor::isEnabled() const
 {
     Settings* settings = m_frame->settings();
     return (settings && settings->xssAuditorEnabled());
 }
-  
+
 bool XSSAuditor::canEvaluate(const String& sourceCode) const
 {
     if (!isEnabled())
         return true;
-    
+
     if (findInRequest(sourceCode)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
@@ -79,7 +76,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
 {
     if (!isEnabled())
         return true;
-    
+
     return canEvaluate(code);
 }
 
@@ -87,7 +84,7 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& url) const
 {
     if (!isEnabled())
         return true;
-  
+
     if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
@@ -103,27 +100,43 @@ bool XSSAuditor::canLoadObject(const String& url) const
 
     if (findInRequest(url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
-        m_frame->domWindow()->console()->addMessage(OtherMessageSource, ErrorMessageLevel, consoleMessage, 1, String());    
+        m_frame->domWindow()->console()->addMessage(OtherMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
     return true;
 }
 
-String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowNullCharacters)
+String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowControlCharacters)
 {
     String result;
     String url = str;
-    
+
     url.replace('+', ' ');
-    result = decodeURLEscapeSequences(url, encoding);
-    return allowNullCharacters ? result : result.removeCharacters(&isControlCharacter);
+    result = decodeURLEscapeSequences(url);
+    if (!allowControlCharacters)
+        result.removeCharacters(&isControlCharacter);
+    result = encoding.decode(result.utf8().data(), result.length());
+    if (!allowControlCharacters)
+        result.removeCharacters(&isControlCharacter);
+    return result;
 }
 
 bool XSSAuditor::findInRequest(const String& string) const
 {
-    ASSERT(m_frame->document());
-    String pageURL = m_frame->document()->url().string();
-    
+    bool result = false;
+    Frame* parentFrame = m_frame->tree()->parent();
+    if (parentFrame && m_frame->document()->url() == blankURL())
+        result = findInRequest(parentFrame, string);
+    if (!result)
+        result = findInRequest(m_frame, string);
+    return result;
+}
+
+bool XSSAuditor::findInRequest(Frame* frame, const String& string) const
+{
+    ASSERT(frame->document());
+    String pageURL = frame->document()->url().string();
+
     if (protocolIs(pageURL, "data"))
         return false;
 
@@ -132,12 +145,12 @@ bool XSSAuditor::findInRequest(const String& string) const
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = decodeURL(pageURL, m_frame->document()->decoder()->encoding());
+        String decodedPageURL = decodeURL(pageURL, frame->document()->decoder()->encoding());
         if (decodedPageURL.find(string, 0, false) != -1)
            return true;  // We've found the smoking gun.
     }
-    
-    FormData* formDataObj = m_frame->loader()->documentLoader()->originalRequest().httpBody();
+
+    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
     if (formDataObj && !formDataObj->isEmpty()) {
         String formData = formDataObj->flattenToString();
         if (string.length() < formData.length()) {
@@ -145,7 +158,7 @@ bool XSSAuditor::findInRequest(const String& string) const
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = decodeURL(formData, m_frame->document()->decoder()->encoding());
+            String decodedFormData = decodeURL(formData, frame->document()->decoder()->encoding());
             if (decodedFormData.find(string, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index e2b6140..7974d1c 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -21,7 +21,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef XSSAuditor_h
@@ -62,7 +62,7 @@ namespace WebCore {
     // * ScriptController::evaluate - used to evaluate JavaScript scripts.
     // * ScriptController::createInlineEventListener - used to create JavaScript event handlers.
     // * HTMLTokenizer::scriptHandler - used to load external JavaScript scripts.
-    // 
+    //
     class XSSAuditor {
     public:
         XSSAuditor(Frame*);
@@ -82,17 +82,19 @@ namespace WebCore {
         // content of any user-submitted data.
         bool canLoadExternalScriptFromSrc(const String& url) const;
 
-        // Determines whether object should be loaded based on the content of 
+        // Determines whether object should be loaded based on the content of
         // any user-submitted data.
         //
         // This method is called by FrameLoader::requestObject.
         bool canLoadObject(const String& url) const;
 
     private:
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowNullCharacters = false);
+        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowControlCharacters = false);
 
         bool findInRequest(const String&) const;
 
+        bool findInRequest(Frame*, const String&) const;
+
         // The frame to audit.
         Frame* m_frame;
     };
diff --git a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
index 362e334..1c8ec20 100644
--- a/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ContextMenu.cpp
@@ -28,6 +28,7 @@
 #include "ContextMenu.h"
 
 #include "ContextMenuController.h"
+#include "ContextMenuClient.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -345,6 +346,12 @@ void ContextMenu::populate()
 #endif
                 }
                 appendItem(CopyItem);
+#if PLATFORM(MAC)
+                appendItem(*separatorItem());
+                ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
+                createAndAppendSpeechSubMenu(m_hitTestResult, SpeechMenuItem);
+                appendItem(SpeechMenuItem);
+#endif                
             } else {
 #if PLATFORM(GTK)
                 appendItem(BackItem);
@@ -481,8 +488,7 @@ void ContextMenu::populate()
             createAndAppendFontSubMenu(m_hitTestResult, FontMenuItem);
             appendItem(FontMenuItem);
 #if PLATFORM(MAC)
-            ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, 
-                contextMenuItemTagSpeechMenu());
+            ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
             createAndAppendSpeechSubMenu(m_hitTestResult, SpeechMenuItem);
             appendItem(SpeechMenuItem);
 #endif
@@ -702,7 +708,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
             shouldCheck = frame->editor()->isAutomaticTextReplacementEnabled();
 #endif
             break;
-#endif
+        case ContextMenuItemTagStopSpeaking:
+            shouldEnable = controller() && controller()->client() && controller()->client()->isSpeaking();
+            break;
+#endif // PLATFORM(MAC)
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
             shouldEnable = frame->loader()->canGoBackOrForward(-1);
@@ -756,7 +765,6 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagShowColors:
         case ContextMenuItemTagSpeechMenu:
         case ContextMenuItemTagStartSpeaking:
-        case ContextMenuItemTagStopSpeaking:
         case ContextMenuItemTagWritingDirectionMenu:
         case ContextMenuItemTagTextDirectionMenu:
         case ContextMenuItemTagPDFSinglePageScrolling:
diff --git a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
index 6fe9748..ae8df4e 100644
--- a/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/platform/PlatformWheelEvent.h
@@ -51,6 +51,9 @@ class wxPoint;
 
 namespace WebCore {
 
+    class FloatPoint;
+    class FloatSize;
+
     // Wheel events come in two flavors:
     // The ScrollByPixelWheelEvent is a fine-grained event that specifies the precise number of pixels to scroll.  It is sent directly by MacBook touchpads on OS X,
     // and synthesized in other cases where platforms generate line-by-line scrolling events.
@@ -99,7 +102,7 @@ namespace WebCore {
 
 #if PLATFORM(WIN)
         PlatformWheelEvent(HWND, WPARAM, LPARAM, bool isMouseHWheel);
-        PlatformWheelEvent(HWND, float deltaX, float deltaY, float xLoc, float yLoc);
+        PlatformWheelEvent(HWND, const FloatSize& delta, const FloatPoint& location);
 #endif
 
 #if PLATFORM(WX)
diff --git a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
index bee21b9..9c8e3cb 100644
--- a/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
+++ b/src/3rdparty/webkit/WebCore/platform/PurgeableBuffer.h
@@ -62,7 +62,7 @@ namespace WebCore {
         mutable State m_state;
     };
 
-#if !PLATFORM(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT)
+#if !PLATFORM(DARWIN) || defined(BUILDING_ON_TIGER) || PLATFORM(QT) || PLATFORM(GTK)
     inline PurgeableBuffer* PurgeableBuffer::create(const char*, size_t) { return 0; }
     inline PurgeableBuffer::~PurgeableBuffer() { }
     inline const char* PurgeableBuffer::data() const { return 0; }
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
index 14bade8..9d3c128 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.cpp
@@ -165,6 +165,7 @@ bool ScrollView::canBlitOnScroll() const
     return m_canBlitOnScroll;
 }
 
+#if !PLATFORM(GTK)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
     if (platformWidget())
@@ -173,6 +174,7 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                    IntSize(max(0, width() - (verticalScrollbar() && !includeScrollbars ? verticalScrollbar()->width() : 0)), 
                            max(0, height() - (horizontalScrollbar() && !includeScrollbars ? horizontalScrollbar()->height() : 0))));
 }
+#endif
 
 int ScrollView::layoutWidth() const
 {
@@ -638,12 +640,12 @@ void ScrollView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppre
     }
 }
 
-Scrollbar* ScrollView::scrollbarUnderMouse(const PlatformMouseEvent& mouseEvent)
+Scrollbar* ScrollView::scrollbarUnderPoint(const IntPoint& windowPoint)
 {
     if (platformWidget())
         return 0;
 
