Updated WebKit from /home/shausman/src/webkit/trunk to qtwebkit-4.6-snapshot-13072009 ( b2abc0c271880b8135507861056af497f895adf5 )

Changes in WebKit/qt since the last update:

++ b/WebKit/qt/ChangeLog
2009-07-13  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Fix qdoc warnings for QWebPage::shouldInterruptJavaScript() and mention
        how to re-implement it.

        * Api/qwebpage.cpp:

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Fix crash with plugins when the plugin stream is cancelled.

        Similar to r26667 handle the case where didReceiveResponse on the
        plugin view results in failure to set up the stream and
        setMainDocumentError being called instead. This will set the
        m_pluginView back to 0 and we need check for it before calling
        didReceiveData.

        This was triggered by consecutive execution of
        LayoutTests/plugins/return-error-from-new-stream-callback-in-full-frame-plugin.html
        followed by LayoutTests/scrollbars/scrollbar-crash-on-refresh.html

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::committedLoad):

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Added QWebDatabase::removeAllDatabases, as a way to delete all
        databases from the offline storage path.

        Used by the Qt DRT.

        * Api/qwebdatabase.cpp:
        (QWebDatabase::removeAllDatabases):
        * Api/qwebdatabase.h:

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Added loadStarted() and loadFinished() signals to QWebFrame,
        to allow load tracking of individual frames, as opposed to
        QWebPage's loadStarted/loadFinished signals that are emitted
        whenever _any_ child frame loads/finishes.

        * Api/qwebframe.cpp: Document new signals.
        * Api/qwebframe.h: Add new signals.
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::setFrame): Connect new signals.

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Add hooks for the GCController JavaScript interface needed by the
        Qt DRT.

        Fixed sort order of includes in qwebframe.cpp.

        * Api/qwebframe.cpp:
        (qt_drt_javaScriptObjectsCount):
        (qt_drt_garbageCollector_collect):
        (qt_drt_garbageCollector_collectOnAlternateThread):

2009-07-13  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Ariya Hidayat.

        Add hooks for the GCController JavaScript interface needed by the
        Qt DRT.

        Fixed sort order of includes in qwebframe.cpp.

        * Api/qwebframe.cpp:
        (qt_drt_javaScriptObjectsCount):
        (qt_drt_garbageCollector_collect):
        (qt_drt_garbageCollector_collectOnAlternateThread):

2009-07-12  Brent Fulgham  <bfulgham@gmail.com>

        Speculative build fix after http://trac.webkit.org/changeset/45786.

        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::addMessageToConsole):
        * WebCoreSupport/ChromeClientQt.h:

2009-07-10  Yael Aharon  <yael.aharon@nokia.com>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=27136

        Fix a bug where webkit hangs when executing infinite JavaScript loop.

        * Api/qwebpage.cpp:
        (QWebPage::shouldInterruptJavaScript):
        * Api/qwebpage.h:
        * WebCoreSupport/ChromeClientQt.cpp:
        (WebCore::ChromeClientQt::shouldInterruptJavaScript):
        * tests/qwebpage/tst_qwebpage.cpp:
        (JSTestPage::JSTestPage):
        (JSTestPage::shouldInterruptJavaScript):
        (tst_QWebPage::infiniteLoopJS):

2009-07-10  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Holger Freyther.

        https://bugs.webkit.org/show_bug.cgi?id=27108

        Fix crash when in frame tree of a new frame before the new frame
        has been installed in the frame tree, similar to r35088.

        After calling Frame::init() the frame it may have been removed from the
        frame tree again through JavaScript. Detect this by checking the page()
        afterwards.

        To make this check safe the Frame::init() code was moved into
        QWebFrameData's constructor, where a RefPtr holds a reference to the frame.
        After the check back in FrameLoaderClientQt we would hold the single
        reference left and after release() the frame, its frame loader, its
        client as well as the QWebFrame should have disappeared then.

        * Api/qwebframe.cpp:
        (QWebFramePrivate::init): Only call Frame::init here, the rest is
        done in QWebFrameData's constructor.
        (QWebFrame::QWebFrame):
        * Api/qwebframe_p.h: Adjust declaration.
        (QWebFrameData::QWebFrameData): Create the Frame here.
        * Api/qwebpage.cpp:
        (QWebPagePrivate::createMainFrame): Adjust and simplify
        to new QWebFrame constructor.
        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::createFrame): Adjust to
        new QWebFrame construction using QWebFrameData and add the
        check like in r35088.

2009-07-09  Beth Dakin  <bdakin@apple.com>

        Reviewed by Dave Hyatt.

        Make Widget RefCounted to fix:

        <rdar://problem/7038831> REGRESSION (TOT): In Mail, a crash occurs
        at WebCore::Widget::afterMouseDown() after clicking To Do's close
        box
        <rdar://problem/6978804> WER #16: Repro Access Violation in
        WebCore::PluginView::bindingInstance (1310178023)
        -and-
        <rdar://problem/6991251> WER #13: Crash in WebKit!
        WebCore::PluginView::performRequest+203 (1311461169)

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::createPlugin):
        (WebCore::FrameLoaderClientQt::createJavaAppletWidget):
        * WebCoreSupport/FrameLoaderClientQt.h:

2009-07-08  Pradeepto Bhattacharya  <pradeepto@kde.org>

        Reviewed by Ariya Hidayat.

        Build fix.

        * WebCoreSupport/FrameLoaderClientQt.h: Removed the slot slotCallPolicyFunction().

2009-07-08  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Tor Arne Vestbø.

        https://bugs.webkit.org/show_bug.cgi?id=27080

        Fix DRT instability issues with fast/loader/submit-form-while-parsing-2.html

        When the form is submitted we call the policy function in the frame
        loader delayed with a queued connection. That queued connection
        sometimes interferes with the javascript timeout set in the testcase.

        Eliminate the entire delayed policy function mechanism and instead always
        call back directly, like in the other ports. In most other places we called
        the slot directly anyway.

