Updated WebKit to 631751dee41f81af4daa7821f98b1ce8667c4d90

Reviewed-By: Andreas Kling

21 files changed, 530 insertions, 76 deletions

diff --git a/src/3rdparty/webkit/.tag b/src/3rdparty/webkit/.tag
index df6e857636..eecdf33c94 100644
--- a/src/3rdparty/webkit/.tag
+++ b/src/3rdparty/webkit/.tag
@@ -1 +1 @@
-0de6fbe7d7714e4d2520f84a7d7e0c5ed9a55114
+631751dee41f81af4daa7821f98b1ce8667c4d90
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
index fbd4469768..4ad4131b19 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2011-06-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r79060): Searching for a flight at united.com fails
+        https://bugs.webkit.org/show_bug.cgi?id=63003
+
+        This original change also broke Twitter, and we attempted to refine the fix to 
+        address that problem (http://trac.webkit.org/changeset/80542), but since it still breaks United,
+        we need to revert the change until we understand the problem better.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
 2011-06-09  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Geoff Garen.
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/DateMath.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/DateMath.cpp
index 70c0cf47f5..d414eae638 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/wtf/DateMath.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/wtf/DateMath.cpp
@@ -926,16 +926,6 @@ static double parseDateFromNullTerminatedCharacters(const char* dateString, bool
             }
         }
     }
-    
-    // The year may be after the time but before the time zone, but don't
-    // confuse a time zone specificed as an offset from UTC (e.g. +0100) with a
-    // four-digit year.
-    if (year <= 0 && *dateString != '+' && *dateString != '-') {
-       if (!parseLong(dateString, &newPosStr, 10, &year))
-          year = 0;
-       dateString = newPosStr;
-       skipSpacesAndComments(dateString);
-    }
 