-    IntPoint viewPoint = convertFromContainingWindow(mouseEvent.pos());
+    IntPoint viewPoint = convertFromContainingWindow(windowPoint);
     if (m_horizontalScrollbar && m_horizontalScrollbar->frameRect().contains(viewPoint))
         return m_horizontalScrollbar.get();
     if (m_verticalScrollbar && m_verticalScrollbar->frameRect().contains(viewPoint))
diff --git a/src/3rdparty/webkit/WebCore/platform/ScrollView.h b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
index 3549c66..7f99a22 100644
--- a/src/3rdparty/webkit/WebCore/platform/ScrollView.h
+++ b/src/3rdparty/webkit/WebCore/platform/ScrollView.h
@@ -181,7 +181,7 @@ public:
     virtual void setFrameRect(const IntRect&);
 
     // For platforms that need to hit test scrollbars from within the engine's event handlers (like Win32).
-    Scrollbar* scrollbarUnderMouse(const PlatformMouseEvent& mouseEvent);
+    Scrollbar* scrollbarUnderPoint(const IntPoint& windowPoint);
 
     // This method exists for scrollviews that need to handle wheel events manually.
     // On Mac the underlying NSScrollView just does the scrolling, but on other platforms
diff --git a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
index 6c301e3..b68a74c 100644
--- a/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -162,15 +162,6 @@ void CheckCacheObjectStatus(DocLoader*, CachedResource*)
 Icon::~Icon() { }
 void Icon::paint(GraphicsContext*, const IntRect&) { }
 
-// This function provides the default value for the CSS property:
-// -webkit-focus-ring-color
-// It is also related to the CSS property outline-color:
-Color focusRingColor()
-{
-    verifiedOk();
-    return 0xFF0000FF;
-}
-
 }  // namespace WebCore
 
 // FIXME, no support for spelling yet.
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
index 7484a7a..a277675 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.cpp
@@ -62,6 +62,8 @@ public:
     virtual void play() { }
     virtual void pause() { }    
 
+    virtual bool supportsFullscreen() const { return false; }
+
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
     virtual bool hasVideo() const { return false; }
@@ -299,6 +301,11 @@ bool MediaPlayer::seeking() const
     return m_private->seeking();
 }
 
+bool MediaPlayer::supportsFullscreen() const
+{
+    return m_private->supportsFullscreen();
+}
+
 IntSize MediaPlayer::naturalSize()
 {
     return m_private->naturalSize();
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
index 2a6993a..187c701 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayer.h
@@ -107,6 +107,7 @@ public:
     static void getSupportedTypes(HashSet<String>&);
     static bool isAvailable();
 
+    bool supportsFullscreen() const;
     IntSize naturalSize();
     bool hasVideo();
     
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
index 9161bbb..edbe125 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -46,6 +46,8 @@ public:
     virtual void play() = 0;
     virtual void pause() = 0;    
 
+    virtual bool supportsFullscreen() const { return false; };
+
     virtual IntSize naturalSize() const = 0;
 
     virtual bool hasVideo() const = 0;
diff --git a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index d22aa89..8503fb5 100644
--- a/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -763,7 +763,6 @@ void GraphicsContext::clipPath(WindRule clipRule)
  * RenderTheme handles drawing focus on widgets which 
  * need it.
  */
-Color focusRingColor() { return Color(0, 0, 0); }
 void GraphicsContext::drawFocusRing(const Color& color)
 {
     if (paintingDisabled())
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2..a6d70fd 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.cpp
@@ -502,7 +502,7 @@ static bool isCacheHeaderSeparator(UChar c)
     }
 }
 
-static bool isControlCharacter(UChar c)
+bool isControlCharacter(UChar c)
 {
     return c < ' ' || c == 127;
 }
diff --git a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
index 7594c09..20165e7 100644
--- a/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
+++ b/src/3rdparty/webkit/WebCore/platform/network/ResourceResponseBase.h
@@ -162,6 +162,8 @@ struct CrossThreadResourceResponseData {
     time_t m_lastModifiedDate;
 };
 
+bool isControlCharacter(UChar c);
+    
 } // namespace WebCore
 
 #endif // ResourceResponseBase_h
diff --git a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
index e477965..67c34eb 100644
--- a/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/win/PluginViewWin.cpp
@@ -110,11 +110,6 @@ static BYTE* endPaint;
 
 HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return 0;
-#else     
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so set up the PAINTSTRUCT so
@@ -130,16 +125,10 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    beginPaint
-#endif
 }
 
 BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
 {
-#if (COMPILER(MINGW))
-    Q_UNUSED(hWnd)
-    Q_UNUSED(lpPaint)
-    return FALSE;
-#else      
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
     if (pluginView && pluginView->m_wmPrintHDC) {
         // We're secretly handling WM_PRINTCLIENT, so we don't have to do any
@@ -152,10 +141,8 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    endPaint
-#endif      
 }
 
-#if (!COMPILER(MINGW))
 static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE*& pProc, const void* pNewProc)
 {
     // See <http://www.fengyuan.com/article/wmprint.html> for an explanation of
@@ -196,7 +183,6 @@ static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAIN
     hook("user32.dll", "BeginPaint", beginPaintSysCall, beginPaint, hookedBeginPaint);
     hook("user32.dll", "EndPaint", endPaintSysCall, endPaint, hookedEndPaint);
 }
-#endif
 
 static bool registerPluginView()
 {
@@ -940,9 +926,8 @@ void PluginView::init()
 
     if (m_isWindowed) {
         registerPluginView();
-#if (!COMPILER(MINGW))       
         setUpOffscreenPaintingHooks(hookedBeginPaint, hookedEndPaint);
-#endif
+
         DWORD flags = WS_CHILD;
         if (isSelfVisible())
             flags |= WS_VISIBLE;
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
index 0432a4c..be6b966 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.cpp
@@ -658,22 +658,20 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
-void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                    int my, int mh, int _tx, int _ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int _tx, int _ty, int w, int h, CompositeOperator op)
 {
     if (!fillLayer)
         return;
-    paintFillLayers(paintInfo, c, fillLayer->next(), my, mh, _tx, _ty, w, h, op);
-    paintFillLayer(paintInfo, c, fillLayer, my, mh, _tx, _ty, w, h, op);
+    paintFillLayers(paintInfo, c, fillLayer->next(), _tx, _ty, w, h, op);
+    paintFillLayer(paintInfo, c, fillLayer, _tx, _ty, w, h, op);
 }
 
-void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                   int my, int mh, int tx, int ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int w, int h, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
     bool hasFillImage = img && img->canRender(renderer()->style()->effectiveZoom());
     if ((!hasFillImage && !renderer()->style()->hasBorderRadius()) || (!prevLineBox() && !nextLineBox()) || !parent())
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, tx, ty, w, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, w, h, this, op);
     else {
         // We have a fill image that spans multiple lines.
         // We need to adjust _tx and _ty by the width of all previous lines.
@@ -692,7 +690,7 @@ void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, con
             totalWidth += curr->width();
         paintInfo.context->save();
         paintInfo.context->clip(IntRect(tx, ty, width(), height()));
-        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, my, mh, startX, ty, totalWidth, h, this, op);
+        boxModelObject()->paintFillLayerExtended(paintInfo, c, fillLayer, startX, ty, totalWidth, h, this, op);
         paintInfo.context->restore();
     }
 }
@@ -720,13 +718,6 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     GraphicsContext* context = paintInfo.context;
     
     // You can use p::first-line to specify a background. If so, the root line boxes for
@@ -738,7 +729,7 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
             paintBoxShadow(context, styleToUse, tx, ty, w, h);
 
         Color c = styleToUse->backgroundColor();
-        paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), my, mh, tx, ty, w, h);
+        paintFillLayers(paintInfo, c, styleToUse->backgroundLayers(), tx, ty, w, h);
 
         // :first-line cannot be used to put borders on a line. Always paint borders with our
         // non-first-line style.
@@ -789,14 +780,6 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
-    
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
@@ -811,7 +794,7 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
         compositeOp = CompositeSourceOver;
     }
 