        * WebCoreSupport/FrameLoaderClientQt.cpp:
        (WebCore::FrameLoaderClientQt::FrameLoaderClientQt): Remove m_policyFunction.
        (WebCore::FrameLoaderClientQt::callPolicyFunction): Call the policy function directly instead
        of emitting the queued signal.
        (WebCore::FrameLoaderClientQt::cancelPolicyCheck): Call callPolicyFunction directly.
        (WebCore::FrameLoaderClientQt::dispatchWillSubmitForm): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForMIMEType): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNewWindowAction): Ditto.
        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction): Ditto.
        * WebCoreSupport/FrameLoaderClientQt.h: Remove m_policyFunction as well as the associated
        signal.

2009-07-07  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Holger Freyther.

        Add Qt DRT hook for clearing the frame name.

        * Api/qwebframe.cpp:
        (qt_drt_clearFrameName):

2009-07-05  Simon Hausmann  <hausmann@webkit.org>

        Reviewed by Holger Freyther.

        Fix two qdoc warnings.

        Added missing \property for QWebFrame::hasFocus and added \a
        tag for pos of QWebPage::frameAt.

        * Api/qwebframe.cpp:
        * Api/qwebpage.cpp:

2009-07-04  Holger Hans Peter Freyther  <zecke@selfish.org>

        Reviewed by Simon Hausmann.

        Use the recently introduced FocusController::setFocused

        Use the recently introduced FocusController::setFocused
        in the Qt platform. The SelectionController will be updated
        from within the FocusController now.

        * Api/qwebpage.cpp:
        (QWebPagePrivate::focusInEvent):
        (QWebPagePrivate::focusOutEvent):

2009-07-02  Simon Hausmann  <simon.hausmann@nokia.com>

        Reviewed by Ariya Hidayat.

        Improve documentation of QWebFrame::setFocus and hasFocus()
        Added missing Q_PROPERTY for QWebFrame::hasFocus.

        * Api/qwebframe.cpp: Clarify the docs.
        * Api/qwebframe.h: add Q_PROPERTY(focus).

2009-07-02  Joe Ligman  <joseph.ligman@nokia.com>

        Reviewed by Simon Hausmann.

        Bug 26855: [Qt] New methods for QWebFrame to check and set focus.

        Added new public methods QWebFrame::hasFocus() and QWebFrame::setFocus()
        Added auto test.

        * Api/qwebframe.cpp:
        (QWebFrame::hasFocus):
        (QWebFrame::setFocus):
        * Api/qwebframe.h:
        * tests/qwebframe/tst_qwebframe.cpp:

2009-07-01  Robert Hogan <robert@roberthogan.net>

        Reviewed by NOBODY.

        Fix Qt segfault when javascript disabled.
        If clients call addToJavaScriptWindowObject even though JavascriptEnabled is false
        webkit will segfault on the assert:
          ASSERTION FAILED: _rootObject
          (../../../WebCore/bridge/runtime.cpp:52
          JSC::Bindings::Instance::Instance(WTF::PassRefPtr<JSC::Bindings::RootObject>))
        Fix is to ensure JavaScript is enabled when client calls addToJavaScriptWindowObject.

        https://bugs.webkit.org/show_bug.cgi?id=26906

        * Api/qwebframe.cpp:
        (QWebFrame::addToJavaScriptWindowObject):

2009-07-01  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        [Qt] Move some API headers from WebCore.pro to headers.pri so that they
        get installed when running make install from the build directory.

        * Api/headers.pri:

2009-07-01  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>

        Reviewed by Simon Hausmann.

        Fixed robotized QtLauncher to work when there is no index.html in the user's home.

        * QtLauncher/main.cpp:
        (main):

2009-06-30  Brian Weinstein  <bweinstein@apple.com>

        Reviewed by Adam Roben.

        Renamed scrollbarUnderPoint to scrollbarAtPoint to follow conventions.

        * Api/qwebpage.cpp:
        (QWebPage::swallowContextMenuEvent):

2009-06-30  Joe Ligman  <joseph.ligman@nokia.com>

        Reviewed by Adam Treat.

        Bug 26422: [Qt] QWebPagePrivate::frameAt calculates wrong frame

        Added a public method QWebPage::frameAt
        Removed QWebPagePrivate::frameAt, which calcuated the wrong frame
        Modified QWebPage::swallowContextMenuEvent to use the new frameAt method
        New test case for frameAt added to tst_qwebpage.cpp

        * Api/qwebpage.cpp:
        (QWebPage::frameAt):
        (QWebPage::swallowContextMenuEvent):
        * Api/qwebpage.h:
        * Api/qwebpage_p.h:
        * tests/qwebpage/frametest/iframe.html: Added.
        * tests/qwebpage/frametest/iframe2.html: Added.
        * tests/qwebpage/frametest/iframe3.html: Added.
        * tests/qwebpage/tst_qwebpage.cpp:
        (frameAtHelper):
        (tst_QWebPage::frameAt):
        * tests/qwebpage/tst_qwebpage.qrc:

2009-06-30  Jakub Wieczorek  <faw217@gmail.com>

        Reviewed by Simon Hausmann.

        Add QWebFrame::baseUrl() function that exposes the base URL of a frame.
        Autotests included.

        * Api/qwebframe.cpp:
        (QWebFrame::baseUrl):
        * Api/qwebframe.h:
        * tests/qwebframe/tst_qwebframe.cpp:

27 files changed, 568 insertions, 244 deletions

diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index e155754c97..78efa45209 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -103,7 +103,7 @@ namespace WebCore {
 
         virtual void setResizable(bool) = 0;
         
-        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) = 0;
+        virtual void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) = 0;
 
         virtual bool canRunBeforeUnloadConfirmPanel() = 0;
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame) = 0;
@@ -168,6 +168,9 @@ namespace WebCore {
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*) = 0;
+        
+        virtual void formDidFocus(const Node*) { };
+        virtual void formDidBlur(const Node*) { };
 
         virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 1a654ab491..45ff059dfc 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -128,18 +128,6 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case ErrorMessageLevel:
             levelString = "ERROR";
             break;
-        case ObjectMessageLevel:
-            levelString = "OBJECT";
-            break;
-        case TraceMessageLevel:
-            levelString = "TRACE";
-            break;
-        case StartGroupMessageLevel:
-            levelString = "START GROUP";
-            break;
-        case EndGroupMessageLevel:
-            levelString = "END GROUP";
-            break;
         default:
             ASSERT_NOT_REACHED();
             levelString = "UNKNOWN";
@@ -149,16 +137,16 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
     printf("%s %s:", sourceString, levelString);
 }
 
