Merge branch '4.6' of git@scm.dev.nokia.troll.no:qt/oslo-staging-2 into 4.6

40 files changed, 588 insertions, 171 deletions

diff --git a/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
index 21cdb167cb..732d2d9755 100644
--- a/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
+++ b/src/3rdparty/phonon/mmf/videoplayer_dsa.cpp
@@ -162,7 +162,10 @@ void MMF::DsaVideoPlayer::prepareCompleted()
 void MMF::DsaVideoPlayer::handleVideoWindowChanged()
 {
     if (!m_window) {
-        m_window = QApplication::activeWindow()->effectiveWinId()->DrawableWindow();
+        if (QWidget *window = QApplication::activeWindow())
+            m_window = window->effectiveWinId()->DrawableWindow();
+        else
+            m_window = 0;
         m_videoScreenRect = TRect();
     }
 
@@ -213,6 +216,9 @@ void MMF::DsaVideoPlayer::handleParametersChanged(VideoParameters parameters)
     TRACE_CONTEXT(DsaVideoPlayer::handleParametersChanged, EVideoInternal);
     TRACE_ENTRY_0();
 
+    if (!m_window)
+        return;
+
 #ifndef QT_NO_DEBUG
     getDsaRegion(m_wsSession, *m_window);
 #endif
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 9dac2f83bf..a8889b3605 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -8,4 +8,4 @@ The commit imported was from the
 
 and has the sha1 checksum
 
-        aa40cdb9595eb15a68e7be03322f973aa613a8f9
+        e9151b11e974f0aa47fd40c225f88f35ced91496
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 0a444bc59f..2bd506beb1 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,3 +1,216 @@
+2010-03-25  yael aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Windowed netscape plugins don't work with QGraphicsWebView on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=35112
+
+        Add a proxy widget when loading a QWidget based plugin in a QGraphicsWebView.
+
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        (PluginContainerSymbian::PluginContainerSymbian):
+        (PluginContainerSymbian::focusInEvent):
+        * plugins/symbian/PluginContainerSymbian.h:
+        (WebCore::PluginContainerSymbian::proxy):
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2010-03-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed for the Qt 4.6 branch by Simon Hausmann.
+
+        Accept XHTML-MP content type as XHTML content
+        https://bugs.webkit.org/show_bug.cgi?id=34262
+
+        Enable processing XHTML-MP mime type as an XHTML document
+        even if XHTML-MP support is not enabled.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
+
+        Instead, keep one instance per RenderTheme around.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::findFrameLineWidth):
+
+2010-03-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Don't undefine SKIP_STATIC_CONSTRUCTORS_ON_GCC for Symbian HW targets.
+        https://bugs.webkit.org/show_bug.cgi?id=34081
+
+        Defining StringImpl instances as globals will cause a crash on process exit as 
+        StringImpl::Remove expects TLS which was already deleted at time of exiting main and ends up
+        constructing one exiting thread.
+
+        * config.h:
+
+2010-02-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        <rdar://problem/7594601> Crash in mangleme in WebCore::Element::getAttribute
+
+        Test: fast/forms/misplaced-img-form-registration.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::registerImgElement): Assert that the same image isn't added
+        to vector again.
+        (WebCore::HTMLFormElement::removeImgElement): Similarly, assert that we're removing something
+        that's actually registered.
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::~HTMLImageElement): If parser fails
+        to insert the image element, then there will be no removed from tree notification either,
+        need to unregister right away.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Fix crashing regression tests (tables/mozilla/bugs/bug4527.html et al.)
+
+        * html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::insertedIntoTree): Remove incorrect
+        assertions added in the previous patch - it's mot true that m_for is always a parent; table
+        parsing can reparent the image element, but m_form still needs to be set.
+
+2010-01-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34076
+        An image remains accessible via form.property syntax after being removed from document.
+
+        Tests: fast/forms/removed-image-as-property.html
+               fast/forms/reparented-image-as-property.html
+
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::~HTMLImageElement): This is called during GC - not a good time
+        to make observable changes to DOM.
+        (WebCore::HTMLImageElement::insertedIntoTree): This is the right place to do any work that
+        depends on connectedness to some ancestor. We still allow for m_form to be set via constructor,
+        which happens during parsing.
+        (WebCore::HTMLImageElement::removedFromTree): Ditto.
+
+        * html/HTMLImageElement.h: Added removedFromTree/insertedIntoTree, moved removedFromDocument
+        and insertedIntoDocument to private section, as they shouldn't be called directly.
+
+2009-12-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Navigating to a cached page can result in accessing a destroyed HTMLInputElement.
+        <rdar://problem/6856662> and https://webkit.org/b/32293
+
+        Test: fast/loader/input-element-page-cache-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Make sure to unregister for the activation
+          callback after the new m_autocomplete setting has been stored so the unregistration actually
+          takes place.
+
+2009-12-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7341364> Crash at HTMLParser::popOneBlockCommon() after
+        handling misnested residual style tags
+
+        Test: fast/parser/residual-style-close-ref-clone.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Gave the
+        block stack a strong reference to the cloned residual style element. 
+
+2009-12-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7487164> First line of text cannot be selected
+        https://bugs.webkit.org/show_bug.cgi?id=32749
+
+        Test: fast/text/remove-zero-length-run.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox): Changed code that assumed that if a box was being
+            removed, it was the only box in the RenderText. Instead, correctly preserve the list of
+            text boxes.
+        (WebCore::RenderText::checkConsistency): Updated for earlier rename.
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
+        https://bugs.webkit.org/show_bug.cgi?id=31576
+
+        Add a RefCounted wrapper object around xmlParserCtxtPtr so we can
+        maintain it's lifetime more effectively.
+
+        Test: fast/parser/xhtml-close-while-parsing.xhtml
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::popCurrentNode):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLParserContext::context):
+        (WebCore::XMLParserContext::XMLParserContext):
+        (WebCore::XMLTokenizer::context):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLParserContext::createStringParser):
+        (WebCore::XMLParserContext::createMemoryParser):
+        (WebCore::XMLParserContext::~XMLParserContext):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::parseAttributes):
+
+2009-11-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/7328395>
+        https://bugs.webkit.org/show_bug.cgi?id=31277
+
+        When an object tag's style changes (for example when child nodes are added/removed),
+        reuse its Frame (if it has one) instead of creating multiple Frames.
+
+        Test: fast/dom/HTMLObjectElement/children-changed.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestObject):
+
+2009-12-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Adam Barth.
+
+        Check that a CSS format() argument is of a valid type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31815
+        http://code.google.com/p/chromium/issues/detail?id=28582
+
+        Test: fast/css/url-format-non-string.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceSrc):
+
 2010-03-19  Miikka Heikkinen  <miikka.heikkinen@digia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 62a7f60a12..003acbee17 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -144,7 +144,9 @@
 #if PLATFORM(SYMBIAN)
 #undef WIN32
 #undef _WIN32
+#if COMPILER(WINSCW)
 #undef SKIP_STATIC_CONSTRUCTORS_ON_GCC
+#endif
 #define USE_SYSTEM_MALLOC 1
 #define U_HAVE_INT8_T 0
 #define U_HAVE_INT16_T 0
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 6024a5ba36..7750a800bb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -3328,6 +3328,12 @@ bool CSSParser::parseFontWeight(bool important)
     return false;
 }
 