-    paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
+    paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
     
     bool hasBoxImage = maskBoxImage && maskBoxImage->canRender(renderer()->style()->effectiveZoom());
     if (!hasBoxImage || !maskBoxImage->isLoaded())
diff --git a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
index 2462eba..ab1b6f2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/InlineFlowBox.h
@@ -87,10 +87,8 @@ public:
 
     virtual void paintBoxDecorations(RenderObject::PaintInfo&, int tx, int ty);
     virtual void paintMask(RenderObject::PaintInfo&, int tx, int ty);
-    void paintFillLayers(const RenderObject::PaintInfo&, const Color&, const FillLayer*,
-                         int my, int mh, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
-    void paintFillLayer(const RenderObject::PaintInfo&, const Color&, const FillLayer*,
-                         int my, int mh, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    void paintFillLayers(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, RenderStyle*, int tx, int ty, int w, int h);
     virtual void paintTextDecorations(RenderObject::PaintInfo&, int tx, int ty, bool paintedChildren = false);
     virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
index d66519a..fc2790c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.cpp
@@ -101,6 +101,7 @@ void MediaTextDisplayElement::update()
 {
     if (renderer())
         renderer()->updateFromElement();
+    updateStyle();
 }
 
 void MediaTextDisplayElement::updateStyle()
@@ -125,13 +126,7 @@ MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseud
     , m_displayType(displayType)
 {
     setInputType(type);
-    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
-    RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
-    if (renderer) {
-        setRenderer(renderer);
-        renderer->setStyle(style);
-    }
-    setAttached();
+    updateStyle();
     setInDocument(true);
 }
 
@@ -147,14 +142,35 @@ void MediaControlInputElement::update()
     updateDisplayType();
     if (renderer())
         renderer()->updateFromElement();
+    updateStyle();
 }
 
 void MediaControlInputElement::updateStyle()
 {
-    if (renderer() && m_mediaElement->renderer()) {
-        RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    if (!m_mediaElement || !m_mediaElement->renderer())
+        return;
+    
+    RenderStyle* style = m_mediaElement->renderer()->getCachedPseudoStyle(m_pseudoStyleId);
+    
+    bool needsRenderer = rendererIsNeeded(style);
+    if (renderer() && !needsRenderer)
+        detach();
+    else if (!renderer() && needsRenderer) {
+        RenderObject* renderer = createRenderer(m_mediaElement->renderer()->renderArena(), style);
+        if (!renderer)
+            return;
+        renderer->setStyle(style);
+        setRenderer(renderer);
+        setAttached();
+        if (parent() && parent()->renderer()) {
+            // Find next sibling with a renderer to determine where to insert.
+            Node* sibling = nextSibling();
+            while (sibling && !sibling->renderer())
+                sibling = sibling->nextSibling();
+            parent()->renderer()->addChild(renderer, sibling ? sibling->renderer() : 0);
+        }
+    } else if (renderer())
         renderer()->setStyle(style);
-    }
 }
 
 bool MediaControlInputElement::hitTest(const IntPoint& absPoint)
@@ -323,6 +339,12 @@ void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
+bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
+{
+    return m_mediaElement->supportsFullscreen() && MediaControlInputElement::rendererIsNeeded(style);
+}
+
+
 // ----------------------------
 
 } //namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
index d3e0040..eefb2ce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
+++ b/src/3rdparty/webkit/WebCore/rendering/MediaControlElements.h
@@ -91,7 +91,7 @@ public:
     MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
     void attachToParent(Element*);
     void update();
-    void updateStyle();
+    virtual void updateStyle();
     bool hitTest(const IntPoint& absPoint);
     MediaControlElementType displayType() const { return m_displayType; }
 
@@ -152,6 +152,7 @@ class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
     MediaControlFullscreenButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
index e9db716..ab0d153 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.cpp
@@ -248,22 +248,22 @@ int RenderBox::clientHeight() const
     return height() - borderTop() - borderBottom() - horizontalScrollbarHeight();
 }
 
-// scrollWidth/scrollHeight will be the same as overflowWidth/overflowHeight unless the
-// object has overflow:hidden/scroll/auto specified and also has overflow.
-// FIXME: It's not completely clear how scrollWidth/Height should behave for 
-// objects with visible overflow.
 int RenderBox::scrollWidth() const
 {
     if (hasOverflowClip())
         return layer()->scrollWidth();
-    return overflowWidth();
+    // For objects with visible overflow, this matches IE.
+    if (style()->direction() == LTR)
+        return max(clientWidth(), rightmostPosition(true, false) - borderLeft());
+    return clientWidth() - min(0, leftmostPosition(true, false) - borderLeft());
 }
 
 int RenderBox::scrollHeight() const
 {
     if (hasOverflowClip())
         return layer()->scrollHeight();
-    return overflowHeight();
+    // For objects with visible overflow, this matches IE.
+    return max(clientHeight(), lowestPosition(true, false) - borderTop());
 }
 
 int RenderBox::scrollLeft() const
@@ -582,9 +582,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     int bw = max(w + marginLeft() + marginRight() + borderLeft() + borderRight(), rw);
     int bh = max(h + marginTop() + marginBottom() + borderTop() + borderBottom(), rh);
 
-    int my = max(by, paintInfo.rect.y());
-
-    paintFillLayers(paintInfo, bgColor, bgLayer, my, paintInfo.rect.height(), bx, by, bw, bh);
+    paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh);
 
     if (style()->hasBorder() && style()->display() != INLINE)
         paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -607,13 +605,6 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     // balloon layout is an example of this).
     borderFitAdjust(tx, w);
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     // FIXME: Should eventually give the theme control over whether the box shadow should paint, since controls could have
     // custom shadows of their own.
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
@@ -626,7 +617,7 @@ void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
         // independent of the body.  Go through the DOM to get to the root element's render object,
         // since the root could be inline and wrapped in an anonymous block.
         if (!isBody() || document()->documentElement()->renderer()->style()->hasBackground())
-            paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+            paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
         if (style()->hasAppearance())
             theme()->paintDecorations(this, paintInfo, IntRect(tx, ty, w, h));
     }
@@ -648,17 +639,10 @@ void RenderBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
     // balloon layout is an example of this).
     borderFitAdjust(tx, w);
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
-void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int tx, int ty, int w, int h)
+void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int w, int h)
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
@@ -689,7 +673,7 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int my, int mh, int
         compositeOp = CompositeSourceOver;
     }
 
-    paintFillLayers(paintInfo, Color(), style()->maskLayers(), my, mh, tx, ty, w, h, compositeOp);
+    paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
     paintNinePieceImage(paintInfo.context, tx, ty, w, h, style(), style()->maskBoxImage(), compositeOp);
     
     if (pushTransparencyLayer)
@@ -715,20 +699,18 @@ IntRect RenderBox::maskClipRect()
     return result;
 }
 
-void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                                int clipY, int clipH, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
 {
     if (!fillLayer)
         return;
 
-    paintFillLayers(paintInfo, c, fillLayer->next(), clipY, clipH, tx, ty, width, height, op);
-    paintFillLayer(paintInfo, c, fillLayer, clipY, clipH, tx, ty, width, height, op);
+    paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op);
+    paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op);
 }
 
-void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer,
-                               int clipY, int clipH, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, clipY, clipH, tx, ty, width, height, 0, op);
+    paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op);
 }
 
 void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
index ceb3302..95c0637 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBox.h
@@ -288,10 +288,10 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
     virtual void updateBoxModelInfoFromStyle();
 
-    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
-    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
 
-    void paintMaskImages(const PaintInfo&, int clipY, int clipHeight, int tx, int ty, int width, int height);
+    void paintMaskImages(const PaintInfo&, int tx, int ty, int width, int height);
 
 #if PLATFORM(MAC)
     void paintCustomHighlight(int tx, int ty, const AtomicString& type, bool behindText);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
index 467fa82..8973e64 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.cpp
@@ -297,8 +297,7 @@ int RenderBoxModelObject::paddingRight(bool) const
 }
 
 
-void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int clipY, int clipH,
-                                                  int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
 {
     GraphicsContext* context = paintInfo.context;
     bool includeLeftEdge = box ? box->includeLeftEdge() : true;
@@ -411,7 +410,8 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     // Paint the color first underneath all images.
     if (!bgLayer->next()) {
-        IntRect rect(tx, clipY, w, clipH);
+        IntRect rect(tx, ty, w, h);
+        rect.intersect(paintInfo.rect);
         // If we have an alpha and we are painting the root element, go ahead and blend with the base background color.
         if (isOpaqueRoot) {
             Color baseColor = view()->frameView()->baseBackgroundColor();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
index f2c6326..9feaf2f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderBoxModelObject.h
@@ -90,8 +90,7 @@ public:
     void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
     bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
-    virtual void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int clipY, int clipHeight,
-                                        int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
+    void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
 
     // The difference between this inline's baseline position and the line's baseline position.
     int verticalPosition(bool firstLine) const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
index 310dbe4..1275882 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderFieldset.cpp
@@ -131,13 +131,9 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     h -= yOff;
     ty += yOff;
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
 
-    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
 
     if (!style()->hasBorder())
         return;
@@ -176,11 +172,7 @@ void RenderFieldset::paintMask(PaintInfo& paintInfo, int tx, int ty)
     h -= yOff;
     ty += yOff;
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
         
 void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
index 620d03d..ba85f1a 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayer.cpp
@@ -1062,8 +1062,10 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
         child->updateLayerPositions(false, false);
 