-void Console::addMessage(MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+void Console::addMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     Page* page = this->page();
     if (!page)
         return;
 
     if (source == JSMessageSource || source == WMLMessageSource)
-        page->chrome()->client()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
+        page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
-    page->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
+    page->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -169,7 +157,8 @@ void Console::addMessage(MessageSource source, MessageLevel level, const String&
     printf(" %s\n", message.utf8().data());
 }
 
-void Console::addMessage(MessageLevel level, ScriptCallStack* callStack, bool acceptNoArguments) {
+void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack* callStack, bool acceptNoArguments)
+{
     Page* page = this->page();
     if (!page)
         return;
@@ -181,9 +170,9 @@ void Console::addMessage(MessageLevel level, ScriptCallStack* callStack, bool ac
 
     String message;
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
-        page->chrome()->client()->addMessageToConsole(JSMessageSource, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
+        page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
-    page->inspectorController()->addMessageToConsole(JSMessageSource, level, callStack);
+    page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack);
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -207,7 +196,7 @@ void Console::debug(ScriptCallStack* callStack)
 
 void Console::error(ScriptCallStack* callStack)
 {
-    addMessage(ErrorMessageLevel, callStack);
+    addMessage(LogMessageType, ErrorMessageLevel, callStack);
 }
 
 void Console::info(ScriptCallStack* callStack)
@@ -217,12 +206,12 @@ void Console::info(ScriptCallStack* callStack)
 
 void Console::log(ScriptCallStack* callStack)
 {
-    addMessage(LogMessageLevel, callStack);
+    addMessage(LogMessageType, LogMessageLevel, callStack);
 }
 
 void Console::dir(ScriptCallStack* callStack)
 {
-    addMessage(ObjectMessageLevel, callStack);
+    addMessage(ObjectMessageType, LogMessageLevel, callStack);
 }
 
 void Console::dirxml(ScriptCallStack* callStack)
@@ -233,7 +222,7 @@ void Console::dirxml(ScriptCallStack* callStack)
 
 void Console::trace(ScriptCallStack* callStack)
 {
-    addMessage(TraceMessageLevel, callStack, true);
+    addMessage(TraceMessageType, LogMessageLevel, callStack, true);
 
     if (!shouldPrintExceptions())
         return;
@@ -251,7 +240,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
         return;
 
     // FIXME: <https://bugs.webkit.org/show_bug.cgi?id=19135> It would be nice to prefix assertion failures with a message like "Assertion failed: ".
-    addMessage(ErrorMessageLevel, callStack, true);
+    addMessage(LogMessageType, ErrorMessageLevel, callStack, true);
 }
 
 void Console::count(ScriptCallStack* callStack)
@@ -349,7 +338,7 @@ void Console::timeEnd(const String& title, ScriptCallStack* callStack)
     String message = title + String::format(": %.0fms", elapsed);
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
-    page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+    page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
 }
 
 void Console::group(ScriptCallStack* callStack)
@@ -372,7 +361,7 @@ void Console::groupEnd()
 
 void Console::warn(ScriptCallStack* callStack)
 {
-    addMessage(WarningMessageLevel, callStack);
+    addMessage(LogMessageType, WarningMessageLevel, callStack);
 }
 
 static bool printExceptions = false;
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 79396ea923..64e596d303 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -59,16 +59,19 @@ namespace WebCore {
         OtherMessageSource
     };
 
+    enum MessageType {
+        LogMessageType,
+        ObjectMessageType,
+        TraceMessageType,
+        StartGroupMessageType,
+        EndGroupMessageType
+    };
+
     enum MessageLevel {
         TipMessageLevel,
         LogMessageLevel,
         WarningMessageLevel,
-        ErrorMessageLevel,
-        // FIXME: the remaining levels should become a new MessageType enum.
-        ObjectMessageLevel,
-        TraceMessageLevel,
-        StartGroupMessageLevel,
-        EndGroupMessageLevel
+        ErrorMessageLevel
     };
 
     class Console : public RefCounted<Console> {
@@ -78,7 +81,7 @@ namespace WebCore {
         Frame* frame() const;
         void disconnectFrame();
 
-        void addMessage(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+        void addMessage(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
 
         void debug(ScriptCallStack*);
         void error(ScriptCallStack*);
@@ -108,7 +111,7 @@ namespace WebCore {
 
     private:
         inline Page* page() const;
-        void addMessage(MessageLevel, ScriptCallStack*, bool acceptNoArguments = false);
+        void addMessage(MessageType, MessageLevel, ScriptCallStack*, bool acceptNoArguments = false);
 
         Console(Frame*);
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index eb1981c629..8e64fe3ff0 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -634,7 +634,7 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
         if (!timer->targetOrigin()->isSameSchemeHostPort(document()->securityOrigin())) {
             String message = String::format("Unable to post message to %s. Recipient has origin %s.\n", 
                 timer->targetOrigin()->toString().utf8().data(), document()->securityOrigin()->toString().utf8().data());
-            console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 0, String());
+            console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 0, String());
             return;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 942facca31..bfdebd4a39 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -349,8 +349,9 @@ module window {
         attribute HTMLBodyElementConstructor HTMLBodyElement;
         attribute HTMLButtonElementConstructor HTMLButtonElement;
         attribute HTMLCanvasElementConstructor HTMLCanvasElement;
-        attribute HTMLDataGridElementConstructor HTMLDataGridElement;
-        attribute HTMLDataGridColElementConstructor HTMLDataGridColElement;
+        attribute [Conditional=DATAGRID] HTMLDataGridElementConstructor HTMLDataGridElement;
+        attribute [Conditional=DATAGRID] HTMLDataGridCellElementConstructor HTMLDataGridCellElement;
+        attribute [Conditional=DATAGRID] HTMLDataGridColElementConstructor HTMLDataGridColElement;
         attribute HTMLDListElementConstructor HTMLDListElement;
         attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
         attribute HTMLDivElementConstructor HTMLDivElement;
@@ -460,6 +461,10 @@ module window {
         attribute [JSCCustomGetter] WorkerConstructor Worker; // Usable with the new operator
 #endif
 