+static bool isValidFormatFunction(CSSParserValue* val)
+{
+    CSSParserValueList* args = val->function->args;
+    return equalIgnoringCase(val->function->name, "format(") && (args->current()->unit == CSSPrimitiveValue::CSS_STRING || args->current()->unit == CSSPrimitiveValue::CSS_IDENT);
+}
+
 bool CSSParser::parseFontFaceSrc()
 {
     RefPtr<CSSValueList> values(CSSValueList::createCommaSeparated());
@@ -3355,7 +3361,7 @@ bool CSSParser::parseFontFaceSrc()
                     CSSParserValue* a = args->current();
                     uriValue.clear();
                     parsedValue = CSSFontFaceSrcValue::createLocal(a->string);
-                } else if (equalIgnoringCase(val->function->name, "format(") && allowFormat && uriValue) {
+                } else if (allowFormat && uriValue && isValidFormatFunction(val)) {
                     expectComma = true;
                     allowFormat = false;
                     uriValue->setFormat(args->current()->string);
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index 30d39e0170..56f8ff4f6a 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -91,7 +91,8 @@ void XMLTokenizer::pushCurrentNode(Node* n)
 
 void XMLTokenizer::popCurrentNode()
 {
-    ASSERT(m_currentNode);
+    if (!m_currentNode)
+        return;
     ASSERT(m_currentNodeStack.size());
 
     if (m_currentNode != m_doc)
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index a83e73af7c..3bd15c8cc8 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -52,6 +52,23 @@ namespace WebCore {
     class PendingCallbacks;
     class ScriptElement;
 
+#if !USE(QXMLSTREAM)
+    class XMLParserContext : public RefCounted<XMLParserContext> {
+    public:
+        static PassRefPtr<XMLParserContext> createMemoryParser(xmlSAXHandlerPtr, void*, const char*);
+        static PassRefPtr<XMLParserContext> createStringParser(xmlSAXHandlerPtr, void*);
+        ~XMLParserContext();
+        xmlParserCtxtPtr context() const { return m_context; }
+
+    private:
+        XMLParserContext(xmlParserCtxtPtr context)
+            : m_context(context)
+        {
+        }
+        xmlParserCtxtPtr m_context;
+    };
+#endif
+
     class XMLTokenizer : public Tokenizer, public CachedResourceClient {
     public:
         XMLTokenizer(Document*, FrameView* = 0);
@@ -146,7 +163,8 @@ public:
         QXmlStreamReader m_stream;
         bool m_wroteText;
 #else
-        xmlParserCtxtPtr m_context;
+        xmlParserCtxtPtr context() const { return m_context ? m_context->context() : 0; };
+        RefPtr<XMLParserContext> m_context;
         OwnPtr<PendingCallbacks> m_pendingCallbacks;
         Vector<xmlChar> m_bufferedText;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index 9aa0961a5e..42c8b9b67b 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -465,7 +465,7 @@ static void errorFunc(void*, const char*, ...)
 
 static bool didInit = false;
 
-static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
+PassRefPtr<XMLParserContext> XMLParserContext::createStringParser(xmlSAXHandlerPtr handlers, void* userData)
 {
     if (!didInit) {
         xmlInitParser();
@@ -482,12 +482,12 @@ static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* user
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
     xmlSwitchEncoding(parser, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
-    return parser;
+    return adoptRef(new XMLParserContext(parser));
 }
 
 
 // Chunk should be encoded in UTF-8
-static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
+PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerPtr handlers, void* userData, const char* chunk)
 {
     if (!didInit) {
         xmlInitParser();
@@ -518,8 +518,8 @@ static xmlParserCtxtPtr createMemoryParser(xmlSAXHandlerPtr handlers, void* user
     parser->str_xmlns = xmlDictLookup(parser->dict, BAD_CAST "xmlns", 5);
     parser->str_xml_ns = xmlDictLookup(parser->dict, XML_XML_NAMESPACE, 36);
     parser->_private = userData;
-
-    return parser;
+    
+    return adoptRef(new XMLParserContext(parser));
 }
 
 // --------------------------------
@@ -609,6 +609,13 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         m_defaultNamespaceURI = parentElement->namespaceURI();
 }
 
+XMLParserContext::~XMLParserContext()
+{
+    if (m_context->myDoc)
+        xmlFreeDoc(m_context->myDoc);
+    xmlFreeParserCtxt(m_context);
+}
+
 XMLTokenizer::~XMLTokenizer()
 {
     clearCurrentNodeStack();
@@ -616,15 +623,16 @@ XMLTokenizer::~XMLTokenizer()
         m_doc->deref();
     if (m_pendingScript)
         m_pendingScript->removeClient(this);
-    if (m_context)
-        xmlFreeParserCtxt(m_context);
 }
 
 void XMLTokenizer::doWrite(const String& parseString)
 {
     if (!m_context)
         initializeParserContext();
-    
+
+    // Protect the libxml context from deletion during a callback
+    RefPtr<XMLParserContext> context = m_context;
+
     // libXML throws an error if you try to switch the encoding for an empty string.
     if (parseString.length()) {
         // Hack around libxml2's lack of encoding overide support by manually
@@ -633,15 +641,15 @@ void XMLTokenizer::doWrite(const String& parseString)
         // and switch encodings, causing the parse to fail.
         const UChar BOM = 0xFEFF;
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-        xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
+        xmlSwitchEncoding(context->context(), BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
         XMLTokenizerScope scope(m_doc->docLoader());
-        xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
+        xmlParseChunk(context->context(), reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
     if (m_doc->decoder() && m_doc->decoder()->sawError()) {
         // If the decoder saw an error, report it as fatal (stops parsing)
-        handleError(fatal, "Encoding error", lineNumber(), columnNumber());
+        handleError(fatal, "Encoding error", context->context()->input->line, context->context()->input->col);
     }
 
     return;
@@ -1277,9 +1285,9 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 
     XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
-        m_context = createMemoryParser(&sax, this, chunk);
+        m_context = XMLParserContext::createMemoryParser(&sax, this, chunk);
     else
-        m_context = createStringParser(&sax, this);
+        m_context = XMLParserContext::createStringParser(&sax, this);
 }
 
 void XMLTokenizer::doEnd()
@@ -1300,12 +1308,9 @@ void XMLTokenizer::doEnd()
         // Tell libxml we're done.
         {
             XMLTokenizerScope scope(m_doc->docLoader());
-            xmlParseChunk(m_context, 0, 0, 1);
+            xmlParseChunk(context(), 0, 0, 1);
         }
 