 #if USE(ACCELERATED_COMPOSITING)
-    if (isComposited())
-        m_backing->updateGraphicsLayerGeometry();
+    if (compositor()->inCompositingMode()) {
+        if (RenderLayer* compositingAncestor = ancestorCompositingLayer())
+            compositingAncestor->backing()->updateAfterLayout();
+    }
 #endif
     
     RenderView* view = renderer()->view();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
index dd5fafd..1c6d43c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerBacking.cpp
@@ -543,29 +543,29 @@ bool RenderLayerBacking::hasNonCompositingContent() const
     // FIXME: test for overflow controls.
     if (m_owningLayer->isStackingContext()) {
         // Use the m_hasCompositingDescendant bit to optimize?
-        Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 if (!curLayer->isComposited())
                     return true;
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = m_owningLayer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 if (!curLayer->isComposited())
                     return true;
             }
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = m_owningLayer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (!curLayer->isComposited())
                 return true;
         }
@@ -794,7 +794,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
-    if (paintingPhase & GraphicsLayerPaintBackgroundMask) {
+    bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
+
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -838,7 +840,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    if (paintingPhase & GraphicsLayerPaintForegroundMask) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
index 8b720a1..8b07ca9 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.cpp
@@ -60,16 +60,16 @@ namespace WebCore {
 
 struct CompositingState {
     CompositingState(RenderLayer* compAncestor)
-        : m_subtreeIsCompositing(false)
-        , m_compositingAncestor(compAncestor)
+        : m_compositingAncestor(compAncestor)
+        , m_subtreeIsCompositing(false)
 #ifndef NDEBUG
         , m_depth(0)
 #endif
     {
     }
     
-    bool m_subtreeIsCompositing;
     RenderLayer* m_compositingAncestor;
+    bool m_subtreeIsCompositing;
 #ifndef NDEBUG
     int m_depth;
 #endif
@@ -266,10 +266,13 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
     
     ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
 
-    Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-    if (negZOrderList) {
-        for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (!layer->isSelfPaintingLayer())
+        return IntRect();
+
+    if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+        size_t listSize = negZOrderList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = negZOrderList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(childUnionBounds);
@@ -277,10 +280,10 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-    if (posZOrderList) {
-        for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+        size_t listSize = posZOrderList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = posZOrderList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect childUnionBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(childUnionBounds);
@@ -288,10 +291,10 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (!curLayer->isComposited()) {
                 IntRect curAbsBounds = calculateCompositedBounds(curLayer, layer);
                 unionBounds.unite(curAbsBounds);
@@ -364,7 +367,7 @@ RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const Rend
 //      must be compositing so that its contents render over that child.
 //      This implies that its positive z-index children must also be compositing.
 //
-void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, struct CompositingState& ioCompState)
+void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, struct CompositingState& compositingState)
 {
     layer->updateLayerPosition();
     layer->updateZOrderLists();
@@ -372,18 +375,23 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
     
     // Clear the flag
     layer->setHasCompositingDescendant(false);
-    layer->setMustOverlayCompositedLayers(ioCompState.m_subtreeIsCompositing);
+    layer->setMustOverlayCompositedLayers(compositingState.m_subtreeIsCompositing);
     
-    const bool willBeComposited = needsToBeComposited(layer);
-    ioCompState.m_subtreeIsCompositing = willBeComposited;
+    // The children of this layer don't need to composite, unless there is
+    // a compositing layer among them, so start by inheriting the compositing
+    // ancestor with m_subtreeIsCompositing set to false.
+    CompositingState childState(compositingState.m_compositingAncestor);
+#ifndef NDEBUG
+    ++childState.m_depth;
+#endif
 
-    CompositingState childState = ioCompState;
-    if (willBeComposited)
+    const bool willBeComposited = needsToBeComposited(layer);
+    if (willBeComposited) {
+        // Tell the parent it has compositing descendants.
+        compositingState.m_subtreeIsCompositing = true;
+        // This layer now acts as the ancestor for kids.
         childState.m_compositingAncestor = layer;
-
-    // The children of this stacking context don't need to composite, unless there is
-    // a compositing layer among them, so start by assuming false.
-    childState.m_subtreeIsCompositing = false;
+    }
 
 #if ENABLE(VIDEO)
     // Video is special. It's a replaced element with a content layer, but has shadow content
@@ -393,22 +401,18 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
         childState.m_subtreeIsCompositing = true;
 #endif
 
-#ifndef NDEBUG
-    ++childState.m_depth;
-#endif
-
     if (layer->isStackingContext()) {
         ASSERT(!layer->m_zOrderListsDirty);
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 computeCompositingRequirements(curLayer, childState);
 
-                // if we have to make a layer for this child, make one now so we can have a contents layer
-                // (since we need to ensure that the -ve z-order child renders underneath our contents)
+                // If we have to make a layer for this child, make one now so we can have a contents layer
+                // (since we need to ensure that the -ve z-order child renders underneath our contents).
                 if (childState.m_subtreeIsCompositing) {
-                    // make |this| compositing
+                    // make layer compositing
                     layer->setMustOverlayCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
                 }
@@ -417,19 +421,19 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
     }
     
     ASSERT(!layer->m_normalFlowListDirty);
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::const_iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             computeCompositingRequirements(curLayer, childState);
         }
     }
 
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 computeCompositingRequirements(curLayer, childState);
             }
         }
@@ -444,7 +448,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, s
 
     // Subsequent layers in the parent stacking context also need to composite.
     if (childState.m_subtreeIsCompositing)
-        ioCompState.m_subtreeIsCompositing = true;
+        compositingState.m_subtreeIsCompositing = true;
 
     // If the layer is going into compositing mode, repaint its old location.
     if (!layer->isComposited() && needsToBeComposited(layer))
@@ -511,7 +515,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 }
 #endif
 
-void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& ioCompState)
+void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, struct CompositingState& compositingState)
 {
     // Make the layer compositing if necessary, and set up clipping and content layers.
     // Note that we can only do work here that is independent of whether the descendant layers
@@ -536,7 +540,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     if (layer->isRootLayer() && layer->isComposited())
         parentInRootLayer(layer);
 
-    CompositingState childState = ioCompState;
+    CompositingState childState = compositingState;
     if (layer->isComposited())
         childState.m_compositingAncestor = layer;
 
@@ -551,10 +555,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     if (layer->isStackingContext()) {
         ASSERT(!layer->m_zOrderListsDirty);
 
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList && negZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 rebuildCompositingLayerTree(curLayer, childState);
                 if (curLayer->isComposited())
                     setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -571,10 +575,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
 
     ASSERT(!layer->m_normalFlowListDirty);
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList && normalFlowList->size() > 0) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             rebuildCompositingLayerTree(curLayer, childState);
             if (curLayer->isComposited())
                 setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -582,10 +586,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     }
     
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList && posZOrderList->size() > 0) {
-            for (Vector<RenderLayer*>::const_iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 rebuildCompositingLayerTree(curLayer, childState);
                 if (curLayer->isComposited())
                     setCompositingParent(curLayer, childState.m_compositingAncestor);
@@ -611,19 +615,22 @@ void RenderLayerCompositor::updateCompositingChildrenGeometry(RenderLayer* compo
     
     if (layer->isStackingContext()) {
         if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
-            for (size_t i = 0; i < negZOrderList->size(); ++i)
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
                 updateCompositingChildrenGeometry(compositingAncestor, negZOrderList->at(i));
         }
     }
 
     if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
-        for (size_t i = 0; i < normalFlowList->size(); ++i)
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i)
             updateCompositingChildrenGeometry(compositingAncestor, normalFlowList->at(i));
     }
     
     if (layer->isStackingContext()) {
         if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
-            for (size_t i = 0; i < posZOrderList->size(); ++i)
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i)
                 updateCompositingChildrenGeometry(compositingAncestor, posZOrderList->at(i));
         }
     }
@@ -641,10 +648,10 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
         layer->setBackingNeedsRepaintInRect(rect);
 
     if (layer->hasCompositingDescendant()) {
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 int x = 0, y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
@@ -653,10 +660,10 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 int x = 0, y = 0;
                 curLayer->convertToLayerCoords(layer, x, y);
                 IntRect childRect(rect);
@@ -664,17 +671,16 @@ void RenderLayerCompositor::recursiveRepaintLayerRect(RenderLayer* layer, const
                 recursiveRepaintLayerRect(curLayer, childRect);
             }
         }
-        
-        Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-        if (normalFlowList) {
-            for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
-                int x = 0, y = 0;
-                curLayer->convertToLayerCoords(layer, x, y);
-                IntRect childRect(rect);
-                childRect.move(-x, -y);
-                recursiveRepaintLayerRect(curLayer, childRect);
-            }
+    }
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
+            int x = 0, y = 0;
+            curLayer->convertToLayerCoords(layer, x, y);
+            IntRect childRect(rect);
+            childRect.move(-x, -y);
+            recursiveRepaintLayerRect(curLayer, childRect);
         }
     }
 }
@@ -730,54 +736,17 @@ bool RenderLayerCompositor::has3DContent() const
 
 bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 {
-    return m_hasAcceleratedCompositing && (requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers());
-}
+    if (!m_hasAcceleratedCompositing || !layer->isSelfPaintingLayer())
+        return false;
 
