Updated WebKit to 9b4474ac44ee2f3311b435bd45630f5c2c357217

15 files changed, 58 insertions, 131 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index edee9247fb..7993dd6c35 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-65360d3d3377f120aecccf1bf9b9ae9444d488e1
+9b4474ac44ee2f3311b435bd45630f5c2c357217
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index 1a30d67245..91c8025331 100644
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,31 @@
+2011-05-31  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Convert raw ptr to RefPtr for documentElement.
+        https://bugs.webkit.org/show_bug.cgi?id=61688
+
+        Test: fast/dom/xml-parser-error-message-crash.svg
+
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::insertErrorMessageBlock):
+
+2011-05-31  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Frame flattening is broken with nested frames
+        https://bugs.webkit.org/show_bug.cgi?id=61491
+
+        After r77988, when frame flattening is enabled, performPostLayoutTasks() is called on a timer for iframes.
+        This causes layout of nested iframes to sometimes happen asynchronously, but WebCore expects layout to always finish synchronously.
+        Added a call to updateWidgetPosition() for cases that performPostLayoutTasks() is now happening asynchronously.
+
+        Test: fast/frames/flattening/iframe-flattening-nested.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
 2011-05-13  Adam Roben  <aroben@apple.com>
 
         Build fix after r86418
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.cpp b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.cpp
index e1764baacb..a1f0a58651 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.cpp
@@ -286,7 +286,7 @@ void XMLDocumentParser::insertErrorMessageBlock()
     // Create elements for display
     ExceptionCode ec = 0;
     Document* document = this->document();
-    Element* documentElement = document->documentElement();
+    RefPtr<Element> documentElement = document->documentElement();
     if (!documentElement) {
         RefPtr<Element> rootElement = document->createElement(htmlTag, false);
         document->appendChild(rootElement, ec);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.cpp
index 515e9a1b0f..6fa2ad3df2 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.cpp
@@ -410,7 +410,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSDOMWindowTableValues[458] =
+static const HashTableValue JSDOMWindowTableValues[456] =
 {
     { "screen", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowScreen), (intptr_t)setJSDOMWindowScreen THUNK_GENERATOR(0) },
     { "history", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowHistory), (intptr_t)setJSDOMWindowHistory THUNK_GENERATOR(0) },
@@ -458,7 +458,6 @@ static const HashTableValue JSDOMWindowTableValues[458] =
     { "sessionStorage", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowSessionStorage), (intptr_t)0 THUNK_GENERATOR(0) },
     { "localStorage", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowLocalStorage), (intptr_t)0 THUNK_GENERATOR(0) },
     { "webkitNotifications", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowWebkitNotifications), (intptr_t)0 THUNK_GENERATOR(0) },
-    { "orientation", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOrientation), (intptr_t)0 THUNK_GENERATOR(0) },
     { "console", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowConsole), (intptr_t)setJSDOMWindowConsole THUNK_GENERATOR(0) },
     { "onabort", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnabort), (intptr_t)setJSDOMWindowOnabort THUNK_GENERATOR(0) },
     { "onbeforeunload", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnbeforeunload), (intptr_t)setJSDOMWindowOnbeforeunload THUNK_GENERATOR(0) },
@@ -527,7 +526,6 @@ static const HashTableValue JSDOMWindowTableValues[458] =
     { "onwebkitanimationiteration", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationiteration), (intptr_t)setJSDOMWindowOnwebkitanimationiteration THUNK_GENERATOR(0) },
     { "onwebkitanimationstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkitanimationstart), (intptr_t)setJSDOMWindowOnwebkitanimationstart THUNK_GENERATOR(0) },
     { "onwebkittransitionend", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnwebkittransitionend), (intptr_t)setJSDOMWindowOnwebkittransitionend THUNK_GENERATOR(0) },
-    { "onorientationchange", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOnorientationchange), (intptr_t)setJSDOMWindowOnorientationchange THUNK_GENERATOR(0) },
 #if ENABLE(TOUCH_EVENTS)
     { "ontouchstart", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsDOMWindowOntouchstart), (intptr_t)setJSDOMWindowOntouchstart THUNK_GENERATOR(0) },
 #endif
@@ -1585,18 +1583,6 @@ JSValue jsDOMWindowWebkitNotifications(ExecState* exec, JSValue slotBase, const
 }
 