     // Don't fail if the time zone is missing. 
     // Some websites omit the time zone (4275206).
diff --git a/src/3rdparty/webkit/Source/WebCore/ChangeLog b/src/3rdparty/webkit/Source/WebCore/ChangeLog
index b27d3aa30d..919d0bf891 100644
--- a/src/3rdparty/webkit/Source/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebCore/ChangeLog
@@ -1,3 +1,232 @@
+2011-06-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ASSERT in WebCore::HTMLToken::appendToAttributeName when visiting www.nba.com
+        https://bugs.webkit.org/show_bug.cgi?id=61774
+
+        This ASSERT triggers for the same underlying issue that causes
+        Bug 62971: When we tokenize a </script> tag, we don't realize that
+        we've already consumed the "</script>" from the input stream when we
+        extracted the previous token.  That causes the source tracker to be
+        out-of-sync, triggering the incorrect view-source highlighting and this
+        ASSERT.
+
+        For now, let's just silence the assert while we work on Bug 62971.
+
+        Test: fast/parser/attributes-on-close-script.html
+
+        * html/parser/HTMLToken.h:
+        (WebCore::HTMLToken::appendToAttributeName):
+        (WebCore::AtomicHTMLToken::initializeAttributes):
+
+2011-06-16  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        RefPtr frame since it can get removed in
+        FrameLoader::finishedParsing.
+        https://bugs.webkit.org/show_bug.cgi?id=62812
+
+        Tests: already tested by fast/parser/document-write-into-initial-document.html.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2011-06-07  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Replicate WidthIterator.cpp fix from r88139.
+        https://bugs.webkit.org/show_bug.cgi?id=62238
+
+        No new tests. Covered by existing layout tests on XP debug bots.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::advance):
+
+2011-06-01  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed.
+
+        Coding style nit. Move ec=0 initialization, change
+        recommended by Alexey in bug.
+        https://bugs.webkit.org/show_bug.cgi?id=60831
+
+        * dom/Document.cpp:
+        (WebCore::Document::setBody):
+
+2011-06-01  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix setting of document.body
+        https://bugs.webkit.org/show_bug.cgi?id=60831
+
+        1. Only allowing setting to an element if it has a body tag.
+        2. If element is from another document, import it.
+
+        Test: fast/dom/document-set-body.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setBody):
+
+2011-06-01  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        Do not use the pushed style selector if it is not equal to the
+        parent document's style selector. It usually means that it is
+        in a bad state, e.g. already cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=61737
+
+        * dom/Element.cpp:
+        (WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher):
+
+2011-06-17  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        When we lose ability to propagate floats, need to find topmost
+        parent with that overhanging float, and then iterate over its
+        sibling blocks to remove the float.
+        https://bugs.webkit.org/show_bug.cgi?id=62875
+
+        Test: fast/block/float/float-not-removed-from-next-sibling5.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::hasOverhangingFloat):
+        * rendering/RenderBlock.h:
+
+2011-05-10  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Add containsFloats call to hasOverhangingFloats.
+        https://bugs.webkit.org/show_bug.cgi?id=60537
+
+        Test: fast/block/float/no-overhanging-float-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::hasOverhangingFloats):
+
+2011-05-05  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        When style changes for a RenderBlock and we lose our ability to intrude into
+        floats in the next siblings block (e.g a position change), make sure to mark
+        our childs with floats for layout and iterate through our next sibling block
+        chain to see which ones contain the float that also exists in our floating
+        objects list and clear those using markAllDescendantsWithFloatsForLayout.
+        https://bugs.webkit.org/show_bug.cgi?id=56299
+
+        Tests: fast/block/float/float-not-removed-from-next-sibling-crash.html
+               fast/block/float/float-not-removed-from-next-sibling.html
+               fast/block/float/float-not-removed-from-next-sibling2.html
+               fast/block/float/float-not-removed-from-next-sibling3.html
+               fast/block/float/float-not-removed-from-next-sibling4.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::markSiblingsWithFloatsForLayout):
+        * rendering/RenderBlock.h:
+
+2011-06-16  Gabor Loki  <loki@webkit.org>
+
+        [Qt] Unreviewed, build fix after r89118.
+
+        * dom/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::initializeParserContext):
+
+2011-06-16  Jeffrey Pfau  <jpfau@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Using null bytes when setting innerHTML in XTHML results in assertion and a crash due to null-pointer dereference
+        https://bugs.webkit.org/show_bug.cgi?id=61053
+
+        XML parsing in-memory XML chunks now passes around a string object instead of a C string, ensuring null characters are properly handled.
+
+        Tests: fast/parser/xhtml-innerhtml-null-byte-first.xhtml
+               fast/parser/xhtml-innerhtml-null-byte.xhtml
+
+        * dom/XMLDocumentParser.h:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLDocumentParser::initializeParserContext):
+        (WebCore::XMLDocumentParser::appendFragmentSource):
+
+2011-06-15  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        Revert speculative fix in r84151. It caused some issues with
+        stylesheet lifetimes.
+        https://bugs.webkit.org/show_bug.cgi?id=62586
+
+        Tests: fast/dom/body-clone-link-decl-parent-crash.html
+               fast/dom/styled-clone-inline-style-decl-parent-crash.html
+               fast/dom/styled-not-in-document-clone-inline-style-decl-parent-crash.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+
+2011-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Frequent crashes due to null frame below ApplicationCacheHost::scheduleLoadFallbackResourceFromApplicationCache
+        https://bugs.webkit.org/show_bug.cgi?id=62764
+
+        This is an non-reproducible high volume crash, so no test :(. 
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::detachFromFrame):
+        Be conservative and stop loading when we detach a document loader from a frame.
+
+2011-06-14  Jeffrey Pfau  <jpfau@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Null dereference in WebCore::RenderBlock::splitFlow regarding use of multicol, inline-block, and spanning elements
+        https://bugs.webkit.org/show_bug.cgi?id=60028
+
+        Ensure that the parent block of a spanning element, if it is not itself
+        a multicol element, is not inline.
+
+        Test: fast/multicol/span/span-as-nested-inline-block-child.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::columnsBlockForSpanningElement):
+
+2011-06-14  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] [Symbian] GraphicsLayer: support plugins on symbian
+        https://bugs.webkit.org/show_bug.cgi?id=57418
+
+        Implement graphics layer for plugins on Symbian.
+
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::shouldUseAcceleratedCompositing):
+        (WebCore::PluginView::platformStart):
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginGraphicsLayerQt::PluginGraphicsLayerQt):
+        (WebCore::PluginGraphicsLayerQt::~PluginGraphicsLayerQt):
+        (WebCore::PluginGraphicsLayerQt::paint):
+        (WebCore::PluginView::shouldUseAcceleratedCompositing):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformLayer):
+
 2011-06-16  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r88796.
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/Document.cpp b/src/3rdparty/webkit/Source/WebCore/dom/Document.cpp
index 1c231ce5a7..9581cbf705 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/Document.cpp
@@ -569,12 +569,6 @@ void Document::removedLastRef()
 #if ENABLE(FULLSCREEN_API)
         m_fullScreenElement = 0;
 #endif
-        m_styleSelector.clear();
-        m_styleSheets.clear();
-        m_elemSheet.clear();
-        m_mappedElementSheet.clear();
-        m_pageUserSheet.clear();
-        m_pageGroupUserSheets.clear();
 
         // removeAllChildren() doesn't always unregister IDs,
         // so tear down scope information upfront to avoid having stale references in the map.
@@ -1990,11 +1984,20 @@ HTMLElement* Document::body() const
 
 void Document::setBody(PassRefPtr<HTMLElement> newBody, ExceptionCode& ec)
 {
-    if (!newBody || !documentElement()) { 
+    if (!newBody || !documentElement() || !newBody->hasTagName(bodyTag)) { 
         ec = HIERARCHY_REQUEST_ERR;
         return;
     }
 