-#define VERBOSE_COMPOSITINGLAYER    0
+    return requiresCompositingLayer(layer) || layer->mustOverlayCompositedLayers();
+}
 
 // Note: this specifies whether the RL needs a compositing layer for intrinsic reasons.
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
 {
-    // FIXME: cache the result of these tests?
-#if VERBOSE_COMPOSITINGLAYER
-    bool gotReason = false;
-
-    if (!gotReason && inCompositingMode() && layer->isRootLayer()) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it's the document root\n", layer);
-        gotReason = true;
-    }
-    
-    if (!gotReason && requiresCompositingForTransform(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has 3d transform, perspective or backface-hidden\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && requiresCompositingForVideo(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it is video\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has backface-visibility: hidden\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && clipsCompositingDescendants(layer)) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has overflow clip\n", layer);
-        gotReason = true;
-    }
-
-    if (!gotReason && requiresCompositingForAnimation(layer->renderer())) {
-        fprintf(stderr, "RenderLayer %p requires compositing layer because: it has a running transition for opacity or transform\n", layer);
-        gotReason = true;
-    }
-    
-    if (!gotReason)
-        fprintf(stderr, "RenderLayer %p does not require compositing layer\n", layer);
-#endif
-
     // The root layer always has a compositing layer, but it may not have backing.
     return (inCompositingMode() && layer->isRootLayer()) ||
              requiresCompositingForTransform(layer->renderer()) ||
@@ -834,7 +803,7 @@ bool RenderLayerCompositor::clipsCompositingDescendants(const RenderLayer* layer
            layer->renderer()->hasOverflowClip();
 }
 
-bool RenderLayerCompositor::requiresCompositingForTransform(RenderObject* renderer)
+bool RenderLayerCompositor::requiresCompositingForTransform(RenderObject* renderer) const
 {
     RenderStyle* style = renderer->style();
     // Note that we ask the renderer if it has a transform, because the style may have transforms,
@@ -853,12 +822,12 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
     return false;
 }
 
-bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer)
+bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
-    AnimationController* animController = renderer->animation();
-    if (animController)
-        return animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyOpacity) ||
-               animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyWebkitTransform);
+    if (AnimationController* animController = renderer->animation()) {
+        return (animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyOpacity) && inCompositingMode())
+            || animController->isAnimatingPropertyOnRenderer(renderer, CSSPropertyWebkitTransform);
+    }
     return false;
 }
 
@@ -909,29 +878,29 @@ bool RenderLayerCompositor::layerHas3DContent(const RenderLayer* layer) const
         return true;
 
     if (layer->isStackingContext()) {
-        Vector<RenderLayer*>* negZOrderList = layer->negZOrderList();
-        if (negZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = negZOrderList->begin(); it != negZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
+            size_t listSize = negZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = negZOrderList->at(i);
                 if (layerHas3DContent(curLayer))
                     return true;
             }
         }
 
-        Vector<RenderLayer*>* posZOrderList = layer->posZOrderList();
-        if (posZOrderList) {
-            for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it) {
-                RenderLayer* curLayer = (*it);
+        if (Vector<RenderLayer*>* posZOrderList = layer->posZOrderList()) {
+            size_t listSize = posZOrderList->size();
+            for (size_t i = 0; i < listSize; ++i) {
+                RenderLayer* curLayer = posZOrderList->at(i);
                 if (layerHas3DContent(curLayer))
                     return true;
             }
         }
     }
 
-    Vector<RenderLayer*>* normalFlowList = layer->normalFlowList();
-    if (normalFlowList) {
-        for (Vector<RenderLayer*>::iterator it = normalFlowList->begin(); it != normalFlowList->end(); ++it) {
-            RenderLayer* curLayer = (*it);
+    if (Vector<RenderLayer*>* normalFlowList = layer->normalFlowList()) {
+        size_t listSize = normalFlowList->size();
+        for (size_t i = 0; i < listSize; ++i) {
+            RenderLayer* curLayer = normalFlowList->at(i);
             if (layerHas3DContent(curLayer))
                 return true;
         }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
index 38995f8..bcd6a3f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderLayerCompositor.h
@@ -146,8 +146,8 @@ private:
     void destroyRootPlatformLayer();
     
     // Whether a running transition or animation enforces the need for a compositing layer.
-    static bool requiresCompositingForAnimation(RenderObject*);
-    static bool requiresCompositingForTransform(RenderObject*);
+    bool requiresCompositingForAnimation(RenderObject*) const;
+    bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
index 1803e49..b0eb097 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderMedia.cpp
@@ -299,6 +299,10 @@ void RenderMedia::updateControls()
         m_playButton->update();
     if (m_timeline)
         m_timeline->update();
+    if (m_currentTimeDisplay)
+        m_currentTimeDisplay->update();
+    if (m_timeRemainingDisplay)
+        m_timeRemainingDisplay->update();
     if (m_seekBackButton)
         m_seekBackButton->update();
     if (m_seekForwardButton)
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
index 5d9de1e..7a3aa64 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderPartObject.cpp
@@ -142,6 +142,24 @@ static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, co
 #endif
 }
 
+static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
+{
+    // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e. Real and WMP
+    // require "src" attribute).
+    int srcIndex = -1, dataIndex = -1;
+    for (unsigned int i = 0; i < paramNames->size(); ++i) {
+        if (equalIgnoringCase((*paramNames)[i], "src"))
+            srcIndex = i;
+        else if (equalIgnoringCase((*paramNames)[i], "data"))
+            dataIndex = i;
+    }
+
+    if (srcIndex == -1 && dataIndex != -1) {
+        paramNames->append("src");
+        paramValues->append((*paramValues)[dataIndex]);
+    }
+}
+
 void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 {
     String url;
@@ -238,6 +256,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
             }
         }
 
+        mapDataParamToSrc(&paramNames, &paramValues);
+
         // If we still don't have a type, try to map from a specific CLASSID to a type.
         if (serviceType.isEmpty())
             serviceType = serviceTypeForClassId(o->classId(), pluginData);
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
index a59a0a0..48b0d1c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTable.cpp
@@ -514,16 +514,9 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
             ty += captionHeight;
     }
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style());
     
-    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), my, mh, tx, ty, w, h);
+    paintFillLayers(paintInfo, style()->backgroundColor(), style()->backgroundLayers(), tx, ty, w, h);
 
     if (style()->hasBorder() && !collapseBorders())
         paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -545,14 +538,7 @@ void RenderTable::paintMask(PaintInfo& paintInfo, int tx, int ty)
             ty += captionHeight;
     }
 
-    int my = max(ty, paintInfo.rect.y());
-    int mh;
-    if (ty < paintInfo.rect.y())
-        mh = max(0, h - (paintInfo.rect.y() - ty));
-    else
-        mh = min(paintInfo.rect.height(), h);
-    
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
 void RenderTable::calcPrefWidths()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
index 81c96f1..9b02c9d 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTableCell.cpp
@@ -818,10 +818,6 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
     int w = width();
     int h = height();
 
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
     Color c = backgroundObject->style()->backgroundColor();
     const FillLayer* bgLayer = backgroundObject->style()->backgroundLayers();
 
@@ -835,7 +831,7 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
             paintInfo.context->save();
             paintInfo.context->clip(clipRect);
         }
-        paintFillLayers(paintInfo, c, bgLayer, my, mh, tx, ty, w, h);
+        paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h);
         if (shouldClip)
             paintInfo.context->restore();
     }
@@ -874,11 +870,7 @@ void RenderTableCell::paintMask(PaintInfo& paintInfo, int tx, int ty)
     int w = width();
     int h = height();
    
-    int my = max(ty, paintInfo.rect.y());
-    int end = min(paintInfo.rect.bottom(), ty + h);
-    int mh = end - my;
-
-    paintMaskImages(paintInfo, my, mh, tx, ty, w, h);
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
index 4bdc046..517d911 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.cpp
@@ -849,4 +849,9 @@ Color RenderTheme::platformInactiveTextSearchHighlightColor() const
     return Color(255, 255, 0); // Yellow.
 }
 
+Color RenderTheme::focusRingColor() const
+{
+    return Color(0, 0, 0); // Black.
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
index 5c87ebd..a1519ce 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderTheme.h
@@ -137,6 +137,8 @@ public:
     virtual Color platformActiveTextSearchHighlightColor() const;
     virtual Color platformInactiveTextSearchHighlightColor() const;
 