 
-JSValue jsDOMWindowOrientation(ExecState* exec, JSValue slotBase, const Identifier&)
-{
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
-    if (!castedThis->allowsAccessFrom(exec))
-        return jsUndefined();
-    UNUSED_PARAM(exec);
-    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    JSValue result = jsNumber(imp->orientation());
-    return result;
-}
-
-
 JSValue jsDOMWindowConsole(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
@@ -2748,23 +2734,6 @@ JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, JSValue slotBase, cons
 }
 
 
-JSValue jsDOMWindowOnorientationchange(ExecState* exec, JSValue slotBase, const Identifier&)
-{
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(asObject(slotBase));
-    if (!castedThis->allowsAccessFrom(exec))
-        return jsUndefined();
-    UNUSED_PARAM(exec);
-    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    if (EventListener* listener = imp->onorientationchange()) {
-        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
-            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
-                return jsFunction;
-        }
-    }
-    return jsNull();
-}
-
-
 #if ENABLE(TOUCH_EVENTS)
 JSValue jsDOMWindowOntouchstart(ExecState* exec, JSValue slotBase, const Identifier&)
 {
@@ -7001,17 +6970,6 @@ void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject,
 }
 
 
-void setJSDOMWindowOnorientationchange(ExecState* exec, JSObject* thisObject, JSValue value)
-{
-    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    UNUSED_PARAM(exec);
-    JSDOMWindow* castedThis = static_cast<JSDOMWindow*>(thisObject);
-    DOMWindow* imp = static_cast<DOMWindow*>(castedThis->impl());
-    imp->setOnorientationchange(createJSAttributeEventListener(exec, value, thisObject));
-}
-
-
 #if ENABLE(TOUCH_EVENTS)
 void setJSDOMWindowOntouchstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.h
index 39b91eb98b..c0125f7a08 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSDOMWindow.h
@@ -240,7 +240,6 @@ JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, JSC::JSValue, const JS
 JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsDOMWindowWebkitNotifications(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsDOMWindowOrientation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
@@ -377,8 +376,6 @@ JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSValue, co
 void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsDOMWindowOnorientationchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-void setJSDOMWindowOnorientationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOntouchstart(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSDOMWindowOntouchstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsDOMWindowOntouchmove(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.cpp
index 8342694dec..9f044ce5ee 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.cpp
@@ -42,7 +42,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement);
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSHTMLBodyElementTableValues[22] =
+static const HashTableValue JSHTMLBodyElementTableValues[21] =
 {
     { "aLink", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementALink), (intptr_t)setJSHTMLBodyElementALink THUNK_GENERATOR(0) },
     { "background", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementBackground), (intptr_t)setJSHTMLBodyElementBackground THUNK_GENERATOR(0) },
@@ -59,7 +59,6 @@ static const HashTableValue JSHTMLBodyElementTableValues[22] =
     { "onresize", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnresize), (intptr_t)setJSHTMLBodyElementOnresize THUNK_GENERATOR(0) },
     { "onstorage", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnstorage), (intptr_t)setJSHTMLBodyElementOnstorage THUNK_GENERATOR(0) },
     { "onunload", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnunload), (intptr_t)setJSHTMLBodyElementOnunload THUNK_GENERATOR(0) },
-    { "onorientationchange", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnorientationchange), (intptr_t)setJSHTMLBodyElementOnorientationchange THUNK_GENERATOR(0) },
     { "onblur", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnblur), (intptr_t)setJSHTMLBodyElementOnblur THUNK_GENERATOR(0) },
     { "onerror", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnerror), (intptr_t)setJSHTMLBodyElementOnerror THUNK_GENERATOR(0) },
     { "onfocus", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLBodyElementOnfocus), (intptr_t)setJSHTMLBodyElementOnfocus THUNK_GENERATOR(0) },
@@ -357,21 +356,6 @@ JSValue jsHTMLBodyElementOnunload(ExecState* exec, JSValue slotBase, const Ident
 }
 
 
-JSValue jsHTMLBodyElementOnorientationchange(ExecState* exec, JSValue slotBase, const Identifier&)
-{
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
-    UNUSED_PARAM(exec);
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    if (EventListener* listener = imp->onorientationchange()) {
-        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
-            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
-                return jsFunction;
-        }
-    }
-    return jsNull();
-}
-
-
 JSValue jsHTMLBodyElementOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(asObject(slotBase));
@@ -581,16 +565,6 @@ void setJSHTMLBodyElementOnunload(ExecState* exec, JSObject* thisObject, JSValue
 }
 