-        if (m_context->myDoc)
-            xmlFreeDoc(m_context->myDoc);
-        xmlFreeParserCtxt(m_context);
         m_context = 0;
     }
 }
@@ -1334,18 +1339,19 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
 
 int XMLTokenizer::lineNumber() const
 {
-    return m_context ? m_context->input->line : 1;
+    return context() ? context()->input->line : 1;
 }
 
 int XMLTokenizer::columnNumber() const
 {
-    return m_context ? m_context->input->col : 1;
+    return context() ? context()->input->col : 1;
 }
 
 void XMLTokenizer::stopParsing()
 {
     Tokenizer::stopParsing();
-    xmlStopParser(m_context);
+    if (context())
+        xmlStopParser(context());
 }
 
 void XMLTokenizer::resumeParsing()
@@ -1384,17 +1390,17 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
     CString chunkAsUtf8 = chunk.utf8();
     tokenizer.initializeParserContext(chunkAsUtf8.data());
 
-    xmlParseContent(tokenizer.m_context);
+    xmlParseContent(tokenizer.context());
 
     tokenizer.endDocument();
 
     // Check if all the chunk has been processed.
-    long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
+    long bytesProcessed = xmlByteConsumed(tokenizer.context());
     if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
-    return tokenizer.m_context->wellFormed || xmlCtxtGetLastError(tokenizer.m_context) == 0;
+    return tokenizer.context()->wellFormed || xmlCtxtGetLastError(tokenizer.context()) == 0;
 }
 
 // --------------------------------
@@ -1437,12 +1443,9 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     memset(&sax, 0, sizeof(sax));
     sax.startElementNs = attributesStartElementNsHandler;
     sax.initialized = XML_SAX2_MAGIC;
-    xmlParserCtxtPtr parser = createStringParser(&sax, &state);
+    RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
-    xmlParseChunk(parser, reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
-    if (parser->myDoc)
-        xmlFreeDoc(parser->myDoc);
-    xmlFreeParserCtxt(parser);
+    xmlParseChunk(parser->context(), reinterpret_cast<const char*>(parseString.characters()), parseString.length() * sizeof(UChar), 1);
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index ace0f2f624..a74ff83882 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -515,11 +515,13 @@ bool HTMLFormElement::isURLAttribute(Attribute* attr) const
 
 void HTMLFormElement::registerImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) == notFound);
     imgElements.append(e);
 }
 
 void HTMLFormElement::removeImgElement(HTMLImageElement* e)
 {
+    ASSERT(imgElements.find(e) != notFound);
     removeFromVector(imgElements, e);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index d3530733b5..3db68117cb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -209,6 +209,30 @@ void HTMLImageElement::removedFromDocument()
     HTMLElement::removedFromDocument();
 }
 
+void HTMLImageElement::insertedIntoTree(bool deep)
+{
+    if (!m_form) {
+        // m_form can be non-null if it was set in constructor.
+        for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
+            if (ancestor->hasTagName(formTag)) {
+                m_form = static_cast<HTMLFormElement*>(ancestor);
+                m_form->registerImgElement(this);
+                break;
+            }
+        }
+    }
+
+    HTMLElement::insertedIntoTree(deep);
+}
+
+void HTMLImageElement::removedFromTree(bool deep)
+{
+    if (m_form)
+        m_form->removeImgElement(this);
+    m_form = 0;
+    HTMLElement::removedFromTree(deep);
+}
+
 int HTMLImageElement::width(bool ignorePendingStylesheets) const
 {
     if (!renderer()) {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
index f58574d33f..14e5fa37e2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.h
@@ -45,8 +45,6 @@ public:
 
     virtual void attach();
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
 
     virtual bool canStartSelection() const { return false; }
 
@@ -105,6 +103,11 @@ public:
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
 private:
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void insertedIntoTree(bool deep);
+    virtual void removedFromTree(bool deep);
+
     HTMLImageLoader m_imageLoader;
     String usemap;
     bool ismap;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index f25c9080b9..652bc40157 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -701,12 +701,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             m_autocomplete = Off;
             registerForActivationCallbackIfNeeded();
         } else {
-            if (m_autocomplete == Off)
-                unregisterForActivationCallbackIfNeeded();
+            bool needsToUnregister = m_autocomplete == Off;
+
             if (attr->isEmpty())
                 m_autocomplete = Uninitialized;
             else
                 m_autocomplete = On;
+
+            if (needsToUnregister)
+                unregisterForActivationCallbackIfNeeded();
         }
     } else if (attr->name() == typeAttr) {
         setInputType(attr->value());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 1cb47aeec5..99c66defb1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -1275,7 +1275,8 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
             prevMaxElem->next = elem;
             ASSERT(newNodePtr);
             prevMaxElem->node = newNodePtr;
-            prevMaxElem->didRefNode = false;
+            newNodePtr->ref();
+            prevMaxElem->didRefNode = true;
         } else
             delete elem;
     }
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index a85dcf5890..7d857d4a6a 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -1260,9 +1260,11 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
 
     ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
     HTMLPlugInElement* element = static_cast<HTMLPlugInElement*>(renderer->node());
-    
-    // FIXME: OK to always make a new frame? When does the old frame get removed?
-    return loadSubframe(element, completedURL, frameName, m_outgoingReferrer);
+
+    // If the plug-in element already contains a subframe, requestFrame will re-use it. Otherwise,
+    // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
+    // in the widget to be torn down.
+    return requestFrame(element, completedURL, frameName);
 }
 
 bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
diff --git a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
index 609a1b023b..758863cc1a 100644
--- a/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/MIMETypeRegistry.cpp
@@ -200,9 +200,7 @@ static void initializeSupportedNonImageMimeTypes()
         "text/",
         "application/xml",
         "application/xhtml+xml",
-#if ENABLE(XHTMLMP)
         "application/vnd.wap.xhtml+xml",
-#endif
         "application/rss+xml",
         "application/atom+xml",
 #if ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
index 37a6408d5a..298d840f1a 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.cpp
@@ -126,6 +126,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 RenderThemeQt::RenderThemeQt(Page* page)
     : RenderTheme()
     , m_page(page)
+    , m_lineEdit(0)
 {
     QPushButton button;
     button.setAttribute(Qt::WA_MacSmallSize);
@@ -142,6 +143,7 @@ RenderThemeQt::RenderThemeQt(Page* page)
 RenderThemeQt::~RenderThemeQt()
 {
     delete m_fallbackStyle;
+    delete m_lineEdit;
 }
 