+    virtual Color focusRingColor() const;
+
     virtual void platformColorsDidChange();
 
     virtual double caretBlinkInterval() const { return 0.5; }
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
index c7d0a9f..5497d52 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.h
@@ -63,6 +63,8 @@ namespace WebCore {
         virtual Color platformActiveSelectionBackgroundColor() const;
         virtual Color platformInactiveSelectionBackgroundColor() const;
         virtual Color activeListBoxSelectionBackgroundColor() const;
+
+        virtual Color focusRingColor() const;
         
         virtual void platformColorsDidChange();
 
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
index 6417f4a..bd90831 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -32,6 +32,8 @@
 #import <math.h>
 
 #import "BitmapImage.h"
+#import "ChromiumBridge.h"
+#import "ColorMac.h"
 #import "CSSStyleSelector.h"
 #import "CSSValueKeywords.h"
 #import "Element.h"
@@ -170,6 +172,14 @@ Color RenderThemeChromiumMac::activeListBoxSelectionBackgroundColor() const
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
 }
 
+Color RenderThemeChromiumMac::focusRingColor() const
+{
+    if (ChromiumBridge::layoutTestMode())
+        return oldAquaFocusRingColor();
+
+    return systemColor(CSSValueWebkitFocusRingColor);
+}
+
 static FontWeight toFontWeight(NSInteger appKitFontWeight)
 {
     ASSERT(appKitFontWeight > 0 && appKitFontWeight < 15);
@@ -422,6 +432,9 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
     case CSSValueThreedlightshadow:
         color = convertNSColorToColor([NSColor controlLightHighlightColor]);
         break;
+    case CSSValueWebkitFocusRingColor:
+        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+        break;
     case CSSValueWindow:
         color = convertNSColorToColor([NSColor windowBackgroundColor]);
         break;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
index b756ab7..1fb0cb2 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -162,6 +162,12 @@ Color RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+Color RenderThemeChromiumSkia::focusRingColor() const
+{
+    static Color focusRingColor(229, 151, 0, 255);
+    return focusRingColor;
+}
+
 double RenderThemeChromiumSkia::caretBlinkInterval() const
 {
     // Disable the blinking caret in layout test mode, as it introduces
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
index d91c0d7..b81d4fa 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -54,6 +54,7 @@ namespace WebCore {
         virtual Color platformInactiveSelectionBackgroundColor() const;
         virtual Color platformActiveSelectionForegroundColor() const;
         virtual Color platformInactiveSelectionForegroundColor() const;
+        virtual Color focusRingColor() const;
 
         // To change the blink interval, override caretBlinkIntervalInternal instead of this one so that we may share layout test code an intercepts.
         virtual double caretBlinkInterval() const;
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
index b532352..ba32105 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeMac.h
@@ -58,6 +58,7 @@ public:
     virtual Color platformActiveListBoxSelectionForegroundColor() const;
     virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
     virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+    virtual Color focusRingColor() const;
 
     virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
     
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
index 16d744f..914f7ee 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.cpp
@@ -94,6 +94,17 @@ SOFT_LINK(SafariTheme, paintThemePart, void, __stdcall, (ThemePart part, CGConte
 #if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 2
 SOFT_LINK(SafariTheme, STPaintProgressIndicator, void, APIENTRY, (ProgressIndicatorType type, CGContextRef context, const CGRect& rect, NSControlSize size, ThemeControlState state, float value), (type, context, rect, size, state, value))
 #endif
+SOFT_LINK_OPTIONAL(SafariTheme, STCopyThemeColor, CGColorRef, APIENTRY, (unsigned color, SafariTheme::ThemeControlState));
+
+static const unsigned stFocusRingColorID = 4;
+
+static const unsigned aquaFocusRingColor = 0xFF7DADD9;
+
+static RGBA32 makeRGBAFromCGColor(CGColorRef color)
+{
+    const CGFloat* components = CGColorGetComponents(color);
+    return makeRGBA(255 * components[0], 255 * components[1], 255 * components[2], 255 * components[3]);
+}
 
 ThemeControlState RenderThemeSafari::determineState(RenderObject* o) const
 {
@@ -149,6 +160,22 @@ Color RenderThemeSafari::activeListBoxSelectionBackgroundColor() const
     return Color(56, 117, 215);
 }
 
+Color RenderThemeSafari::focusRingColor() const
+{
+    static Color focusRingColor;
+
+    if (!focusRingColor.isValid()) {
+        if (STCopyThemeColorPtr()) {
+            RetainPtr<CGColorRef> color(AdoptCF, STCopyThemeColorPtr()(stFocusRingColorID, SafariTheme::ActiveState));
+            focusRingColor = makeRGBAFromCGColor(color.get());
+        }
+        if (!focusRingColor.isValid())
+            focusRingColor = aquaFocusRingColor;
+    }
+
+    return focusRingColor;
+}
+
 static float systemFontSizeForControlSize(NSControlSize controlSize)
 {
     static float sizes[] = { 13.0f, 11.0f, 9.0f };
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
index d0a70ef..4685238 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderThemeSafari.h
@@ -69,6 +69,8 @@ public:
     virtual Color platformInactiveSelectionBackgroundColor() const;
     virtual Color activeListBoxSelectionBackgroundColor() const;
 
+    virtual Color focusRingColor() const;
+
     // System fonts.
     virtual void systemFont(int propId, FontDescription&) const;
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
deleted file mode 100644
index 978e67b..0000000
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.cpp
+++ /dev/null
@@ -1,115 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "LocalStorage.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "CString.h"
-#include "EventNames.h"
-#include "FileSystem.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "StorageArea.h"
-#include "StorageSyncManager.h"
-#include <wtf/StdLibExtras.h>
-
-namespace WebCore {
-
-typedef HashMap<String, LocalStorage*> LocalStorageMap;
-
-static LocalStorageMap& localStorageMap()
-{
-    DEFINE_STATIC_LOCAL(LocalStorageMap, localStorageMap, ());
-    return localStorageMap;
-}
-
-PassRefPtr<LocalStorage> LocalStorage::localStorage(const String& path)
-{
-    const String lookupPath = path.isNull() ? String("") : path;
-    LocalStorageMap::iterator it = localStorageMap().find(lookupPath);
-    if (it == localStorageMap().end()) {
-        RefPtr<LocalStorage> localStorage = adoptRef(new LocalStorage(lookupPath));
-        localStorageMap().set(lookupPath, localStorage.get());
-        return localStorage.release();
-    }
-    
-    return it->second;
-}
-
-LocalStorage::LocalStorage(const String& path)
-    : m_path(path.copy())
-{
-    if (!m_path.isEmpty())
-        m_syncManager = StorageSyncManager::create(m_path);
-}
-
-LocalStorage::~LocalStorage()
-{
-    ASSERT(localStorageMap().get(m_path) == this);
-    localStorageMap().remove(m_path);
-}
-
-PassRefPtr<StorageArea> LocalStorage::storageArea(SecurityOrigin* origin)
-{
-    ASSERT(isMainThread());
-
-    // FIXME: If the security origin in question has never had a storage area established,
-    // we need to ask a client call if establishing it is okay.  If the client denies the request,
-    // this method will return null.
-    // The sourceFrame argument exists for the purpose of asking a client.
-    // To know if an area has previously been established, we need to wait until this LocalStorage 
-    // object has finished it's AreaImport task.
-
-    // FIXME: If the storage area is being established for the first time here, we need to 
-    // sync its existance and quota out to disk via an task of type AreaSync
-
-    RefPtr<StorageArea> storageArea;
-    if (storageArea = m_storageAreaMap.get(origin))
-        return storageArea.release();
-
-    storageArea = StorageArea::createLocalStorage(origin, m_syncManager);
-    m_storageAreaMap.set(origin, storageArea);
-    return storageArea.release();
-}
-
-void LocalStorage::close()
-{
-    ASSERT(isMainThread());
-
-    LocalStorageAreaMap::iterator end = m_storageAreaMap.end();
-    for (LocalStorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
-        it->second->scheduleFinalSync();
-    
-    m_syncManager = 0;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h b/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
deleted file mode 100644
index 5139415..0000000
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorage.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef LocalStorage_h
-#define LocalStorage_h
-
-#if ENABLE(DOM_STORAGE)
-
-#include "SecurityOriginHash.h"
-
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-
-    class StorageArea;
-    class StorageSyncManager;
-
-    class LocalStorage : public RefCounted<LocalStorage> {
-    public:
-        ~LocalStorage();
-
-        static PassRefPtr<LocalStorage> localStorage(const String& path);
-
-        PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
-
-        void close();
-
-    private:
-        LocalStorage(const String& path);
-
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> LocalStorageAreaMap;
-        LocalStorageAreaMap m_storageAreaMap;
-
-        String m_path;
-        RefPtr<StorageSyncManager> m_syncManager;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
-#endif // LocalStorage_h
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
index 2b04120..f9b8dc2 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageTask.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorage.h"
 #include "LocalStorageThread.h"
 #include "StorageAreaSync.h"
 
diff --git a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
index ef1e3c6..2da5934 100644
--- a/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/LocalStorageThread.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorage.h"
 #include "LocalStorageTask.h"
 #include "StorageAreaSync.h"
 