 
-void setJSHTMLBodyElementOnorientationchange(ExecState* exec, JSObject* thisObject, JSValue value)
-{
-    UNUSED_PARAM(exec);
-    JSHTMLBodyElement* castedThis = static_cast<JSHTMLBodyElement*>(thisObject);
-    JSDOMGlobalObject* globalObject = castedThis->globalObject();
-    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(castedThis->impl());
-    imp->setOnorientationchange(createJSAttributeEventListener(exec, value, globalObject));
-}
-
-
 void setJSHTMLBodyElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.h
index d765070499..de4b6f8328 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLBodyElement.h
@@ -95,8 +95,6 @@ JSC::JSValue jsHTMLBodyElementOnstorage(JSC::ExecState*, JSC::JSValue, const JSC
 void setJSHTMLBodyElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLBodyElementOnorientationchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-void setJSHTMLBodyElementOnorientationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLBodyElementOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLBodyElementOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.cpp
index 3508b9a434..c65718bbf7 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -43,7 +43,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement);
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSHTMLFrameSetElementTableValues[18] =
+static const HashTableValue JSHTMLFrameSetElementTableValues[17] =
 {
     { "cols", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementCols), (intptr_t)setJSHTMLFrameSetElementCols THUNK_GENERATOR(0) },
     { "rows", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementRows), (intptr_t)setJSHTMLFrameSetElementRows THUNK_GENERATOR(0) },
@@ -56,7 +56,6 @@ static const HashTableValue JSHTMLFrameSetElementTableValues[18] =
     { "onresize", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnresize), (intptr_t)setJSHTMLFrameSetElementOnresize THUNK_GENERATOR(0) },
     { "onstorage", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnstorage), (intptr_t)setJSHTMLFrameSetElementOnstorage THUNK_GENERATOR(0) },
     { "onunload", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnunload), (intptr_t)setJSHTMLFrameSetElementOnunload THUNK_GENERATOR(0) },
-    { "onorientationchange", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnorientationchange), (intptr_t)setJSHTMLFrameSetElementOnorientationchange THUNK_GENERATOR(0) },
     { "onblur", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnblur), (intptr_t)setJSHTMLFrameSetElementOnblur THUNK_GENERATOR(0) },
     { "onerror", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnerror), (intptr_t)setJSHTMLFrameSetElementOnerror THUNK_GENERATOR(0) },
     { "onfocus", DontDelete | DontEnum, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsHTMLFrameSetElementOnfocus), (intptr_t)setJSHTMLFrameSetElementOnfocus THUNK_GENERATOR(0) },
@@ -66,7 +65,7 @@ static const HashTableValue JSHTMLFrameSetElementTableValues[18] =
 };
 
 #undef THUNK_GENERATOR
-static JSC_CONST_HASHTABLE HashTable JSHTMLFrameSetElementTable = { 64, 63, JSHTMLFrameSetElementTableValues, 0 };
+static JSC_CONST_HASHTABLE HashTable JSHTMLFrameSetElementTable = { 33, 31, JSHTMLFrameSetElementTableValues, 0 };
 /* Hash table for constructor */
 #if ENABLE(JIT)
 #define THUNK_GENERATOR(generator) , generator
@@ -324,21 +323,6 @@ JSValue jsHTMLFrameSetElementOnunload(ExecState* exec, JSValue slotBase, const I
 }
 
 
-JSValue jsHTMLFrameSetElementOnorientationchange(ExecState* exec, JSValue slotBase, const Identifier&)
-{
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
-    UNUSED_PARAM(exec);
-    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
-    if (EventListener* listener = imp->onorientationchange()) {
-        if (const JSEventListener* jsListener = JSEventListener::cast(listener)) {
-            if (JSObject* jsFunction = jsListener->jsFunction(imp->scriptExecutionContext()))
-                return jsFunction;
-        }
-    }
-    return jsNull();
-}
-
-
 JSValue jsHTMLFrameSetElementOnblur(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(asObject(slotBase));
@@ -516,15 +500,6 @@ void setJSHTMLFrameSetElementOnunload(ExecState* exec, JSObject* thisObject, JSV
 }
 