 // for some widget painting, we need to fallback to Windows style
@@ -207,11 +209,13 @@ bool RenderThemeQt::supportsControlTints() const
     return true;
 }
 
-static int findFrameLineWidth(QStyle* style)
+int RenderThemeQt::findFrameLineWidth(QStyle* style) const
 {
-    QLineEdit lineEdit;
+    if (!m_lineEdit)
+        m_lineEdit = new QLineEdit();
+
     QStyleOptionFrameV2 opt;
-    return style->pixelMetric(QStyle::PM_DefaultFrameWidth, &opt, &lineEdit);
+    return style->pixelMetric(QStyle::PM_DefaultFrameWidth, &opt, m_lineEdit);
 }
 
 static QRect inflateButtonRect(const QRect& originalRect, QStyle* style)
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
index 13fb42ff12..64921b14b6 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
+++ b/src/3rdparty/webkit/WebCore/platform/qt/RenderThemeQt.h
@@ -27,6 +27,7 @@
 #include <QStyle>
 
 QT_BEGIN_NAMESPACE
+class QLineEdit;
 class QPainter;
 class QWidget;
 QT_END_NAMESPACE
@@ -140,6 +141,8 @@ private:
     void setButtonPadding(RenderStyle*) const;
     void setPopupPadding(RenderStyle*) const;
 
+    int findFrameLineWidth(QStyle* style) const;
+
     QStyle* fallbackStyle() const;
 
     Page* m_page;
@@ -150,6 +153,7 @@ private:
     QString m_buttonFontFamily;
 
     QStyle* m_fallbackStyle;
+    mutable QLineEdit* m_lineEdit;
 };
 
 class StylePainter {
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
index aece0e48b4..b839870c61 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.cpp
@@ -32,12 +32,12 @@
 
 using namespace WebCore;
 
-PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent)
-    : m_parent(parent)
+PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent, QGraphicsProxyWidget* proxy)
+    : QWidget(parent)
     , m_pluginView(view)
+    , m_proxy(proxy)
     , m_hasPendingGeometryChange(false)
 {
-    setParent(m_parent);
 }
 
 PluginContainerSymbian::~PluginContainerSymbian()
@@ -62,7 +62,7 @@ void PluginContainerSymbian::adjustGeometry()
     }
 }
 
-void PluginContainerSymbian::focusInEvent(QFocusEvent* event)
+void PluginContainerSymbian::focusInEvent(QFocusEvent*)
 {
     if (Page* page = m_pluginView->parentFrame()->page())
         page->focusController()->setActive(true);
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
index fce4a7160a..fead8723b6 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginContainerSymbian.h
@@ -22,6 +22,8 @@
 
 #include <QWidget>
 
+class QGraphicsProxyWidget;
+
 namespace WebCore {
 
     class PluginView;
@@ -29,18 +31,19 @@ namespace WebCore {
     class PluginContainerSymbian : public QWidget {
         Q_OBJECT
     public:
-        PluginContainerSymbian(PluginView*, QWidget* parent);
+        PluginContainerSymbian(PluginView*, QWidget* parent, QGraphicsProxyWidget* proxy = 0);
         ~PluginContainerSymbian();
 
         void requestGeometry(const QRect&, const QRegion& clip = QRegion());
         void adjustGeometry();
+        QGraphicsProxyWidget* proxy() { return m_proxy; }
 
     protected:
         virtual void focusInEvent(QFocusEvent*);
         virtual void focusOutEvent(QFocusEvent*);
     private:
         PluginView* m_pluginView;
-        QWidget* m_parent;
+        QGraphicsProxyWidget* m_proxy;
         QRect m_windowRect;
         QRegion m_clipRegion;
         bool m_hasPendingGeometryChange;
diff --git a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
index cf69723c6b..86f5f6c534 100644
--- a/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/src/3rdparty/webkit/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -52,6 +52,8 @@
 #include "runtime.h"
 #include "runtime_root.h"
 #include "QWebPageClient.h"
+#include "qgraphicswebview.h"
+#include <QGraphicsProxyWidget>
 #include <QKeyEvent>
 #include <QPixmap.h>
 #include <QRegion>
@@ -84,6 +86,7 @@ void PluginView::updatePluginWidget()
     IntRect oldClipRect = m_clipRect;
     
     m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
+    
     m_clipRect = windowClipRect();
     m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
@@ -425,12 +428,15 @@ bool PluginView::platformStart()
 
     if (m_isWindowed) {
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        // FIXME this will not work for QGraphicsView.
-        // But we cannot use winId because it will create a window and on S60,
-        // QWidgets should not create a window. 
-        Q_ASSERT(qobject_cast<QWidget*>(client->pluginParent()));
-        setPlatformWidget(new PluginContainerSymbian(this, 
-            qobject_cast<QWidget*>(client->pluginParent())));
+        QGraphicsProxyWidget* proxy = 0;
+        if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(client->pluginParent()))
+            proxy = new QGraphicsProxyWidget(webView);
+
+        PluginContainerSymbian* container = new PluginContainerSymbian(this, proxy ? 0 : client->ownerWidget(), proxy);
+        setPlatformWidget(container);
+        if (proxy)
+            proxy->setWidget(container);
+        
         m_npWindow.type = NPWindowTypeWindow;
         m_npWindow.window = (void*)platformPluginWidget();
 
@@ -446,7 +452,11 @@ bool PluginView::platformStart()
 
 void PluginView::platformDestroy()
 {
-    delete platformPluginWidget();
+    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+    if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(client->pluginParent()))
+        delete static_cast<PluginContainerSymbian*>(platformPluginWidget())->proxy();
+    else
+        delete platformPluginWidget();
 }
 
 void PluginView::halt()
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
index 40c3d75a54..88a05e5f5f 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
+++ b/src/3rdparty/webkit/WebCore/rendering/RenderText.cpp
@@ -1047,8 +1047,15 @@ void RenderText::positionLineBox(InlineBox* box)
     if (!s->len()) {
         // We want the box to be destroyed.
         s->remove();
+        if (m_firstTextBox == s)
+            m_firstTextBox = s->nextTextBox();
+        else
+            s->prevTextBox()->setNextLineBox(s->nextTextBox());
+        if (m_lastTextBox == s)
+            m_lastTextBox = s->prevTextBox();
+        else
+            s->nextTextBox()->setPreviousLineBox(s->prevTextBox());
         s->destroy(renderArena());
-        m_firstTextBox = m_lastTextBox = 0;
         return;
     }
 