+    if (newBody->document() && newBody->document() != this) {
+        ec = 0;
+        RefPtr<Node> node = importNode(newBody.get(), true, ec);
+        if (ec)
+            return;
+        
+        newBody = toHTMLElement(node.get());
+    }
+
     HTMLElement* b = body();
     if (!b)
         documentElement()->appendChild(newBody, ec);
@@ -4220,7 +4223,7 @@ void Document::finishedParsing()
     if (!m_documentTiming.domContentLoadedEventEnd)
         m_documentTiming.domContentLoadedEventEnd = currentTime();
 
-    if (Frame* f = frame()) {
+    if (RefPtr<Frame> f = frame()) {
         // FrameLoader::finishedParsing() might end up calling Document::implicitClose() if all
         // resource loads are complete. HTMLObjectElements can start loading their resources from
         // post attach callbacks triggered by recalcStyle().  This means if we parse out an <object>
@@ -4232,7 +4235,7 @@ void Document::finishedParsing()
 
         f->loader()->finishedParsing();
 
-        InspectorInstrumentation::domContentLoadedEventFired(f, url());
+        InspectorInstrumentation::domContentLoadedEventFired(f.get(), url());
     }
 }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/Element.cpp b/src/3rdparty/webkit/Source/WebCore/dom/Element.cpp
index 063bda6094..e7bfbc0f1b 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/Element.cpp
@@ -90,7 +90,13 @@ public:
 
         if (!m_pushedStyleSelector)
             return;
+
+        // This tells us that our pushed style selector is in a bad state,
+        // so we should just bail out in that scenario.
         ASSERT(m_pushedStyleSelector == m_parent->document()->styleSelector());
+        if (m_pushedStyleSelector != m_parent->document()->styleSelector())
+            return;
+
         m_pushedStyleSelector->popParent(m_parent); 
     }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.h b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.h
index 4e42a1004b..fa8c08a65b 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.h
+++ b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParser.h
@@ -32,6 +32,7 @@
 #include "SegmentedString.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/text/CString.h>
 #include <wtf/text/StringHash.h>
 
 #if USE(QXMLSTREAM)
@@ -56,8 +57,8 @@ namespace WebCore {
 #if !USE(QXMLSTREAM)
     class XMLParserContext : public RefCounted<XMLParserContext> {
     public:
-        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
-        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void* userData, const CString& chunk);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void* userData);
         ~XMLParserContext();
         xmlParserCtxtPtr context() const { return m_context; }
 
@@ -160,7 +161,7 @@ public:
         void endDocument();
 #endif
     private:
-        void initializeParserContext(const char* chunk = 0);
+        void initializeParserContext(const CString& chunk = CString());
 
         void pushCurrentNode(Node*);
         void popCurrentNode();
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
index b7867c759a..e82bf897f0 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserLibxml2.cpp
@@ -501,7 +501,7 @@ PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerP
 
 
 // Chunk should be encoded in UTF-8
-PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const CString& chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -511,7 +511,8 @@ PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerP
         didInit = true;
     }
 
-    xmlParserCtxtPtr parser = xmlCreateMemoryParserCtxt(chunk, xmlStrlen((const xmlChar*)chunk));
+    // appendFragmentSource() checks that the length doesn't overflow an int.
+    xmlParserCtxtPtr parser = xmlCreateMemoryParserCtxt(chunk.data(), chunk.length());
 
     if (!parser)
         return 0;
@@ -1276,7 +1277,7 @@ static void ignorableWhitespaceHandler(void*, const xmlChar*, int)
     // http://bugs.webkit.org/show_bug.cgi?id=5792
 }
 
-void XMLDocumentParser::initializeParserContext(const char* chunk)
+void XMLDocumentParser::initializeParserContext(const CString& chunk)
 {
     xmlSAXHandler sax;
     memset(&sax, 0, sizeof(sax));
@@ -1308,7 +1309,7 @@ void XMLDocumentParser::initializeParserContext(const char* chunk)
     if (m_parsingFragment)
         m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else {
-        ASSERT(!chunk);
+        ASSERT(!chunk.data());
         m_context = XMLParserContext::createStringParser(&sax, this);
     }
 }
@@ -1443,7 +1444,12 @@ bool XMLDocumentParser::appendFragmentSource(const String& chunk)
     ASSERT(m_parsingFragment);
 
     CString chunkAsUtf8 = chunk.utf8();
-    initializeParserContext(chunkAsUtf8.data());
+    
+    // libxml2 takes an int for a length, and therefore can't handle XML chunks larger than 2 GiB.
+    if (chunkAsUtf8.length() > INT_MAX)
+        return false;
+
+    initializeParserContext(chunkAsUtf8);
     xmlParseContent(context());
     endDocument(); // Close any open text nodes.
 