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp b/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
deleted file mode 100644
index 7c2df16..0000000
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.cpp
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
- 
-#include "config.h"
-#include "SessionStorage.h"
-
-#if ENABLE(DOM_STORAGE)
-
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameTree.h"
-#include "Page.h"
-#include "SecurityOrigin.h"
-#include "StorageArea.h"
-#include "StorageMap.h"
-
-namespace WebCore {
-
-PassRefPtr<SessionStorage> SessionStorage::create(Page* page)
-{
-    return adoptRef(new SessionStorage(page));
-}
-
-SessionStorage::SessionStorage(Page* page)
-    : m_page(page)
-{
-    ASSERT(m_page);
-}
-
-PassRefPtr<SessionStorage> SessionStorage::copy(Page* newPage)
-{
-    ASSERT(newPage);
-    RefPtr<SessionStorage> newSession = SessionStorage::create(newPage);
-    
-    SessionStorageAreaMap::iterator end = m_storageAreaMap.end();
-    for (SessionStorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
-        RefPtr<StorageArea> areaCopy = i->second->copy(i->first.get(), newPage);
-        newSession->m_storageAreaMap.set(i->first, areaCopy.release());
-    }
-    
-    return newSession.release();
-}
-
-PassRefPtr<StorageArea> SessionStorage::storageArea(SecurityOrigin* origin)
-{
-    RefPtr<StorageArea> storageArea;
-    if (storageArea = m_storageAreaMap.get(origin))
-        return storageArea.release();
-        
-    storageArea = StorageArea::createSessionStorage(origin, m_page);
-    m_storageAreaMap.set(origin, storageArea);
-    return storageArea.release();
-}
-
-}
-
-#endif // ENABLE(DOM_STORAGE)
-
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h b/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
deleted file mode 100644
index b1244c2..0000000
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorage.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef SessionStorage_h
-#define SessionStorage_h
-
-#if ENABLE(DOM_STORAGE)
-
-#include "SecurityOriginHash.h"
-#include "StorageArea.h"
-
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-
-    class Page;
-
-    class SessionStorage : public RefCounted<SessionStorage> {
-    public:
-        static PassRefPtr<SessionStorage> create(Page*);
-        PassRefPtr<SessionStorage> copy(Page*);
-        
-        PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
-
-#ifndef NDEBUG
-        Page* page() { return m_page; }
-#endif
-
-    private:
-        SessionStorage(Page*);
-
-        void dispatchStorageEvent(StorageArea*, const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
-        Page* m_page;
-        
-        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> SessionStorageAreaMap;
-        SessionStorageAreaMap m_storageAreaMap;
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(DOM_STORAGE)
-
-#endif // SessionStorage_h
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
index 992ddd5..ac41447 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.cpp
@@ -42,16 +42,19 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageArea> StorageArea::createLocalStorage(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+PassRefPtr<StorageArea> StorageArea::create(StorageType storageType, SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
 {
-    return adoptRef(new StorageArea(origin, syncManager));
+    return adoptRef(new StorageArea(storageType, origin, syncManager));
 }
 
-StorageArea::StorageArea(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
-    : m_securityOrigin(origin)
+StorageArea::StorageArea(StorageType storageType, SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager)
+    : m_storageType(storageType)
+    , m_securityOrigin(origin)
     , m_storageMap(StorageMap::create())
     , m_storageSyncManager(syncManager)
-    , m_sessionStoragePage(0)
+#ifndef NDEBUG
+    , m_isShutdown(false)
+#endif
 {
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
@@ -64,37 +67,35 @@ StorageArea::StorageArea(SecurityOrigin* origin, PassRefPtr<StorageSyncManager>
     }
 }
 
-PassRefPtr<StorageArea> StorageArea::createSessionStorage(SecurityOrigin* origin, Page* page)
+PassRefPtr<StorageArea> StorageArea::copy(SecurityOrigin* origin)
 {
-    return adoptRef(new StorageArea(origin, page, 0));
+    ASSERT(!m_isShutdown);
+    return adoptRef(new StorageArea(origin, this));
 }
 
-PassRefPtr<StorageArea> StorageArea::copy(SecurityOrigin* origin, Page* page)
-{
-    return adoptRef(new StorageArea(origin, page, m_storageMap));
-}
-
-StorageArea::StorageArea(SecurityOrigin* origin, Page* page, PassRefPtr<StorageMap> storageMap)
-    : m_securityOrigin(origin)
-    , m_storageMap(storageMap)
-    , m_sessionStoragePage(page)
+StorageArea::StorageArea(SecurityOrigin* origin, StorageArea* area)
+    : m_storageType(area->m_storageType)
+    , m_securityOrigin(origin)
+    , m_storageMap(area->m_storageMap)
+    , m_storageSyncManager(area->m_storageSyncManager)
+#ifndef NDEBUG
+    , m_isShutdown(area->m_isShutdown)
+#endif
 {
     ASSERT(m_securityOrigin);
-    ASSERT(m_sessionStoragePage);
-
-    if (!m_storageMap) {
-        m_storageMap = StorageMap::create();
-        ASSERT(m_storageMap);
-    }
+    ASSERT(m_storageMap);
+    ASSERT(!m_isShutdown);
 }
 
 unsigned StorageArea::length() const
 {
+    ASSERT(!m_isShutdown);
     return m_storageMap->length();
 }
 
 String StorageArea::key(unsigned index, ExceptionCode& ec) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     String key;
@@ -109,6 +110,7 @@ String StorageArea::key(unsigned index, ExceptionCode& ec) const
 
 String StorageArea::getItem(const String& key) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     return m_storageMap->getItem(key);
@@ -116,6 +118,7 @@ String StorageArea::getItem(const String& key) const
 
 void StorageArea::setItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     ASSERT(!value.isNull());
     blockUntilImportComplete();
     
@@ -147,6 +150,7 @@ void StorageArea::setItem(const String& key, const String& value, ExceptionCode&
 
 void StorageArea::removeItem(const String& key, Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     if (frame->page()->settings()->privateBrowsingEnabled())
@@ -167,6 +171,7 @@ void StorageArea::removeItem(const String& key, Frame* frame)
 
 void StorageArea::clear(Frame* frame)
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     if (frame->page()->settings()->privateBrowsingEnabled())
@@ -181,6 +186,7 @@ void StorageArea::clear(Frame* frame)
 
 bool StorageArea::contains(const String& key) const
 {
+    ASSERT(!m_isShutdown);
     blockUntilImportComplete();
     
     return m_storageMap->contains(key);
@@ -188,13 +194,18 @@ bool StorageArea::contains(const String& key) const
 
 void StorageArea::importItem(const String& key, const String& value)
 {
+    ASSERT(!m_isShutdown);
     m_storageMap->importItem(key, value);
 }
 
-void StorageArea::scheduleFinalSync()
+void StorageArea::close()
 {
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleFinalSync();
+
+#ifndef NDEBUG
+    m_isShutdown = true;
+#endif
 }
 
 void StorageArea::blockUntilImportComplete() const
@@ -209,9 +220,14 @@ void StorageArea::dispatchStorageEvent(const String& key, const String& oldValue
     // of any given page in the group or mutate the page group itself.
     Vector<RefPtr<Frame> > frames;
 
-    if (m_sessionStoragePage) {
+    // FIXME: When can this occur?
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    if (m_storageType == SessionStorage) {
         // Send events only to our page.
-        for (Frame* frame = m_sessionStoragePage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
             if (frame->document()->securityOrigin()->equal(securityOrigin()))
                 frames.append(frame);
         }
@@ -219,11 +235,6 @@ void StorageArea::dispatchStorageEvent(const String& key, const String& oldValue
         for (unsigned i = 0; i < frames.size(); ++i)
             frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
     } else {
-        // FIXME: When can this occur?
-        Page* page = sourceFrame->page();
-        if (!page)
-            return;
-
         // Send events to every page.
         const HashSet<Page*>& pages = page->group().pages();
         HashSet<Page*>::const_iterator end = pages.end();
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageArea.h b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
index 30f0367..69e7882 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageArea.h
+++ b/src/3rdparty/webkit/WebCore/storage/StorageArea.h
@@ -48,12 +48,12 @@ namespace WebCore {
     class StorageMap;
     class StorageSyncManager;
     typedef int ExceptionCode;
+    enum StorageType { LocalStorage, SessionStorage };
 
     class StorageArea : public ThreadSafeShared<StorageArea> {
     public:
-        static PassRefPtr<StorageArea> createLocalStorage(SecurityOrigin* origin, PassRefPtr<StorageSyncManager> syncManager);
-        static PassRefPtr<StorageArea> createSessionStorage(SecurityOrigin* origin, Page* page);
-        PassRefPtr<StorageArea> copy(SecurityOrigin*, Page*);
+        static PassRefPtr<StorageArea> create(StorageType, SecurityOrigin*, PassRefPtr<StorageSyncManager>);
+        PassRefPtr<StorageArea> copy(SecurityOrigin*);
 