 
-void setJSHTMLFrameSetElementOnorientationchange(ExecState* exec, JSObject* thisObject, JSValue value)
-{
-    UNUSED_PARAM(exec);
-    JSHTMLFrameSetElement* castedThis = static_cast<JSHTMLFrameSetElement*>(thisObject);
-    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(castedThis->impl());
-    imp->setOnorientationchange(createJSAttributeEventListener(exec, value, thisObject));
-}
-
-
 void setJSHTMLFrameSetElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     UNUSED_PARAM(exec);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.h
index c01f5e3293..c0a30ca638 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSHTMLFrameSetElement.h
@@ -90,8 +90,6 @@ JSC::JSValue jsHTMLFrameSetElementOnstorage(JSC::ExecState*, JSC::JSValue, const
 void setJSHTMLFrameSetElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnunload(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
-JSC::JSValue jsHTMLFrameSetElementOnorientationchange(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-void setJSHTMLFrameSetElementOnorientationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnblur(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSHTMLFrameSetElementOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsHTMLFrameSetElementOnerror(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.cpp
index 1c25b67233..ce3ac5a643 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.cpp
@@ -24,11 +24,9 @@
 #include "DOMMimeTypeArray.h"
 #include "DOMPluginArray.h"
 #include "ExceptionCode.h"
-#include "Geolocation.h"
 #include "JSDOMBinding.h"
 #include "JSDOMMimeTypeArray.h"
 #include "JSDOMPluginArray.h"
-#include "JSGeolocation.h"
 #include "KURL.h"
 #include "Navigator.h"
 #include <runtime/Error.h>
@@ -48,7 +46,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSNavigator);
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSNavigatorTableValues[16] =
+static const HashTableValue JSNavigatorTableValues[15] =
 {
     { "appCodeName", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorAppCodeName), (intptr_t)0 THUNK_GENERATOR(0) },
     { "appName", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorAppName), (intptr_t)0 THUNK_GENERATOR(0) },
@@ -64,7 +62,6 @@ static const HashTableValue JSNavigatorTableValues[16] =
     { "vendorSub", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorVendorSub), (intptr_t)0 THUNK_GENERATOR(0) },
     { "cookieEnabled", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorCookieEnabled), (intptr_t)0 THUNK_GENERATOR(0) },
     { "onLine", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorOnLine), (intptr_t)0 THUNK_GENERATOR(0) },
-    { "geolocation", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsNavigatorGeolocation), (intptr_t)0 THUNK_GENERATOR(0) },
     { 0, 0, 0, 0 THUNK_GENERATOR(0) }
 };
 
@@ -267,16 +264,6 @@ JSValue jsNavigatorOnLine(ExecState* exec, JSValue slotBase, const Identifier&)
 }
 
 
-JSValue jsNavigatorGeolocation(ExecState* exec, JSValue slotBase, const Identifier&)
-{
-    JSNavigator* castedThis = static_cast<JSNavigator*>(asObject(slotBase));
-    UNUSED_PARAM(exec);
-    Navigator* imp = static_cast<Navigator*>(castedThis->impl());
-    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->geolocation()));
-    return result;
-}
-
-
 EncodedJSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
diff --git a/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.h
index d632434b36..243c490883 100644
--- a/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/Source/WebCore/generated/JSNavigator.h
@@ -107,7 +107,6 @@ JSC::JSValue jsNavigatorVendor(JSC::ExecState*, JSC::JSValue, const JSC::Identif
 JSC::JSValue jsNavigatorVendorSub(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsNavigatorCookieEnabled(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsNavigatorOnLine(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
-JSC::JSValue jsNavigatorGeolocation(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
index ba0c68790f..894c196c85 100644
--- a/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/page/FrameView.cpp
@@ -1013,13 +1013,17 @@ void FrameView::layout(bool allowSubtree)
                              layoutHeight() < contentsHeight());
 