@@ -1452,9 +1458,9 @@ bool XMLDocumentParser::appendFragmentSource(const String& chunk)
     // Check if all the chunk has been processed.
     long bytesProcessed = xmlByteConsumed(context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length()) {
-        // FIXME: I don't believe we can hit this case without also having seen an error.
+        // FIXME: I don't believe we can hit this case without also having seen an error or a null byte.
         // If we hit this ASSERT, we've found a test case which demonstrates the need for this code.
-        ASSERT(m_sawError);
+        ASSERT(m_sawError || (bytesProcessed >= 0 && !chunkAsUtf8.data()[bytesProcessed]));
         return false;
     }
 
diff --git a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserQt.cpp b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserQt.cpp
index 04dd0b4bb5..dc72276e47 100644
--- a/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserQt.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/dom/XMLDocumentParserQt.cpp
@@ -202,7 +202,7 @@ void XMLDocumentParser::doWrite(const String& parseString)
     return;
 }
 
-void XMLDocumentParser::initializeParserContext(const char*)
+void XMLDocumentParser::initializeParserContext(const CString&)
 {
     DocumentParser::startParsing();
     m_sawError = false;
diff --git a/src/3rdparty/webkit/Source/WebCore/html/parser/HTMLToken.h b/src/3rdparty/webkit/Source/WebCore/html/parser/HTMLToken.h
index 59f7ed4d21..67db64706f 100644
--- a/src/3rdparty/webkit/Source/WebCore/html/parser/HTMLToken.h
+++ b/src/3rdparty/webkit/Source/WebCore/html/parser/HTMLToken.h
@@ -210,7 +210,9 @@ public:
     {
         ASSERT(character);
         ASSERT(m_type == StartTag || m_type == EndTag);
-        ASSERT(m_currentAttribute->m_nameRange.m_start);
+        // FIXME: We should be able to add the following ASSERT once we fix
+        // https://bugs.webkit.org/show_bug.cgi?id=62971
+        //   ASSERT(m_currentAttribute->m_nameRange.m_start);
         m_currentAttribute->m_name.append(character);
     }
 
@@ -545,7 +547,9 @@ inline void AtomicHTMLToken::initializeAttributes(const HTMLToken::AttributeList
         if (attribute.m_name.isEmpty())
             continue;
 
-        ASSERT(attribute.m_nameRange.m_start);
+        // FIXME: We should be able to add the following ASSERT once we fix
+        // https://bugs.webkit.org/show_bug.cgi?id=62971
+        //   ASSERT(attribute.m_nameRange.m_start);
         ASSERT(attribute.m_nameRange.m_end);
         ASSERT(attribute.m_valueRange.m_start);
         ASSERT(attribute.m_valueRange.m_end);
diff --git a/src/3rdparty/webkit/Source/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/Source/WebCore/loader/DocumentLoader.cpp
index b4ccd4941d..96889d8d4d 100644
--- a/src/3rdparty/webkit/Source/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/loader/DocumentLoader.cpp
@@ -399,6 +399,11 @@ void DocumentLoader::attachToFrame()
 void DocumentLoader::detachFromFrame()
 {
     ASSERT(m_frame);
+
+    // It never makes sense to have a document loader that is detached from its
+    // frame have any loads active, so go ahead and kill all the loads.
+    stopLoading();
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheHost->setDOMApplicationCache(0);
 #endif
diff --git a/src/3rdparty/webkit/Source/WebCore/platform/graphics/win/UniscribeController.cpp b/src/3rdparty/webkit/Source/WebCore/platform/graphics/win/UniscribeController.cpp
index a85088297f..75c19bb9ed 100644
--- a/src/3rdparty/webkit/Source/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -101,12 +101,12 @@ void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
     if (static_cast<int>(offset) > m_end)
         offset = m_end;
 
-    // Itemize the string.
-    const UChar* cp = m_run.data(m_currentCharacter);
     int length = offset - m_currentCharacter;
     if (length <= 0)
         return;
 
+    // Itemize the string.
+    const UChar* cp = m_run.data(m_currentCharacter);
     unsigned baseCharacter = m_currentCharacter;
 
     // We break up itemization of the string by fontData and (if needed) the use of small caps.
diff --git a/src/3rdparty/webkit/Source/WebCore/plugins/PluginView.h b/src/3rdparty/webkit/Source/WebCore/plugins/PluginView.h
index 49a4b61b4b..f528754055 100644
--- a/src/3rdparty/webkit/Source/WebCore/plugins/PluginView.h
+++ b/src/3rdparty/webkit/Source/WebCore/plugins/PluginView.h
@@ -64,6 +64,11 @@ QT_BEGIN_NAMESPACE
 class QPainter;
 QT_END_NAMESPACE
 #endif
+#if PLATFORM(QT) && USE(ACCELERATED_COMPOSITING) && ENABLE(NETSCAPE_PLUGIN_API) && (defined(XP_UNIX) || OS(SYMBIAN))
+#ifndef WTF_USE_ACCELERATED_COMPOSITING_PLUGIN_LAYER
+#define WTF_USE_ACCELERATED_COMPOSITING_PLUGIN_LAYER 1
+#endif
+#endif
 #if PLATFORM(GTK)
 typedef struct _GtkSocket GtkSocket;
 #endif
@@ -255,8 +260,9 @@ namespace WebCore {
         void keepAlive();
 