         // The HTML5 DOM Storage API
         unsigned length() const;
@@ -64,28 +64,31 @@ namespace WebCore {
         void clear(Frame* sourceFrame);
 
         bool contains(const String& key) const;
-        void scheduleFinalSync();
+        void close();
 
         // Could be called from a background thread.
         void importItem(const String& key, const String& value);
         SecurityOrigin* securityOrigin() { return m_securityOrigin.get(); }
 
     protected:
-        StorageArea(SecurityOrigin*, PassRefPtr<StorageSyncManager>);
-        StorageArea(SecurityOrigin*, Page*);
-        StorageArea(SecurityOrigin*, Page*, PassRefPtr<StorageMap>);
+        StorageArea(StorageType, SecurityOrigin*, PassRefPtr<StorageSyncManager>);
+        StorageArea(SecurityOrigin*, StorageArea*);
 
     private:
         void blockUntilImportComplete() const;
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
+        StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
 
         RefPtr<StorageAreaSync> m_storageAreaSync;
         RefPtr<StorageSyncManager> m_storageSyncManager;
-        Page* m_sessionStoragePage;  // NULL iff it's LocalStorage
+
+#ifndef NDEBUG
+        bool m_isShutdown;
+#endif
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
index 5cac054..2cef56d 100644
--- a/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
+++ b/src/3rdparty/webkit/WebCore/storage/StorageAreaSync.cpp
@@ -75,6 +75,8 @@ StorageAreaSync::~StorageAreaSync()
 void StorageAreaSync::scheduleFinalSync()
 {
     ASSERT(isMainThread());
+    // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
+    blockUntilImportComplete();
     
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
new file mode 100644
index 0000000..d8d85a7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageNamespace.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<String, StorageNamespace*> LocalStorageNamespaceMap;
+
+static LocalStorageNamespaceMap& localStorageNamespaceMap()
+{
+    DEFINE_STATIC_LOCAL(LocalStorageNamespaceMap, localStorageNamespaceMap, ());
+    return localStorageNamespaceMap;
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+{
+    const String lookupPath = path.isNull() ? String("") : path;
+    LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
+    if (it == localStorageNamespaceMap().end()) {
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespace(LocalStorage, lookupPath));
+        localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
+        return storageNamespace.release();
+    }
+
+    return it->second;
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
+{
+    return adoptRef(new StorageNamespace(SessionStorage, String()));
+}
+
+StorageNamespace::StorageNamespace(StorageType storageType, const String& path)
+    : m_storageType(storageType)
+    , m_path(path.copy())  // FIXME: Is the .copy necessary?
+    , m_syncManager(0)
+#ifndef NDEBUG
+    , m_isShutdown(false)
+#endif
+{
+    if (m_storageType == LocalStorage && !m_path.isEmpty())
+        m_syncManager = StorageSyncManager::create(m_path);
+}
+
+StorageNamespace::~StorageNamespace()
+{
+    ASSERT(isMainThread());
+
+    if (m_storageType == LocalStorage) {
+        ASSERT(localStorageNamespaceMap().get(m_path) == this);
+        localStorageNamespaceMap().remove(m_path);
+    }
+}
+
+PassRefPtr<StorageNamespace> StorageNamespace::copy()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    RefPtr<StorageNamespace> newNamespace = adoptRef(new StorageNamespace(m_storageType, m_path));
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i) {
+        RefPtr<StorageArea> areaCopy = i->second->copy(i->first.get());
+        newNamespace->m_storageAreaMap.set(i->first, areaCopy.release());
+    }
+
+    return newNamespace.release();
+}
+
+PassRefPtr<StorageArea> StorageNamespace::storageArea(SecurityOrigin* origin)
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    RefPtr<StorageArea> storageArea;
+    if (storageArea = m_storageAreaMap.get(origin))
+        return storageArea.release();
+
+    storageArea = StorageArea::create(m_storageType, origin, m_syncManager);
+    m_storageAreaMap.set(origin, storageArea);
+    return storageArea.release();
+}
+
+void StorageNamespace::close()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_isShutdown);
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->close();
+
+#ifndef NDEBUG
+    m_isShutdown = true;
+#endif
+}
+
+#endif // ENABLE(DOM_STORAGE)
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
new file mode 100644
index 0000000..5621b01
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/storage/StorageNamespace.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageNamespace_h
+#define StorageNamespace_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "SecurityOriginHash.h"
+#include "StorageArea.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class StorageArea;
+    class StorageSyncManager;
+
+    class StorageNamespace : public RefCounted<StorageNamespace> {
+    public:
+        ~StorageNamespace();
+
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> sessionStorageNamespace();
+
+        PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
+        PassRefPtr<StorageNamespace> copy();
+        void close();
+
+    private:
+        StorageNamespace(StorageType, const String& path);
+
+        typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageArea>, SecurityOriginHash> StorageAreaMap;
+        StorageAreaMap m_storageAreaMap;
+
+        StorageType m_storageType;
+
+        // Only used if m_storageType == LocalStorage and the path was not "" in our constructor.
+        String m_path;
+        RefPtr<StorageSyncManager> m_syncManager;
+
+#ifndef NDEBUG
+        bool m_isShutdown;
+#endif
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageNamespace_h
diff --git a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
index 2157144..227b570 100644
--- a/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
+++ b/src/3rdparty/webkit/WebCore/svg/graphics/SVGImage.cpp
@@ -95,7 +95,7 @@ SVGImage::~SVGImage()
     }
 
     // Verify that page teardown destroyed the Chrome
-    ASSERT(!m_chromeClient->image());
+    ASSERT(!m_chromeClient || !m_chromeClient->image());
 }
 
 void SVGImage::setContainerSize(const IntSize& containerSize)
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index 5c2214d..5899a1b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -2195,7 +2195,7 @@ bool QWebPage::swallowContextMenuEvent(QContextMenuEvent *event)
 
     if (QWebFrame* webFrame = d->frameAt(event->pos())) {
         Frame* frame = QWebFramePrivate::core(webFrame);
-        if (Scrollbar* scrollbar = frame->view()->scrollbarUnderMouse(PlatformMouseEvent(event, 1))) {
+        if (Scrollbar* scrollbar = frame->view()->scrollbarUnderPoint(PlatformMouseEvent(event, 1).pos())) {
             return scrollbar->contextMenu(PlatformMouseEvent(event, 1));
         }
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index bd1530e..dffa5e5 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,37 @@
+2009-06-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add missing isSpeaking() implementation to
+        ContextMenuClient.
+
+        * WebCoreSupport/ContextMenuClientQt.cpp:
+        (WebCore::ContextMenuClientQt::isSpeaking):
+        * WebCoreSupport/ContextMenuClientQt.h:
+
+2009-06-28  Sriram Yadavalli  <sriram.yadavalli@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix build break for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=26779
+
+        * Api/qwebpage.cpp:
+        (QWebPage::swallowContextMenuEvent):
+
+2009-06-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Build fix for Qt under Windows.
+
+        * Api/qwebhistory.h: Use consistent export linkage for the datastream operators.
+
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Changed call of scrollbarUnderMouse to scrollbarUnderPoint to match new API.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::swallowContextMenuEvent):
+
 2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
index ae9d718..ed79946 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.cpp
@@ -67,6 +67,12 @@ void ContextMenuClientQt::speak(const String&)
     notImplemented();
 }
 
+bool ContextMenuClientQt::isSpeaking()
+{
+    notImplemented();
+    return false;
+}
+
 void ContextMenuClientQt::stopSpeaking()
 {
     notImplemented();
diff --git a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
index ad6bfae..8440ff5 100644
--- a/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
+++ b/src/3rdparty/webkit/WebKit/qt/WebCoreSupport/ContextMenuClientQt.h
@@ -44,6 +44,7 @@ namespace WebCore {
         virtual void downloadURL(const KURL& url);
         virtual void lookUpInDictionary(Frame*);
         virtual void speak(const String&);
+        virtual bool isSpeaking();
         virtual void stopSpeaking();
         virtual void searchWithGoogle(const Frame*);
     };
-- 
cgit v0.12