+#if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
+        attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index 8f0b420c79..3f0296ec14 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -154,6 +154,8 @@ EventHandler::EventHandler(Frame* frame)
     , m_capturingMouseEventsNode(0)
     , m_clickCount(0)
     , m_mouseDownTimestamp(0)
+    , m_useLatchedWheelEventNode(false)
+    , m_widgetIsLatched(false)
 #if PLATFORM(MAC)
     , m_mouseDownView(nil)
     , m_sendingEventToSubview(false)
@@ -193,6 +195,7 @@ void EventHandler::clear()
     m_mousePressed = false;
     m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
+    m_latchedWheelEventNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -395,7 +398,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     m_mouseDownMayStartAutoscroll = m_mouseDownMayStartSelect || 
         (m_mousePressNode && m_mousePressNode->renderBox() && m_mousePressNode->renderBox()->canBeProgramaticallyScrolled(true));
 
-   return swallowEvent;
+    return swallowEvent;
 }
 
 bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& event)
@@ -766,7 +769,7 @@ HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool all
         result = widgetHitTestResult;
 
         if (testScrollbars == ShouldHitTestScrollbars) {
-            Scrollbar* eventScrollbar = view->scrollbarUnderPoint(point);
+            Scrollbar* eventScrollbar = view->scrollbarAtPoint(point);
             if (eventScrollbar)
                 result.setScrollbar(eventScrollbar);
         }
@@ -967,7 +970,7 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
             // If the link is editable, then we need to check the settings to see whether or not the link should be followed
             if (editable) {
                 ASSERT(m_frame->settings());
-                switch(m_frame->settings()->editableLinkBehavior()) {
+                switch (m_frame->settings()->editableLinkBehavior()) {
                     default:
                     case EditableLinkDefaultBehavior:
                     case EditableLinkAlwaysLive:
@@ -1159,7 +1162,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
             invalidateClick();
             return true;
         }
-   }
+    }
 #endif
 
     m_clickCount = mouseEvent.clickCount();
@@ -1205,7 +1208,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         }
 
         FrameView* view = m_frame->view();
-        Scrollbar* scrollbar = view ? view->scrollbarUnderPoint(mouseEvent.pos()) : 0;
+        Scrollbar* scrollbar = view ? view->scrollbarAtPoint(mouseEvent.pos()) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1297,7 +1300,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
 
     // Send events right to a scrollbar if the mouse is pressed.
     if (m_lastScrollbarUnderMouse && m_mousePressed)
-        return m_lastScrollbarUnderMouse->mouseMoved(m_lastScrollbarUnderMouse->transformEvent(mouseEvent));
+        return m_lastScrollbarUnderMouse->mouseMoved(mouseEvent);
 
     // Treat mouse move events while the mouse is pressed as "read-only" in prepareMouseEvent
     // if we are allowed to select.
@@ -1319,7 +1322,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
         if (FrameView* view = m_frame->view())
-            scrollbar = view->scrollbarUnderPoint(mouseEvent.pos());
+            scrollbar = view->scrollbarAtPoint(mouseEvent.pos());
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
@@ -1349,7 +1352,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
             swallowEvent |= passMouseMoveEventToSubframe(mev, newSubframe.get(), hoveredNode);
     } else {
         if (scrollbar && !m_mousePressed)
-            scrollbar->mouseMoved(scrollbar->transformEvent(mouseEvent)); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
+            scrollbar->mouseMoved(mouseEvent); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
         if (Page* page = m_frame->page()) {
             if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !page->mainFrame()->eventHandler()->panScrollInProgress()) {
                 if (FrameView* view = m_frame->view())
@@ -1715,16 +1718,38 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         return false;
     IntPoint vPoint = view->windowToContents(e.pos());
 
-    HitTestRequest request(HitTestRequest::ReadOnly);
-    HitTestResult result(vPoint);
-    doc->renderView()->layer()->hitTest(request, result);
-    Node* node = result.innerNode();
+    Node* node;
+    bool isOverWidget;
+    bool didSetLatchedNode = false;
+    
+    if (m_useLatchedWheelEventNode) {
+        if (!m_latchedWheelEventNode) {
+            HitTestRequest request(HitTestRequest::ReadOnly);
+            HitTestResult result(vPoint);
+            doc->renderView()->layer()->hitTest(request, result);
+            m_latchedWheelEventNode = result.innerNode();
+            m_widgetIsLatched = result.isOverWidget();
+            didSetLatchedNode = true;
+        }
+        
+        node = m_latchedWheelEventNode.get();
+        isOverWidget = m_widgetIsLatched;
+    } else {
+        if (m_latchedWheelEventNode)
+            m_latchedWheelEventNode = 0;
+        
+        HitTestRequest request(HitTestRequest::ReadOnly);
+        HitTestResult result(vPoint);
+        doc->renderView()->layer()->hitTest(request, result);
+        node = result.innerNode();
+        isOverWidget = result.isOverWidget();
+    }
     
     if (node) {
         // Figure out which view to send the event to.
         RenderObject* target = node->renderer();
         
-        if (result.isOverWidget() && target && target->isWidget()) {
+        if (isOverWidget && target && target->isWidget()) {
             Widget* widget = static_cast<RenderWidget*>(target)->widget();
 
             if (widget && passWheelEventToWidget(e, widget)) {
@@ -2027,7 +2052,7 @@ void EventHandler::handleKeyboardSelectionMovement(KeyboardEvent* event)
     
 void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
 {
-   if (event->type() == eventNames().keydownEvent) {
+    if (event->type() == eventNames().keydownEvent) {
         m_frame->editor()->handleKeyboardEvent(event);
         if (event->defaultHandled())
             return;
@@ -2037,14 +2062,14 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
        // provides KB navigation and selection for enhanced accessibility users
        if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
            handleKeyboardSelectionMovement(event);       
-   }
-   if (event->type() == eventNames().keypressEvent) {
+    }
+    if (event->type() == eventNames().keypressEvent) {
         m_frame->editor()->handleKeyboardEvent(event);
         if (event->defaultHandled())
             return;
         if (event->charCode() == ' ')
             defaultSpaceEventHandler(event);
-   }
+    }
 }
 
 bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLocation) const
@@ -2102,6 +2127,9 @@ void EventHandler::dragSourceEndedAt(const PlatformMouseEvent& event, DragOperat
     }
     freeClipboard();
     dragState().m_dragSrc = 0;
+    // In case the drag was ended due to an escape key press we need to ensure
+    // that consecutive mousemove events don't reinitiate the drag and drop.
+    m_mouseDownMayStartDrag = false;
 }
     