 #if USE(ACCELERATED_COMPOSITING)
-#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API) && PLATFORM(QT)
+#if USE(ACCELERATED_COMPOSITING_PLUGIN_LAYER)
         virtual PlatformLayer* platformLayer() const;
+        bool shouldUseAcceleratedCompositing() const;
 #else
         virtual PlatformLayer* platformLayer() const { return 0; }
 #endif
@@ -428,11 +434,11 @@ private:
 #endif
 #if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
         void paintUsingXPixmap(QPainter* painter, const QRect &exposedRect);
-#if USE(ACCELERATED_COMPOSITING)
+#endif
+#if USE(ACCELERATED_COMPOSITING_PLUGIN_LAYER)
         OwnPtr<PlatformLayer> m_platformLayer;
         friend class PluginGraphicsLayerQt;
-#endif // USE(ACCELERATED_COMPOSITING)
-#endif
+#endif // USE(ACCELERATED_COMPOSITING_PLUGIN_LAYER)
 #endif // PLATFORM(QT)
 
 #if PLATFORM(GTK)
diff --git a/src/3rdparty/webkit/Source/WebCore/plugins/qt/PluginViewQt.cpp b/src/3rdparty/webkit/Source/WebCore/plugins/qt/PluginViewQt.cpp
index cadf928b60..2fe69d12af 100644
--- a/src/3rdparty/webkit/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -120,6 +120,13 @@ public:
 private:
     PluginView* m_view;
 };
+
+bool PluginView::shouldUseAcceleratedCompositing() const
+{
+    return m_parentFrame->page()->chrome()->client()->allowsAcceleratedCompositing()
+           && m_parentFrame->page()->settings()
+           && m_parentFrame->page()->settings()->acceleratedCompositingEnabled();
+}
 #endif
 
 void PluginView::updatePluginWidget()
@@ -942,9 +949,7 @@ bool PluginView::platformStart()
         m_pluginDisplay = getPluginDisplay();
 
 #if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-        if (m_parentFrame->page()->chrome()->client()->allowsAcceleratedCompositing()
-            && m_parentFrame->page()->settings() 
-            && m_parentFrame->page()->settings()->acceleratedCompositingEnabled()) {
+        if (shouldUseAcceleratedCompositing()) {
             m_platformLayer = new PluginGraphicsLayerQt(this);
             // Trigger layer computation in RenderLayerCompositor
             m_element->setNeedsStyleRecalc(SyntheticStyleChange);
diff --git a/src/3rdparty/webkit/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp b/src/3rdparty/webkit/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
index 8110605658..5c0e9c0a7a 100644
--- a/src/3rdparty/webkit/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -20,6 +20,8 @@
 #include "PluginView.h"
 
 #include "BridgeJSC.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -59,6 +61,7 @@
 #include <QKeyEvent>
 #include <QPixmap>
 #include <QRegion>
+#include <QStyleOptionGraphicsItem>
 #include <QVector>
 #include <QWidget>
 #include <runtime/JSLock.h>
@@ -85,6 +88,49 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#if USE(ACCELERATED_COMPOSITING)
+class PluginGraphicsLayerQt : public QGraphicsWidget {
+public:
+    PluginGraphicsLayerQt(PluginView* view) : m_view(view)
+    {
+        setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, true);
+    }
+
+    ~PluginGraphicsLayerQt() { }
+
+    void paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget = 0)
+    {
+        Q_UNUSED(widget);
+
+        m_view->m_npWindow.ws_info = (void*)(painter);
+        m_view->setNPWindowIfNeeded();
+
+        painter->save();
+        QRectF clipRect(QPointF(0, 0), QSizeF(m_view->frameRect().size()));
+        if (option && !option->exposedRect.isEmpty())
+            clipRect &= option->exposedRect;
+        painter->setClipRect(clipRect);
+
+        QRect rect = clipRect.toRect();
+        QPaintEvent ev(rect);
+        QEvent& npEvent = ev;
+        m_view->dispatchNPEvent(npEvent);
+
+        painter->restore();
+    }
+
+private:
+    PluginView* m_view;
+};
+
+bool PluginView::shouldUseAcceleratedCompositing() const
+{
+    return m_parentFrame->page()->chrome()->client()->allowsAcceleratedCompositing()
+           && m_parentFrame->page()->settings()
+           && m_parentFrame->page()->settings()->acceleratedCompositingEnabled();
+}
+#endif
+
 void PluginView::updatePluginWidget()
 {
     if (!parent())
@@ -148,6 +194,11 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (m_isWindowed)
         return;
 