     if (!m_hasPendingPostLayoutTasks) {
-        if (!m_inSynchronousPostLayout && !inSubframeLayoutWithFrameFlattening) {
-            m_inSynchronousPostLayout = true;
-            // Calls resumeScheduledEvents()
-            performPostLayoutTasks();
-            m_inSynchronousPostLayout = false;
+        if (!m_inSynchronousPostLayout) {
+            if (inSubframeLayoutWithFrameFlattening)
+                m_frame->contentRenderer()->updateWidgetPositions();
+            else {
+                m_inSynchronousPostLayout = true;
+                // Calls resumeScheduledEvents()
+                performPostLayoutTasks();
+                m_inSynchronousPostLayout = false;
+            }
         }
-
+        
         if (!m_hasPendingPostLayoutTasks && (needsLayout() || m_inSynchronousPostLayout || inSubframeLayoutWithFrameFlattening)) {
             // If we need layout or are already in a synchronous call to postLayoutTasks(), 
             // defer widget updates and event dispatch until after we return. postLayoutTasks()
diff --git a/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.cpp b/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.cpp
index f93702b2e1..980fc58168 100644
--- a/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.cpp
@@ -46,7 +46,9 @@ LauncherWindow::LauncherWindow(WindowOptions* data, QGraphicsScene* sharedScene)
     , m_inspector(0)
     , m_formatMenuAction(0)
     , m_zoomAnimation(0)
+#ifndef QT_NO_LINEEDIT
     , m_findFlag(0)
+#endif
 {
     if (data)
         m_windowOptions = *data;
@@ -198,8 +200,10 @@ void LauncherWindow::createChrome()
     editMenu->addAction(page()->action(QWebPage::Copy));
     editMenu->addAction(page()->action(QWebPage::Paste));
     editMenu->addSeparator();
+#ifndef QT_NO_LINEEDIT
     editMenu->addAction("&Find", this, SLOT(showFindBar()), QKeySequence(Qt::CTRL | Qt::Key_F));
     editMenu->addSeparator();
+#endif
     QAction* setEditable = editMenu->addAction("Set Editable", this, SLOT(setEditable(bool)));
     setEditable->setCheckable(true);
 
@@ -410,7 +414,7 @@ void LauncherWindow::createChrome()
     QAction* toggleJavascriptCanOpenWindows = settingsMenu->addAction("Enable js popup windows", this, SLOT(toggleJavascriptCanOpenWindows(bool)));
     toggleJavascriptCanOpenWindows->setCheckable(true);
     toggleJavascriptCanOpenWindows->setChecked(false);
-
+#ifndef QT_NO_LINEEDIT
     m_findBar = new QToolBar("Find", this);
     addToolBar(Qt::BottomToolBarArea, m_findBar);
 
@@ -454,6 +458,7 @@ void LauncherWindow::createChrome()
     m_findBar->setMovable(false);
     m_findBar->setVisible(false);
 #endif
+#endif
 }
 
 bool LauncherWindow::isGraphicsBased() const
@@ -1022,6 +1027,7 @@ LauncherWindow* LauncherWindow::cloneWindow()
     return mw;
 }
 
+#ifndef QT_NO_LINEEDIT
 void LauncherWindow::showFindBar()
 {
     if (!m_findBar->isVisible()) {
@@ -1057,3 +1063,4 @@ void LauncherWindow::find(int mode = s_findNormalFlag)
     if (m_findFlag & QWebPage::HighlightAllOccurrences)
         page()->findText(m_lineEdit->text(), QFlag(m_findFlag));
 }
+#endif
diff --git a/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.h b/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.h
index f9cf00a393..d68995883c 100644
--- a/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.h
+++ b/src/3rdparty/webkit/Tools/QtTestBrowser/launcherwindow.h
@@ -190,9 +190,10 @@ protected slots:
     void toggleOfflineStorageDatabase(bool toggle);
     void toggleOfflineWebApplicationCache(bool toggle);
     void setOfflineStorageDefaultQuota();
-
+#ifndef QT_NO_LINEEDIT
     void showFindBar();
     void find(int mode);
+#endif
 #if defined(QT_CONFIGURED_WITH_OPENGL)
     void toggleQGLWidgetViewport(bool enable);
 #endif
@@ -241,11 +242,12 @@ private:
     bool m_touchMocking;
 
     QString m_inputUrl;
-
+#ifndef QT_NO_LINEEDIT
     QToolBar* m_findBar;
     QLineEdit* m_lineEdit;
     int m_findFlag;
     static const int s_findNormalFlag = 0;
+#endif
 };
 
 #endif
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7a8ed41586..88f6f3e2f1 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        65360d3d3377f120aecccf1bf9b9ae9444d488e1
+        9b4474ac44ee2f3311b435bd45630f5c2c357217