 // returns if we should continue "default processing", i.e., whether eventhandler canceled
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index f76716e694..d5c0b972f8 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -332,6 +332,10 @@ private:
     double m_mouseDownTimestamp;
     PlatformMouseEvent m_mouseDown;
 
+    bool m_useLatchedWheelEventNode;
+    RefPtr<Node> m_latchedWheelEventNode;
+    bool m_widgetIsLatched;
+    
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index 8dad84650d..817801c27c 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -58,6 +58,7 @@ using namespace HTMLNames;
 FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
+    , m_isFocused(false)
 {
 }
 
@@ -66,16 +67,20 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     if (m_focusedFrame == frame)
         return;
 
-    if (m_focusedFrame && m_focusedFrame->view()) {
-        m_focusedFrame->selection()->setFocused(false);
-        m_focusedFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
-    }
+    RefPtr<Frame> oldFrame = m_focusedFrame;
+    RefPtr<Frame> newFrame = frame;
 
-    m_focusedFrame = frame;
+    m_focusedFrame = newFrame;
 
-    if (m_focusedFrame && m_focusedFrame->view()) {
-        m_focusedFrame->selection()->setFocused(true);
-        m_focusedFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+    // Now that the frame is updated, fire events and update the selection focused states of both frames.
+    if (oldFrame && oldFrame->view()) {
+        oldFrame->selection()->setFocused(false);
+        oldFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+    }
+
+    if (newFrame && newFrame->view() && isFocused()) {
+        newFrame->selection()->setFocused(true);
+        newFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
     }
 }
 
@@ -86,6 +91,19 @@ Frame* FocusController::focusedOrMainFrame()
     return m_page->mainFrame();
 }
 
+void FocusController::setFocused(bool focused)
+{
+    if (isFocused() == focused)
+        return;
+    
+    m_isFocused = focused;
+    
+    if (m_focusedFrame && m_focusedFrame->view()) {
+        m_focusedFrame->selection()->setFocused(focused);
+        m_focusedFrame->document()->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+    }
+}
+
 static Node* deepFocusableNode(FocusDirection direction, Node* node, KeyboardEvent* event)
 {
     // The node we found might be a HTMLFrameOwnerElement, so descend down the frame tree until we find either:
@@ -322,7 +340,7 @@ void FocusController::setActive(bool active)
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
     
-    if (m_focusedFrame)
+    if (m_focusedFrame && isFocused())
         m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.h b/src/3rdparty/webkit/WebCore/page/FocusController.h
index f4a66320a6..33debf1569 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.h
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.h
@@ -53,10 +53,14 @@ namespace WebCore {
         void setActive(bool);
         bool isActive() const { return m_isActive; }
 
+        void setFocused(bool);
+        bool isFocused() const { return m_isFocused; }
+
     private:
         Page* m_page;
         RefPtr<Frame> m_focusedFrame;
         bool m_isActive;
+        bool m_isFocused;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index 8905bd9cbf..870bd2ae49 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -793,7 +793,7 @@ String Frame::jsStatusBarText() const
 
 String Frame::jsDefaultStatusBarText() const
 {
-   return m_kjsDefaultStatusBarText;
+    return m_kjsDefaultStatusBarText;
 }
 
 void Frame::setNeedsReapplyStyles()
@@ -1771,7 +1771,7 @@ void Frame::createView(const IntSize& viewportSize,
         frameView->setParentVisible(true);
 
     if (ownerRenderer())
-        ownerRenderer()->setWidget(frameView.get());
+        ownerRenderer()->setWidget(frameView);
 
     if (HTMLFrameOwnerElement* owner = ownerElement())
         view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.cpp b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
index 41f2c5cc39..d57e845eae 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.cpp
@@ -111,7 +111,6 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
-    , m_lockedToAnchor(false)
 {
     init();
 }
@@ -185,7 +184,7 @@ void FrameView::reset()
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
-    m_lockedToAnchor = false;
+    m_maintainScrollPositionAnchor = 0;
 }
 
 bool FrameView::isFrameView() const 
@@ -417,20 +416,18 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void FrameView::updateCompositingLayers(CompositingUpdate updateType)
+void FrameView::updateCompositingLayers()
 {
     RenderView* view = m_frame->contentRenderer();
-    if (view && view->compositor()) {
-        // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
-        view->compositor()->cacheAcceleratedCompositingEnabledFlag();
-    }
-    
-    if (!view || !view->usesCompositing())
+    if (!view)
         return;
 
-    if (updateType == ForcedCompositingUpdate)
-        view->compositor()->setCompositingLayersNeedUpdate();
+    // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
+    view->compositor()->cacheAcceleratedCompositingEnabledFlag();
     
+    if (!view->usesCompositing())
+        return;
+
     view->compositor()->updateCompositingLayers();
 }
 
@@ -624,7 +621,9 @@ void FrameView::layout(bool allowSubtree)
 
     // Now update the positions of all layers.
     beginDeferredRepaints();
-    layer->updateLayerPositions(m_doFullRepaint);
+    layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
+                                | RenderLayer::CheckForRepaint
+                                | RenderLayer::UpdateCompositingLayers);
     endDeferredRepaints();
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -666,9 +665,6 @@ void FrameView::layout(bool allowSubtree)
         ASSERT(m_enqueueEvents);
     }
 
-    if (lockedToAnchor())
-        m_frame->loader()->gotoAnchor();
-
     m_nestedLayoutCount--;
 }
 
@@ -751,11 +747,27 @@ void FrameView::restoreScrollbar()
     setScrollbarsSuppressed(false);
 }
 