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_platformLayer)
+        return;
+#endif
+
     context->save();
     IntRect clipRect(rect);
     clipRect.intersect(frameRect());
@@ -344,6 +395,13 @@ bool PluginView::platformGetValue(NPNVariable, void*, NPError*)
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
+#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
+    if (m_platformLayer) {
+        m_platformLayer->update(QRectF(rect));
+        return;
+    }
+#endif
+
     if (m_isWindowed) {
         platformWidget()->update(rect);
         return;
@@ -415,6 +473,12 @@ bool PluginView::platformStart()
         setPlatformWidget(0);
         m_npWindow.type = NPWindowTypeDrawable;
         m_npWindow.window = 0; // Not used?
+#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
+        if (shouldUseAcceleratedCompositing()) {
+            m_platformLayer = new PluginGraphicsLayerQt(this);
+            m_element->setNeedsStyleRecalc(SyntheticStyleChange);
+        }
+#endif
     }    
     updatePluginWidget();
     setNPWindowIfNeeded();
@@ -444,4 +508,11 @@ void PluginView::restart()
 {
 }
 
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* PluginView::platformLayer() const
+{
+    return m_platformLayer.get();
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
index 59c8db7774..deb6389217 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.cpp
@@ -77,6 +77,8 @@ typedef WTF::HashSet<RenderBlock*> DelayedUpdateScrollInfoSet;
 static int gDelayUpdateScrollInfo = 0;
 static DelayedUpdateScrollInfoSet* gDelayedUpdateScrollInfoSet = 0;
 
+bool RenderBlock::s_canPropagateFloatIntoSibling = false;
+
 // Our MarginInfo state used when laying out block children.
 RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int beforeBorderPadding, int afterBorderPadding)
     : m_atBeforeSideOfBlock(true)
@@ -193,6 +195,8 @@ void RenderBlock::destroy()
 
 void RenderBlock::styleWillChange(StyleDifference diff, const RenderStyle* newStyle)
 {
+    s_canPropagateFloatIntoSibling = style() ? !isFloatingOrPositioned() && !avoidsFloats() : false;
+
     setReplaced(newStyle->isDisplayInlineType());
     
     if (style() && parent() && diff == StyleDifferenceLayout && style()->position() != newStyle->position()) {
@@ -256,6 +260,36 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
         updateBeforeAfterContent(BEFORE);
         updateBeforeAfterContent(AFTER);
     }
+
+    // After our style changed, if we lose our ability to propagate floats into next sibling
+    // blocks, then we need to find the top most parent containing that overhanging float and
+    // then mark its descendants with floats for layout and clear all floats from its next
+    // sibling blocks that exist in our floating objects list. See bug 56299 and 62875.
+    bool canPropagateFloatIntoSibling = !isFloatingOrPositioned() && !avoidsFloats();
+    if (diff == StyleDifferenceLayout && s_canPropagateFloatIntoSibling && !canPropagateFloatIntoSibling && hasOverhangingFloats()) {
+        RenderBlock* parentBlock = this;
+        FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+        FloatingObjectSetIterator end = floatingObjectSet.end();
+
+        for (RenderObject* curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
+            if (curr->isRenderBlock()) {
+                RenderBlock* currBlock = toRenderBlock(curr);
+
+                if (currBlock->hasOverhangingFloats()) {
+                    for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+                        RenderBox* renderer = (*it)->renderer();
+                        if (currBlock->hasOverhangingFloat(renderer)) {
+                            parentBlock = currBlock;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+              
+        parentBlock->markAllDescendantsWithFloatsForLayout();
+        parentBlock->markSiblingsWithFloatsForLayout();
+    }
 }
 
 void RenderBlock::updateBeforeAfterContent(PseudoId pseudoId)
@@ -617,7 +651,7 @@ RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
         && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
         if (style()->specifiesColumns())
             columnsBlockAncestor = this;
-        else if (parent() && parent()->isRenderBlock())
+        else if (!isInline() && parent() && parent()->isRenderBlock())
             columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
     }
     return columnsBlockAncestor;
@@ -2205,30 +2239,26 @@ void RenderBlock::markForPaginationRelayoutIfNeeded()
 void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants)
 {
     // Repaint any overhanging floats (if we know we're the one to paint them).
-    if (hasOverhangingFloats()) {
-        // We think that we must be in a bad state if m_floatingObjects is nil at this point, so 
-        // we assert on Debug builds and nil-check Release builds.
-        ASSERT(m_floatingObjects);
-        if (!m_floatingObjects)
-            return;
+    // Otherwise, bail out.
+    if (!hasOverhangingFloats())
+        return;
 