@@ -1349,7 +1356,7 @@ void RenderText::checkConsistency() const
 #ifdef CHECK_CONSISTENCY
     const InlineTextBox* prev = 0;
     for (const InlineTextBox* child = m_firstTextBox; child != 0; child = child->nextTextBox()) {
-        ASSERT(child->object() == this);
+        ASSERT(child->renderer() == this);
         ASSERT(child->prevTextBox() == prev);
         prev = child;
     }
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
index a80c5d3548..490ada1691 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.cpp
@@ -65,6 +65,7 @@ public:
     void _q_doLoadFinished(bool success);
 
     void _q_updateMicroFocus();
+    void _q_pageDestroyed();
 
     QGraphicsWebView* q;
     QWebPage* page;
@@ -97,6 +98,12 @@ void QGraphicsWebViewPrivate::_q_updateMicroFocus()
 #endif
 }
 
+void QGraphicsWebViewPrivate::_q_pageDestroyed()
+{
+    page = 0;
+    q->setPage(0);
+}
+
 void QGraphicsWebViewPrivate::scroll(int dx, int dy, const QRect& rectToScroll)
 {
     q->scroll(qreal(dx), qreal(dy), QRectF(rectToScroll));
@@ -454,6 +461,8 @@ void QGraphicsWebView::setPage(QWebPage* page)
             this, SIGNAL(linkClicked(QUrl)));
     connect(d->page, SIGNAL(microFocusChanged()),
             this, SLOT(_q_updateMicroFocus()));
+    connect(d->page, SIGNAL(destroyed()),
+            this, SLOT(_q_pageDestroyed()));
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
index f983ae4683..1b02f35698 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qgraphicswebview.h
@@ -135,6 +135,7 @@ protected:
 private:
     Q_PRIVATE_SLOT(d, void _q_doLoadFinished(bool success))
     Q_PRIVATE_SLOT(d, void _q_updateMicroFocus())
+    Q_PRIVATE_SLOT(d, void _q_pageDestroyed())
 
     QGraphicsWebViewPrivate* const d;
     friend class QGraphicsWebViewPrivate;
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
index e4c2afc943..710e11b6c2 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebframe.cpp
@@ -324,15 +324,12 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer l
     }
 }
 
-static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy)
+static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy, const QPoint& pos)
 {
     if (!frame || !frame->document() || !frame->eventHandler())
         return false;
 
-    Node* node = frame->document()->focusedNode();
-    if (!node)
-        node = frame->document()->elementFromPoint(frame->eventHandler()->currentMousePosition().x(),
-                                                   frame->eventHandler()->currentMousePosition().y());
+    Node* node = frame->document()->elementFromPoint(pos.x(), pos.y());
     if (!node)
         return false;
 
@@ -363,6 +360,10 @@ static bool webframe_scrollOverflow(WebCore::Frame* frame, int dx, int dy)
     return (scrolledHorizontal || scrolledVertical);
 }
 
+
+
+
+
 /*!
     \class QWebFrame
     \since 4.4
@@ -1047,27 +1048,24 @@ void QWebFrame::scroll(int dx, int dy)
 }
 
 /*!
-  \since 4.7
   \internal
   Scrolls nested frames starting at this frame, \a dx pixels to the right 
   and \a dy pixels downward. Both \a dx and \a dy may be negative. First attempts
-  to scroll elements with CSS overflow followed by this frame. If this 
+  to scroll elements with CSS overflow at position pos, followed by this frame. If this 
   frame doesn't scroll, attempts to scroll the parent
-
-  \sa QWebFrame::scroll
 */
-bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy)
+void QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy, const QPoint& pos)
 {
     Frame* frame = QWebFramePrivate::core(qFrame);
-    bool scrolledHorizontal = false;
-    bool scrolledVertical = false;
-    bool scrolledOverflow = webframe_scrollOverflow(frame, dx, dy);
-
-    if (!scrolledOverflow) {
-        if (!frame || !frame->view())
-            return false;
 
+    if (!frame || !frame->view())
+        return;
+    
+    if (!webframe_scrollOverflow(frame, dx, dy, pos)) {
         do {
+            bool scrolledHorizontal = false;
+            bool scrolledVertical = false;
+            
             IntSize scrollOffset = frame->view()->scrollOffset();
             IntPoint maxScrollOffset = frame->view()->maximumScrollPosition();
 
@@ -1083,12 +1081,12 @@ bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int d
 
             if (scrolledHorizontal || scrolledVertical) {
                 frame->view()->scrollBy(IntSize(dx, dy));
-                return true;
+                return;
             }
+            
             frame = frame->tree()->parent(); 
         } while (frame && frame->view());
     }
-    return (scrolledHorizontal || scrolledVertical || scrolledOverflow);
 }
 
 /*!
diff --git a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
index a289ec0949..97a4e4ed2b 100644
--- a/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/Api/qwebpage.cpp
@@ -1248,8 +1248,8 @@ void QWebPagePrivate::inputMethodEvent(QInputMethodEvent *ev)
 #if QT_VERSION >= 0x040600
         case QInputMethodEvent::Selection: {
             if (renderTextControl) {
-                renderTextControl->setSelectionStart(a.start);
-                renderTextControl->setSelectionEnd(a.start + a.length);
+                renderTextControl->setSelectionStart(qMin(a.start, (a.start + a.length)));
+                renderTextControl->setSelectionEnd(qMax(a.start, (a.start + a.length)));
             }
             break;
         }
diff --git a/src/3rdparty/webkit/WebKit/qt/ChangeLog b/src/3rdparty/webkit/WebKit/qt/ChangeLog
index a5441cd97f..64726c2a10 100644
--- a/src/3rdparty/webkit/WebKit/qt/ChangeLog
+++ b/src/3rdparty/webkit/WebKit/qt/ChangeLog
@@ -1,3 +1,87 @@
+2010-03-22  Jakub Wieczorek  <jwieczorek@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't construct a QLineEdit every time when painting a text field
+        https://bugs.webkit.org/show_bug.cgi?id=36373
+
+        Add a simple benchmark covering this area.
+
+        * tests/benchmarks/painting/tst_painting.cpp:
+        (tst_Painting::textAreas):
+
+2010-03-22  Yi Shen  <shenyi2006@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35933  
+        [Qt] [Symbian] Can not backward select (highlight) text using virtual keyboard
+        Make sure the selection start index is smaller than the selection end index.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::inputMethodEvent):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2010-03-25  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtLauncher crashes on Mac OS and Linux when exiting with QGraphicsView mode enabled
+        https://bugs.webkit.org/show_bug.cgi?id=35251
+
+        Followed the way QWebView registers for the signal QWebPage::destroyed(), to prevent
+        QGraphicsWebView from referencing QWebPage after it was deleted.        
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_pageDestroyed):
+        (QGraphicsWebView::setPage):
+        * Api/qgraphicswebview.h:
+
+2010-03-23  David Leong  <david.leong@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Build fix for Symbian Def file.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-03-18  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] New API scrollRecursively has several problems.
+        https://bugs.webkit.org/show_bug.cgi?id=35873
+
+        Remove scrollRecursively from the Qt 4.7 API
+        Update the internal API to accept a hit test position 
+        for nested scrolling
+
+        * Api/qwebframe.cpp:
+        (webframe_scrollOverflow):
+        (qtwebkit_webframe_scrollRecursively):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-12-18  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add new API to QWebFrame to scrollRecursively starting with any css overflow 
+        then checking current frame and then ancestors
+        https://bugs.webkit.org/show_bug.cgi?id=32668
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::scrollOverflow):
+        (QWebFrame::scrollRecursively):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * tests/qwebframe/qwebframe.qrc:
+        * tests/qwebframe/testiframe.html: Added.
+        * tests/qwebframe/testiframe2.html: Added.
+        * tests/qwebframe/tst_qwebframe.cpp:
+
 2010-03-21  Kristian Amlie  <kristian.amlie@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
index 5dd2e20c41..cfa8f7f2ff 100644
--- a/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/src/3rdparty/webkit/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -693,5 +693,5 @@ EXPORTS
 	_Z23qt_networkAccessAllowedb @ 692 NONAME
 	_Z25qt_resumeActiveDOMObjectsP9QWebFrame @ 693 NONAME
 	_Z26qt_suspendActiveDOMObjectsP9QWebFrame @ 694 NONAME
-	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameii @ 695 NONAME
-
+	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameii @ 695 NONAME ABSENT
+	_Z35qtwebkit_webframe_scrollRecursivelyP9QWebFrameiiRK6QPoint @ 715 NONAME
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
index f4531fdac2..fc5b8e3b0a 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/benchmarks/painting/tst_painting.cpp
@@ -19,6 +19,7 @@
 