+void FrameView::maintainScrollPositionAtAnchor(Node* anchorNode)
+{
+    m_maintainScrollPositionAnchor = anchorNode;
+    if (!m_maintainScrollPositionAnchor)
+        return;
+
+    // We need to update the layout before scrolling, otherwise we could
+    // really mess things up if an anchor scroll comes at a bad moment.
+    m_frame->document()->updateStyleIfNeeded();
+    // Only do a layout if changes have occurred that make it necessary.
+    if (m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
+        layout();
+    else
+        scrollToAnchor();
+}
+
 void FrameView::scrollRectIntoViewRecursively(const IntRect& r)
 {
     bool wasInProgrammaticScroll = m_inProgrammaticScroll;
     m_inProgrammaticScroll = true;
-    setLockedToAnchor(false);
+    m_maintainScrollPositionAnchor = 0;
     ScrollView::scrollRectIntoViewRecursively(r);
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
@@ -764,7 +776,7 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
 {
     bool wasInProgrammaticScroll = m_inProgrammaticScroll;
     m_inProgrammaticScroll = true;
-    setLockedToAnchor(false);
+    m_maintainScrollPositionAnchor = 0;
     ScrollView::setScrollPosition(scrollPoint);
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
@@ -1118,6 +1130,27 @@ void FrameView::resumeScheduledEvents()
     ASSERT(m_scheduledEvents.isEmpty() || m_enqueueEvents);
 }
 
+void FrameView::scrollToAnchor()
+{
+    RefPtr<Node> anchorNode = m_maintainScrollPositionAnchor;
+    if (!anchorNode)
+        return;
+
+    if (!anchorNode->renderer())
+        return;
+
+    IntRect rect;
+    if (anchorNode != m_frame->document())
+        rect = anchorNode->getRect();
+
+    // Scroll nested layers and frames to reveal the anchor.
+    // Align to the top and to the closest side (this matches other browsers).
+    anchorNode->renderer()->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
+
+    // scrollRectToVisible can call into scrollRectIntoViewRecursively(), which resets m_maintainScrollPositionAnchor.
+    m_maintainScrollPositionAnchor = anchorNode;
+}
+
 bool FrameView::updateWidgets()
 {
     if (m_nestedLayoutCount > 1 || !m_widgetUpdateSet || m_widgetUpdateSet->isEmpty())
@@ -1161,7 +1194,9 @@ void FrameView::performPostLayoutTasks()
         if (updateWidgets())
             break;
     }
-    
+
+    scrollToAnchor();
+
     resumeScheduledEvents();
 
     if (!root->printing()) {
@@ -1351,7 +1386,7 @@ void FrameView::setWasScrolledByUser(bool wasScrolledByUser)
 {
     if (m_inProgrammaticScroll)
         return;
-    setLockedToAnchor(false);
+    m_maintainScrollPositionAnchor = 0;
     m_wasScrolledByUser = wasScrolledByUser;
 }
 
@@ -1447,11 +1482,13 @@ void FrameView::layoutIfNeededRecursive()
     if (needsLayout())
         layout();
 
-    const HashSet<Widget*>* viewChildren = children();
-    HashSet<Widget*>::const_iterator end = viewChildren->end();
-    for (HashSet<Widget*>::const_iterator current = viewChildren->begin(); current != end; ++current)
-        if ((*current)->isFrameView())
-            static_cast<FrameView*>(*current)->layoutIfNeededRecursive();
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = (*current).get();
+        if (widget->isFrameView())
+            static_cast<FrameView*>(widget)->layoutIfNeededRecursive();
+    }
 
     // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
     // painting, so we need to flush out any deferred repaints too.
@@ -1517,4 +1554,142 @@ void FrameView::adjustPageHeight(float *newBottom, float oldTop, float oldBottom
         *newBottom = oldBottom;
 }
 
+IntRect FrameView::convertFromRenderer(const RenderObject* renderer, const IntRect& rendererRect) const
+{
+    IntRect rect = renderer->localToAbsoluteQuad(FloatRect(rendererRect)).enclosingBoundingBox();
+
+    // Convert from page ("absolute") to FrameView coordinates.
+    rect.move(-scrollX(), -scrollY());
+
+    return rect;
+}
+
+IntRect FrameView::convertToRenderer(const RenderObject* renderer, const IntRect& viewRect) const
+{
+    IntRect rect = viewRect;
+    
+    // Convert from FrameView coords into page ("absolute") coordinates.
+    rect.move(scrollX(), scrollY());
+
+    // FIXME: we don't have a way to map an absolute rect down to a local quad, so just
+    // move the rect for now.
+    rect.setLocation(roundedIntPoint(renderer->absoluteToLocal(rect.location(), false, true /* use transforms */)));
+    return rect;
+}
+
+IntPoint FrameView::convertFromRenderer(const RenderObject* renderer, const IntPoint& rendererPoint) const
+{
+    IntPoint point = roundedIntPoint(renderer->localToAbsolute(rendererPoint, false, true /* use transforms */));
+
+    // Convert from page ("absolute") to FrameView coordinates.
+    point.move(-scrollX(), -scrollY());
+    return point;
+}
+
+IntPoint FrameView::convertToRenderer(const RenderObject* renderer, const IntPoint& viewPoint) const
+{
+    IntPoint point = viewPoint;
+    
+    // Convert from FrameView coords into page ("absolute") coordinates.
+    point += IntSize(scrollX(), scrollY());
+
+    return roundedIntPoint(renderer->absoluteToLocal(point, false, true /* use transforms */));
+}
+
+IntRect FrameView::convertToContainingView(const IntRect& localRect) const
+{
+    if (const ScrollView* parentScrollView = parent()) {
+        if (parentScrollView->isFrameView()) {
+            const FrameView* parentView = static_cast<const FrameView*>(parentScrollView);
+            // Get our renderer in the parent view
+            RenderPart* renderer = m_frame->ownerRenderer();
+            if (!renderer)
+                return localRect;
+                
+            IntRect rect(localRect);
+            // Add borders and padding??
+            rect.move(renderer->borderLeft() + renderer->paddingLeft(),
+                      renderer->borderTop() + renderer->paddingTop());
+            return parentView->convertFromRenderer(renderer, rect);
+        }
+        
+        return Widget::convertToContainingView(localRect);
+    }
+    
+    return localRect;
+}
+
+IntRect FrameView::convertFromContainingView(const IntRect& parentRect) const
+{
+    if (const ScrollView* parentScrollView = parent()) {
+        if (parentScrollView->isFrameView()) {
+            const FrameView* parentView = static_cast<const FrameView*>(parentScrollView);
+
+            // Get our renderer in the parent view
+            RenderPart* renderer = m_frame->ownerRenderer();
+            if (!renderer)
+                return parentRect;
+
+            IntRect rect = parentView->convertToRenderer(renderer, parentRect);
+            // Subtract borders and padding
+            rect.move(-renderer->borderLeft() - renderer->paddingLeft(),
+                      -renderer->borderTop() - renderer->paddingTop());
+            return rect;
+        }
+        
+        return Widget::convertFromContainingView(parentRect);
+    }
+    
+    return parentRect;
+}
+
+IntPoint FrameView::convertToContainingView(const IntPoint& localPoint) const
+{
+    if (const ScrollView* parentScrollView = parent()) {
+        if (parentScrollView->isFrameView()) {
+            const FrameView* parentView = static_cast<const FrameView*>(parentScrollView);
+
+            // Get our renderer in the parent view
+            RenderPart* renderer = m_frame->ownerRenderer();
+            if (!renderer)
+                return localPoint;
+                
+            IntPoint point(localPoint);
+
+            // Add borders and padding
+            point.move(renderer->borderLeft() + renderer->paddingLeft(),
+                       renderer->borderTop() + renderer->paddingTop());
+            return parentView->convertFromRenderer(renderer, point);
+        }
+        
+        return Widget::convertToContainingView(localPoint);
+    }
+    
+    return localPoint;
+}
+
+IntPoint FrameView::convertFromContainingView(const IntPoint& parentPoint) const
+{
+    if (const ScrollView* parentScrollView = parent()) {
+        if (parentScrollView->isFrameView()) {
+            const FrameView* parentView = static_cast<const FrameView*>(parentScrollView);
+
+            // Get our renderer in the parent view
+            RenderPart* renderer = m_frame->ownerRenderer();
+            if (!renderer)
+                return parentPoint;
+
+            IntPoint point = parentView->convertToRenderer(renderer, parentPoint);
+            // Subtract borders and padding
+            point.move(-renderer->borderLeft() - renderer->paddingLeft(),
+                       -renderer->borderTop() - renderer->paddingTop());
+            return point;
+        }
+        
+        return Widget::convertFromContainingView(parentPoint);
+    }
+    
+    return parentPoint;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FrameView.h b/src/3rdparty/webkit/WebCore/page/FrameView.h
index 9dabe56e92..8eee5b8211 100644
--- a/src/3rdparty/webkit/WebCore/page/FrameView.h
+++ b/src/3rdparty/webkit/WebCore/page/FrameView.h
@@ -48,7 +48,7 @@ class String;
 