-        // FIXME: Avoid disabling LayoutState. At the very least, don't disable it for floats originating
-        // in this block. Better yet would be to push extra state for the containers of other floats.
-        view()->disableLayoutState();
-        FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        FloatingObjectSetIterator end = floatingObjectSet.end();
-        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
-            FloatingObject* r = *it;
-            // Only repaint the object if it is overhanging, is not in its own layer, and
-            // is our responsibility to paint (m_shouldPaint is set). When paintAllDescendants is true, the latter
-            // condition is replaced with being a descendant of us.
-            if (logicalBottomForFloat(r) > logicalHeight() && ((paintAllDescendants && r->m_renderer->isDescendantOf(this)) || r->m_shouldPaint) && !r->m_renderer->hasSelfPaintingLayer()) {
-                r->m_renderer->repaint();
-                r->m_renderer->repaintOverhangingFloats();
-            }
+    // FIXME: Avoid disabling LayoutState. At the very least, don't disable it for floats originating
+    // in this block. Better yet would be to push extra state for the containers of other floats.
+    view()->disableLayoutState();
+    FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+    FloatingObjectSetIterator end = floatingObjectSet.end();
+    for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        FloatingObject* r = *it;
+        // Only repaint the object if it is overhanging, is not in its own layer, and
+        // is our responsibility to paint (m_shouldPaint is set). When paintAllDescendants is true, the latter
+        // condition is replaced with being a descendant of us.
+        if (logicalBottomForFloat(r) > logicalHeight() && ((paintAllDescendants && r->m_renderer->isDescendantOf(this)) || r->m_shouldPaint) && !r->m_renderer->hasSelfPaintingLayer()) {
+            r->m_renderer->repaint();
+            r->m_renderer->repaintOverhangingFloats();
         }
-        view()->enableLayoutState();
     }
+    view()->enableLayoutState();
 }
  
 void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
@@ -3725,6 +3755,19 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
     return lowestFloatLogicalBottom;
 }
 
+bool RenderBlock::hasOverhangingFloat(RenderBox* renderer)
+{
+    if (!m_floatingObjects || hasColumns() || !parent())
+        return false;
+
+    FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+    FloatingObjectSetIterator it = floatingObjectSet.find<RenderBox*, FloatingObjectHashTranslator>(renderer);
+    if (it == floatingObjectSet.end())
+        return false;
+
+    return logicalBottomForFloat(*it) > logicalHeight();
+}
+
 void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, int logicalTopOffset)
 {
     // If the parent or previous sibling doesn't have any floats to add, don't bother.
@@ -3802,6 +3845,30 @@ void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove
     }
 }
 
+void RenderBlock::markSiblingsWithFloatsForLayout()
+{
+    FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+    FloatingObjectSetIterator end = floatingObjectSet.end();
+    for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        if (logicalBottomForFloat(*it) > logicalHeight()) {
+            RenderBox* floatingBox = (*it)->renderer();
+
+            RenderObject* next = nextSibling();
+            while (next) {
+                if (next->isRenderBlock() && !next->isFloatingOrPositioned() && !toRenderBlock(next)->avoidsFloats()) {
+                    RenderBlock* nextBlock = toRenderBlock(next);
+                    if (nextBlock->containsFloat(floatingBox))
+                        nextBlock->markAllDescendantsWithFloatsForLayout(floatingBox);
+                    else
+                        break;
+                }
+
+                next = next->nextSibling();
+            }
+        }
+    }
+}
+
 int RenderBlock::getClearDelta(RenderBox* child, int yPos)
 {
     // There is no need to compute clearance if we have no floats.
diff --git a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.h b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.h
index 68e2d80fef..6e420ca023 100644
--- a/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.h
+++ b/src/3rdparty/webkit/Source/WebCore/rendering/RenderBlock.h
@@ -98,6 +98,7 @@ public:
     bool generatesLineBoxesForInlineChild(RenderObject*);
 
     void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
+    void markSiblingsWithFloatsForLayout();
     void markPositionedObjectsForLayout();
     virtual void markForPaginationRelayoutIfNeeded();
     
@@ -567,7 +568,8 @@ private:
 
     virtual bool avoidsFloats() const;
 
-    bool hasOverhangingFloats() { return parent() && !hasColumns() && lowestFloatLogicalBottom() > logicalHeight(); }
+    bool hasOverhangingFloats() { return parent() && !hasColumns() && containsFloats() && lowestFloatLogicalBottom() > logicalHeight(); }
+    bool hasOverhangingFloat(RenderBox*);
     void addIntrudingFloats(RenderBlock* prev, int xoffset, int yoffset);
     int addOverhangingFloats(RenderBlock* child, int xoffset, int yoffset, bool makeChildPaintOtherFloats);
 