 #include <QtTest/QtTest>
 
+#include <qwebelement.h>
 #include <qwebframe.h>
 #include <qwebview.h>
 #include <qpainter.h>
@@ -59,6 +60,7 @@ public Q_SLOTS:
 private Q_SLOTS:
     void paint_data();
     void paint();
+    void textAreas();
 
 private:
     QWebView* m_view;
@@ -105,5 +107,30 @@ void tst_Painting::paint()
     }
 }
 
+void tst_Painting::textAreas()
+{
+    m_view->load(QUrl("data:text/html;<html><body></body></html>"));
+    ::waitForSignal(m_view, SIGNAL(loadFinished(bool)));
+
+    QWebElement bodyElement = m_page->mainFrame()->findFirstElement("body");
+
+    int count = 100;
+    while (count--) {
+        QString markup("<textarea cols='1' rows='1'></textarea>");
+        bodyElement.appendInside(markup);
+    }
+
+    /* force a layout */
+    QWebFrame* mainFrame = m_page->mainFrame();
+    mainFrame->toPlainText();
+
+    QPixmap pixmap(mainFrame->contentsSize());
+    QBENCHMARK {
+        QPainter painter(&pixmap);
+        mainFrame->render(&painter, QRect(QPoint(0, 0), mainFrame->contentsSize()));
+        painter.end();
+    }
+}
+
 QTEST_MAIN(tst_Painting)
 #include "tst_painting.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 609f8b4e87..8cc79538c9 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -606,7 +606,6 @@ private slots:
     void scrollPosition();
     void evaluateWillCauseRepaint();
     void qObjectWrapperWithSameIdentity();
-    void scrollRecursively();
 
 private:
     QString  evalJS(const QString&s) {
@@ -2825,71 +2824,5 @@ void tst_QWebFrame::qObjectWrapperWithSameIdentity()
     QCOMPARE(mainFrame->toPlainText(), QString("test2"));
 }
 
-bool QWEBKIT_EXPORT qtwebkit_webframe_scrollRecursively(QWebFrame* qFrame, int dx, int dy);
-
-void tst_QWebFrame::scrollRecursively()
-{
-    // The test content is 
-    // a nested frame set
-    // The main frame scrolls
-    // and has two children
-    // an iframe and a div overflow
-    // both scroll
-    QWebView webView;
-    QWebPage* webPage = webView.page();
-    QSignalSpy loadSpy(webPage, SIGNAL(loadFinished(bool)));
-    QUrl url = QUrl("qrc:///testiframe.html");
-    webPage->mainFrame()->load(url);
-    QTRY_COMPARE(loadSpy.count(), 1);
-
-    QList<QWebFrame*> children =  webPage->mainFrame()->childFrames();
-    QVERIFY(children.count() == 1);
-
-    // 1st test
-    // call scrollRecursively over mainframe
-    // verify scrolled
-    // verify scroll postion changed
-    QPoint scrollPosition(webPage->mainFrame()->scrollPosition());
-    QVERIFY(qtwebkit_webframe_scrollRecursively(webPage->mainFrame(), 10, 10));
-    QVERIFY(scrollPosition != webPage->mainFrame()->scrollPosition());
-
-    // 2nd test
-    // call scrollRecursively over child iframe
-    // verify scrolled
-    // verify child scroll position changed
-    // verify parent's scroll position did not change
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    QPoint childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), 10, 10));
-    QVERIFY(scrollPosition == webPage->mainFrame()->scrollPosition());
-    QVERIFY(childScrollPosition != children.at(0)->scrollPosition());
-
-    // 3rd test
-    // call scrollRecursively over div overflow
-    // verify scrolled == true
-    // verify parent and child frame's scroll postion did not change
-    QWebElement div = webPage->mainFrame()->documentElement().findFirst("#content1");
-    QMouseEvent evpres(QEvent::MouseMove, div.geometry().center(), Qt::NoButton, Qt::NoButton, Qt::NoModifier);
-    webPage->event(&evpres);
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(webPage->mainFrame(), 5, 5));
-    QVERIFY(childScrollPosition == children.at(0)->scrollPosition());
-    QVERIFY(scrollPosition == webPage->mainFrame()->scrollPosition());
-
-    // 4th test
-    // call scrollRecursively twice over childs iframe
-    // verify scrolled == true first time
-    // verify parent's scroll == true second time
-    // verify parent and childs scroll position changed
-    childScrollPosition = children.at(0)->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), -10, -10));
-    QVERIFY(childScrollPosition != children.at(0)->scrollPosition());
-    scrollPosition = webPage->mainFrame()->scrollPosition();
-    QVERIFY(qtwebkit_webframe_scrollRecursively(children.at(0), -10, -10));
-    QVERIFY(scrollPosition != webPage->mainFrame()->scrollPosition());
-
-}
-
 QTEST_MAIN(tst_QWebFrame)
 #include "tst_qwebframe.moc"
diff --git a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 0e04acc074..55ee42abb6 100644
--- a/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/src/3rdparty/webkit/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1451,6 +1451,26 @@ void tst_QWebPage::inputMethods()
     variant = page->inputMethodQuery(Qt::ImCurrentSelection);
     QString selectionValue = variant.value<QString>();
     QCOMPARE(selectionValue, QString("eb"));
+
+    //Set selection with negative length
+    inputAttributes << QInputMethodEvent::Attribute(QInputMethodEvent::Selection, 6, -5, QVariant());
+    QInputMethodEvent eventSelection2("",inputAttributes);
+    page->event(&eventSelection2);
+
+    //ImAnchorPosition
+    variant = page->inputMethodQuery(Qt::ImAnchorPosition);
+    anchorPosition =  variant.toInt();
+    QCOMPARE(anchorPosition, 1);
+
+    //ImCursorPosition
+    variant = page->inputMethodQuery(Qt::ImCursorPosition);
+    cursorPosition =  variant.toInt();
+    QCOMPARE(cursorPosition, 6);
+
+    //ImCurrentSelection
+    variant = page->inputMethodQuery(Qt::ImCurrentSelection);
+    selectionValue = variant.value<QString>();
+    QCOMPARE(selectionValue, QString("tWebK"));
 #endif
 