 template <typename T> class Timer;
 
-class FrameView : public ScrollView, public RefCounted<FrameView> {
+class FrameView : public ScrollView {
 public:
     friend class RenderView;
 
@@ -93,8 +93,7 @@ public:
     bool needsFullRepaint() const { return m_doFullRepaint; }
 
 #if USE(ACCELERATED_COMPOSITING)
-    enum CompositingUpdate { NormalCompositingUpdate, ForcedCompositingUpdate };
-    void updateCompositingLayers(CompositingUpdate updateType = NormalCompositingUpdate);
+    void updateCompositingLayers();
 
     // Called when changes to the GraphicsLayer hierarchy have to be synchronized with
     // content rendered via the normal painting path.
@@ -126,11 +125,6 @@ public:
     virtual IntRect windowClipRect(bool clipToContents = true) const;
     IntRect windowClipRectForLayer(const RenderLayer*, bool clipToLayerContents) const;
 
-    virtual bool isActive() const;
-    virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
-    virtual void valueChanged(Scrollbar*);
-    virtual void getTickmarks(Vector<IntRect>&) const;
-
     virtual IntRect windowResizerRect() const;
 
     virtual void scrollRectIntoViewRecursively(const IntRect&);
@@ -185,9 +179,13 @@ public:
 
     void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
 
-    bool lockedToAnchor() { return m_lockedToAnchor; }
-    void setLockedToAnchor(bool lockedToAnchor) { m_lockedToAnchor = lockedToAnchor; }
+    void maintainScrollPositionAtAnchor(Node*);
 
+    // Methods to convert points and rects between the coordinate space of the renderer, and this view.
+    virtual IntRect convertFromRenderer(const RenderObject*, const IntRect&) const;
+    virtual IntRect convertToRenderer(const RenderObject*, const IntRect&) const;
+    virtual IntPoint convertFromRenderer(const RenderObject*, const IntPoint&) const;
+    virtual IntPoint convertToRenderer(const RenderObject*, const IntPoint&) const;
 
 private:
     FrameView(Frame*);
@@ -215,12 +213,26 @@ private:
             layout();
     }
 
+    // Override ScrollView methods to do point conversion via renderers, in order to
+    // take transforms into account.
+    virtual IntRect convertToContainingView(const IntRect&) const;
+    virtual IntRect convertFromContainingView(const IntRect&) const;
+    virtual IntPoint convertToContainingView(const IntPoint&) const;
+    virtual IntPoint convertFromContainingView(const IntPoint&) const;
+
+    // ScrollBarClient interface
+    virtual void valueChanged(Scrollbar*);
+    virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
+    virtual bool isActive() const;
+    virtual void getTickmarks(Vector<IntRect>&) const;
+
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
     void updateDeferredRepaintDelay();
     double adjustedDeferredRepaintDelay() const;
 
     bool updateWidgets();
+    void scrollToAnchor();
     
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
@@ -290,7 +302,7 @@ private:
     bool m_isVisuallyNonEmpty;
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
-    bool m_lockedToAnchor;
+    RefPtr<Node> m_maintainScrollPositionAnchor;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h b/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
index c4e419c725..7330d939d2 100644
--- a/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
+++ b/src/3rdparty/webkit/WebCore/page/MouseEventWithHitTestResults.h
@@ -28,7 +28,6 @@ namespace WebCore {
 
 class Scrollbar;
 