@@ -821,6 +823,10 @@ private:
     // (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
     friend class RenderRubyBase;
     friend class LineWidth; // Needs to know FloatingObject
+
+private:
+    // Used to store state between styleWillChange and styleDidChange
+    static bool s_canPropagateFloatIntoSibling;
 };
 
 inline RenderBlock* toRenderBlock(RenderObject* object)
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebpage.cpp
index 9a1e190efc..b3efe0fbcf 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/Api/qwebpage.cpp
@@ -269,6 +269,8 @@ static inline DragOperation dropActionToDragOp(Qt::DropActions actions)
         result |= (DragOperationMove | DragOperationGeneric);
     if (actions & Qt::LinkAction)
         result |= DragOperationLink;
+    if (result == (DragOperationCopy | DragOperationMove | DragOperationGeneric | DragOperationLink))
+        result = DragOperationEvery;
     return (DragOperation)result;
 }
 
@@ -315,6 +317,7 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     , inspectorFrontend(0)
     , inspector(0)
     , inspectorIsInternalOnly(false)
+    , m_lastDropAction(Qt::IgnoreAction)
 {
     WebCore::InitializeLoggingChannelsIfNecessary();
     ScriptController::initializeThreading();
@@ -1015,10 +1018,10 @@ void QWebPagePrivate::dragMoveEvent(T *ev)
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), QPointF(ev->pos()).toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
-    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
-    ev->setDropAction(action);
-    if (action != Qt::IgnoreAction)
-        ev->acceptProposedAction();
+    m_lastDropAction = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
+    ev->setDropAction(m_lastDropAction);
+    if (m_lastDropAction != Qt::IgnoreAction)
+        ev->accept();
 #endif
 }
 
@@ -1028,8 +1031,10 @@ void QWebPagePrivate::dropEvent(T *ev)
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), QPointF(ev->pos()).toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
-    if (page->dragController()->performDrag(&dragData))
-        ev->acceptProposedAction();
+    if (page->dragController()->performDrag(&dragData)) {
+        ev->setDropAction(m_lastDropAction);
+        ev->accept();
+    }
 #endif
 }
 
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
index 51d57e503f..63a8501410 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,43 @@
+2011-06-22  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix Qt namespace on QDeclarativeWebView autotest
+        https://bugs.webkit.org/show_bug.cgi?id=63147
+
+        Applications (such as the test runner) are not supposed to be wrapped
+        by {QT_BEGIN,QT_END}_NAMESPACE macros, otherwise building Qt (or
+        QtWebKit) with a specific namespace won't work (will result in main
+        being undefined).
+
+        This was the only test wrapped by these macros, all others are fine.
+
+        * tests/qdeclarativewebview/tst_qdeclarativewebview.cpp: remove
+        namespace macros.
+
+2011-06-21  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Regression(60942) wrong default action for drag-and-drop.
+        https://bugs.webkit.org/show_bug.cgi?id=63004
+
+        Added special handling for the case that dragOperation is not initialized.
+        Save the last dropOperation and pass it to the dropEvent, so that it can 
+        be accepted by QDrag.
+        Call event->accepted() and not event->acceptProposedAction(), because the
+        later ignores the dropAction specified in JavaScript.
+
+        Tested with the test page attached to https://bugs.webkit.org/show_bug.cgi?id=40401
+        and did not see any issue.
+        Also manually tested all combinations of LayoutTests/fast/events/drag-and-drop.html
+        and they all pass.
+
+        * Api/qwebpage.cpp:
+        (dropActionToDragOp):
+        (QWebPagePrivate::dragMoveEvent):
+        (QWebPagePrivate::dropEvent):
+
 2011-06-16  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r88796.
diff --git a/src/3rdparty/webkit/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp b/src/3rdparty/webkit/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
index 5ce1eb130a..c6e9f7d883 100644
--- a/src/3rdparty/webkit/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
+++ b/src/3rdparty/webkit/Source/WebKit/qt/tests/qdeclarativewebview/tst_qdeclarativewebview.cpp
@@ -14,8 +14,6 @@
 #include <QWebFrame>
 #include "qdeclarativewebview_p.h"
 
-QT_BEGIN_NAMESPACE
-
 class tst_QDeclarativeWebView : public QObject {
     Q_OBJECT
 
@@ -548,5 +546,3 @@ void tst_QDeclarativeWebView::checkNoErrors(const QDeclarativeComponent& compone
 
 QTEST_MAIN(tst_QDeclarativeWebView)
 #include "tst_qdeclarativewebview.moc"
-
-QT_END_NAMESPACE
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index cd81b17a6f..667ad32a4b 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,4 +4,4 @@ This is a snapshot of the Qt port of WebKit from
 
 and has the sha1 checksum
 
-        0de6fbe7d7714e4d2520f84a7d7e0c5ed9a55114
+        631751dee41f81af4daa7821f98b1ce8667c4d90