     //ImSurroundingText
diff --git a/src/gui/dialogs/qfilesystemmodel.cpp b/src/gui/dialogs/qfilesystemmodel.cpp
index 6fd947ce3b..3757ad7295 100644
--- a/src/gui/dialogs/qfilesystemmodel.cpp
+++ b/src/gui/dialogs/qfilesystemmodel.cpp
@@ -1361,6 +1361,16 @@ QModelIndex QFileSystemModel::setRootPath(const QString &newPath)
     if (!showDrives && !newPathDir.exists())
         return d->index(rootPath());
 
+    //We remove the watcher on the previous path
+    if (!rootPath().isEmpty()) {
+        //This remove the watcher for the old rootPath
+        d->fileInfoGatherer.removePath(rootPath());
+        //This line "marks" the node as dirty, so the next fetchMore
+        //call on the path will ask the gatherer to install a watcher again
+        //But it doesn't re-fetch everything
+        d->node(rootPath())->populatedChildren = false;
+    }
+
     // We have a new valid root path
     d->rootDir = newPathDir;
     QModelIndex newRootIndex;
diff --git a/src/gui/graphicsview/qgraphicsitem_p.h b/src/gui/graphicsview/qgraphicsitem_p.h
index 669ae1b06c..eb5fac7da4 100644
--- a/src/gui/graphicsview/qgraphicsitem_p.h
+++ b/src/gui/graphicsview/qgraphicsitem_p.h
@@ -74,7 +74,8 @@ class QGraphicsItemPrivate;
 #ifndef QDECLARATIVELISTPROPERTY
 #define QDECLARATIVELISTPROPERTY
 template<typename T>
-struct QDeclarativeListProperty {
+class QDeclarativeListProperty {
+public:
     typedef void (*AppendFunction)(QDeclarativeListProperty<T> *, T*);
     typedef int (*CountFunction)(QDeclarativeListProperty<T> *);
     typedef T *(*AtFunction)(QDeclarativeListProperty<T> *, int);
diff --git a/src/gui/graphicsview/qgraphicswidget.cpp b/src/gui/graphicsview/qgraphicswidget.cpp
index 131ee879c4..654a432923 100644
--- a/src/gui/graphicsview/qgraphicswidget.cpp
+++ b/src/gui/graphicsview/qgraphicswidget.cpp
@@ -801,6 +801,7 @@ void QGraphicsWidget::setLayout(QGraphicsLayout *l)
     l->setParentLayoutItem(this);
     l->d_func()->reparentChildItems(this);
     l->invalidate();
+    emit layoutChanged();
 }
 
 /*!
diff --git a/src/gui/graphicsview/qgraphicswidget.h b/src/gui/graphicsview/qgraphicswidget.h
index 468a134418..730674cae9 100644
--- a/src/gui/graphicsview/qgraphicswidget.h
+++ b/src/gui/graphicsview/qgraphicswidget.h
@@ -82,6 +82,7 @@ class Q_GUI_EXPORT QGraphicsWidget : public QGraphicsObject, public QGraphicsLay
     Q_PROPERTY(Qt::WindowFlags windowFlags READ windowFlags WRITE setWindowFlags)
     Q_PROPERTY(QString windowTitle READ windowTitle WRITE setWindowTitle)
     Q_PROPERTY(QRectF geometry READ geometry WRITE setGeometry NOTIFY geometryChanged)
+    Q_PROPERTY(QGraphicsLayout* layout READ layout WRITE setLayout NOTIFY layoutChanged)
 public:
     QGraphicsWidget(QGraphicsItem *parent = 0, Qt::WindowFlags wFlags = 0);
     ~QGraphicsWidget();
@@ -176,6 +177,7 @@ public:
 
 Q_SIGNALS:
     void geometryChanged();
+    void layoutChanged();
 
 public Q_SLOTS:
     bool close();
diff --git a/src/gui/kernel/qwidget_p.h b/src/gui/kernel/qwidget_p.h
index 1bbc0572cf..555647c1df 100644
--- a/src/gui/kernel/qwidget_p.h
+++ b/src/gui/kernel/qwidget_p.h
@@ -233,6 +233,15 @@ struct QWExtra {
     uint activated : 1; // RWindowBase::Activated has been called
 
     /**
+     * If this bit is set, each native widget receives the signals from the
+     * Symbian control immediately before and immediately after draw ops are
+     * sent to the window server for this control:
+     *      void beginNativePaintEvent(const QRect &paintRect);
+     *      void endNativePaintEvent(const QRect &paintRect);
+     */
+    uint receiveNativePaintEvents : 1;
+
+    /**
      * Defines the behaviour of QSymbianControl::Draw.
      */
     enum NativePaintMode {
@@ -257,16 +266,7 @@ struct QWExtra {
         Default = Blit
     };
 
-    NativePaintMode nativePaintMode : 2;
-
-    /**
-     * If this bit is set, each native widget receives the signals from the
-     * Symbian control immediately before and immediately after draw ops are
-     * sent to the window server for this control:
-     *      void beginNativePaintEvent(const QRect &paintRect);
-     *      void endNativePaintEvent(const QRect &paintRect);
-     */
-    uint receiveNativePaintEvents : 1;
+    NativePaintMode nativePaintMode;
 
 #endif
 };
diff --git a/src/gui/styles/qs60style.cpp b/src/gui/styles/qs60style.cpp
index 65191a491d..000696c225 100644
--- a/src/gui/styles/qs60style.cpp
+++ b/src/gui/styles/qs60style.cpp
@@ -2626,14 +2626,22 @@ QRect QS60Style::subControlRect(ComplexControl control, const QStyleOptionComple
             const int frameThickness = spinbox->frame ? pixelMetric(PM_SpinBoxFrameWidth, spinbox, widget) : 0;
             const int buttonMargin = spinbox->frame ? 2 : 0;
             const int buttonContentWidth = QS60StylePrivate::pixelMetric(PM_ButtonIconSize) + 2 * buttonMargin;
+            // Spinbox buttons should be no larger than one fourth of total width.
+            // Thus, side-by-side buttons would take half of the total width.
+            const int maxSize = qMax(spinbox->rect.width() / 4, buttonContentWidth);
             QSize buttonSize;
-            buttonSize.setHeight(qMax(8, spinbox->rect.height() - frameThickness));
+            buttonSize.setHeight(qMin(maxSize, qMax(8, spinbox->rect.height() - frameThickness)));
             //width should at least be equal to height
             buttonSize.setWidth(qMax(buttonSize.height(), buttonContentWidth));
             buttonSize = buttonSize.expandedTo(QApplication::globalStrut());
 
-            const int y = frameThickness + spinbox->rect.y();
-            const int x = spinbox->rect.x() + spinbox->rect.width() - frameThickness - 2 * buttonSize.width();
+            // Normally spinbuttons should be side-by-side, but if spinbox grows very big
+            // and spinbuttons reach their maximum size, they can be deployed one top of the other.
+            const bool sideBySide = (buttonSize.height() * 2 < spinbox->rect.height()) ? false : true;
+            const int y = frameThickness + spinbox->rect.y() +  
+                          (spinbox->rect.height() - (sideBySide ? 1 : 2) * buttonSize.height()) / 2;
+            const int x = spinbox->rect.x() + 
+                          spinbox->rect.width() - frameThickness - (sideBySide ? 2 : 1) * buttonSize.width();
 
             switch (scontrol) {
                 case SC_SpinBoxUp:
@@ -2644,7 +2652,9 @@ QRect QS60Style::subControlRect(ComplexControl control, const QStyleOptionComple
                 case SC_SpinBoxDown:
                     if (spinbox->buttonSymbols == QAbstractSpinBox::NoButtons)
                         return QRect();
-                    ret = QRect(x + buttonSize.width(), y, buttonSize.width(), buttonSize.height());
+                    ret = QRect(x + (sideBySide ? buttonSize.width() : 0), 
+                                y + (sideBySide ? 0 : buttonSize.height()), 
+                                buttonSize.width(), buttonSize.height());
                     break;
                 case SC_SpinBoxEditField:
                     if (spinbox->buttonSymbols == QAbstractSpinBox::NoButtons)
@@ -2787,11 +2797,10 @@ QRect QS60Style::subElementRect(SubElement element, const QStyleOption *opt, con
             break;
         case SE_LineEditContents: {
                 // in S60 the input text box doesn't start from line Edit's TL, but
-                // a bit indented.
-                QRect lineEditRect = opt->rect;
-                const int adjustment = opt->rect.height() >> 2;
-                lineEditRect.adjust(adjustment, 0, 0, 0);
-                ret = lineEditRect;
+                // a bit indented (8 pixels).
+                const int KLineEditDefaultIndention = 8;
+                ret = visualRect(
+                    opt->direction, opt->rect, opt->rect.adjusted(KLineEditDefaultIndention, 0, 0, 0));
             }
             break;
         case SE_TabBarTearIndicator:
diff --git a/src/gui/text/qfontdatabase_s60.cpp b/src/gui/text/qfontdatabase_s60.cpp
index 87a73df2a3..fceb401d69 100644
--- a/src/gui/text/qfontdatabase_s60.cpp
+++ b/src/gui/text/qfontdatabase_s60.cpp
@@ -332,6 +332,11 @@ bool QFontDatabase::removeApplicationFont(int handle)
     return false;
 }
 
+bool QFontDatabase::removeAllApplicationFonts()
+{
+    return false;
+}
+
 bool QFontDatabase::supportsThreadedFontRendering()
 {
     return false;
diff --git a/src/gui/text/qfontengine_win.cpp b/src/gui/text/qfontengine_win.cpp
index 92fb7de579..eea196eb4c 100644
--- a/src/gui/text/qfontengine_win.cpp
+++ b/src/gui/text/qfontengine_win.cpp
@@ -39,6 +39,11 @@
 **
 ****************************************************************************/
 
+#if _WIN32_WINNT < 0x0500
+#undef _WIN32_WINNT
+#define _WIN32_WINNT 0x0500
+#endif
+
 #include "qfontengine_p.h"
 #include "qtextengine_p.h"
 #include <qglobal.h>
diff --git a/src/s60installs/bwins/QtGuiu.def b/src/s60installs/bwins/QtGuiu.def
index 8e758d0ad3..6a4f07b7ac 100644
--- a/src/s60installs/bwins/QtGuiu.def
+++ b/src/s60installs/bwins/QtGuiu.def
@@ -12601,4 +12601,5 @@ EXPORTS
 	?setPixelFormat@QEglProperties@@QAEXW4Format@QImage@@@Z @ 12600 NONAME ABSENT ; void QEglProperties::setPixelFormat(enum QImage::Format)
 	?currentContext@QEglContext@@CAPAV1@W4API@QEgl@@@Z @ 12601 NONAME ABSENT ; class QEglContext * QEglContext::currentContext(enum QEgl::API)
 	?errorString@QEglContext@@SA?AVQString@@H@Z @ 12602 NONAME ABSENT ; class QString QEglContext::errorString(int)
+	?removeAllApplicationFonts@QFontDatabase@@SA_NXZ @12603 ; NONAME ; bool QFontDatabase::removeAllApplicationFonts()
 
diff --git a/src/s60installs/eabi/QtGuiu.def b/src/s60installs/eabi/QtGuiu.def
index 373f66d50f..a3fc452297 100644
--- a/src/s60installs/eabi/QtGuiu.def
+++ b/src/s60installs/eabi/QtGuiu.def
@@ -11805,4 +11805,5 @@ EXPORTS
 	_ZN24QImagePixmapCleanupHooks34executePixmapDataModificationHooksEP11QPixmapData @ 11804 NONAME
 	_ZN9QS60Style10timerEventEP11QTimerEvent @ 11805 NONAME
 	_ZN9QS60Style11eventFilterEP7QObjectP6QEvent @ 11806 NONAME
+	_ZN13QFontDatabase25removeAllApplicationFontsEv @ 11807 NONAME