-// FIXME: Why doesn't this class just cache a HitTestResult instead of copying all of HitTestResult's fields over?
 class MouseEventWithHitTestResults {
 public:
     MouseEventWithHitTestResults(const PlatformMouseEvent&, const HitTestResult&);
@@ -46,6 +45,6 @@ private:
     HitTestResult m_hitTestResult;
 };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // MouseEventWithHitTestResults_h
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.cpp b/src/3rdparty/webkit/WebCore/page/Settings.cpp
index 7a15163350..6f8b7c7f6c 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Settings.cpp
@@ -75,6 +75,7 @@ Settings::Settings(Page* page)
 #endif
     , m_needsAdobeFrameReloadingQuirk(false)
     , m_needsKeyboardEventDisambiguationQuirks(false)
+    , m_treatsAnyTextCSSLinkAsStylesheet(false)
     , m_needsLeopardMailQuirks(false)
     , m_needsTigerMailQuirks(false)
     , m_isDOMPasteAllowed(false)
@@ -87,6 +88,7 @@ Settings::Settings(Page* page)
     , m_needsSiteSpecificQuirks(false)
     , m_fontRenderingMode(0)
     , m_webArchiveDebugModeEnabled(false)
+    , m_localFileContentSniffingEnabled(false)
     , m_inApplicationChromeMode(false)
     , m_offlineWebApplicationCacheEnabled(false)
     , m_shouldPaintCustomScrollbars(false)
@@ -314,6 +316,11 @@ void Settings::setNeedsKeyboardEventDisambiguationQuirks(bool needsQuirks)
     m_needsKeyboardEventDisambiguationQuirks = needsQuirks;
 }
 
+void Settings::setTreatsAnyTextCSSLinkAsStylesheet(bool treatsAnyTextCSSLinkAsStylesheet)
+{
+    m_treatsAnyTextCSSLinkAsStylesheet = treatsAnyTextCSSLinkAsStylesheet;
+}
+
 void Settings::setNeedsLeopardMailQuirks(bool needsQuirks)
 {
     m_needsLeopardMailQuirks = needsQuirks;
@@ -400,6 +407,11 @@ void Settings::setWebArchiveDebugModeEnabled(bool enabled)
     m_webArchiveDebugModeEnabled = enabled;
 }
 
+void Settings::setLocalFileContentSniffingEnabled(bool enabled)
+{
+    m_localFileContentSniffingEnabled = enabled;
+}
+
 void Settings::setLocalStorageDatabasePath(const String& path)
 {
     m_localStorageDatabasePath = path;
diff --git a/src/3rdparty/webkit/WebCore/page/Settings.h b/src/3rdparty/webkit/WebCore/page/Settings.h
index 4b9b40a243..962af1845d 100644
--- a/src/3rdparty/webkit/WebCore/page/Settings.h
+++ b/src/3rdparty/webkit/WebCore/page/Settings.h
@@ -163,6 +163,9 @@ namespace WebCore {
         void setNeedsKeyboardEventDisambiguationQuirks(bool);
         bool needsKeyboardEventDisambiguationQuirks() const { return m_needsKeyboardEventDisambiguationQuirks; }
 
+        void setTreatsAnyTextCSSLinkAsStylesheet(bool);
+        bool treatsAnyTextCSSLinkAsStylesheet() const { return m_treatsAnyTextCSSLinkAsStylesheet; }
+
         void setNeedsLeopardMailQuirks(bool);
         bool needsLeopardMailQuirks() const { return m_needsLeopardMailQuirks; }
 
@@ -202,6 +205,9 @@ namespace WebCore {
         void setWebArchiveDebugModeEnabled(bool);
         bool webArchiveDebugModeEnabled() const { return m_webArchiveDebugModeEnabled; }
 
+        void setLocalFileContentSniffingEnabled(bool);
+        bool localFileContentSniffingEnabled() const { return m_localFileContentSniffingEnabled; }
+
         void setLocalStorageDatabasePath(const String&);
         const String& localStorageDatabasePath() const { return m_localStorageDatabasePath; }
         
@@ -282,6 +288,7 @@ namespace WebCore {
 #endif
         bool m_needsAdobeFrameReloadingQuirk : 1;
         bool m_needsKeyboardEventDisambiguationQuirks : 1;
+        bool m_treatsAnyTextCSSLinkAsStylesheet : 1;
         bool m_needsLeopardMailQuirks : 1;
         bool m_needsTigerMailQuirks : 1;
         bool m_isDOMPasteAllowed : 1;
@@ -294,6 +301,7 @@ namespace WebCore {
         bool m_needsSiteSpecificQuirks : 1;
         unsigned m_fontRenderingMode : 1;
         bool m_webArchiveDebugModeEnabled : 1;
+        bool m_localFileContentSniffingEnabled : 1;
         bool m_inApplicationChromeMode : 1;
         bool m_offlineWebApplicationCacheEnabled : 1;
         bool m_shouldPaintCustomScrollbars : 1;
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
index f8a2f4001f..5dfc963133 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.cpp
@@ -28,6 +28,7 @@
 #include "XSSAuditor.h"
 
 #include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
 
 #include "Console.h"
 #include "CString.h"
@@ -35,6 +36,7 @@
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "KURL.h"
+#include "PreloadScanner.h"
 #include "ResourceResponseBase.h"
 #include "ScriptSourceCode.h"
 #include "Settings.h"
@@ -44,6 +46,11 @@ using namespace WTF;
 
 namespace WebCore {
 
+static bool isNonNullControlCharacter(UChar c)
+{
+    return (c > '\0' && c < ' ') || c == 127;
+}
+
 XSSAuditor::XSSAuditor(Frame* frame)
     : m_frame(frame)
 {
@@ -64,9 +71,22 @@ bool XSSAuditor::canEvaluate(const String& sourceCode) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(sourceCode)) {
+    if (findInRequest(sourceCode, false, true, false)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+        return false;
+    }
+    return true;
+}
+
+bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
+{
+    if (!isEnabled())
+        return true;
+
+    if (findInRequest(code, false, false, true, true)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
     return true;
@@ -77,17 +97,22 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    return canEvaluate(code);
+    if (findInRequest(code)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+        return false;
+    }
+    return true;
 }
 
-bool XSSAuditor::canLoadExternalScriptFromSrc(const String& url) const
+bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const String& url) const
 {
     if (!isEnabled())
         return true;
 
-    if (findInRequest(url)) {
+    if (findInRequest(context + url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
     return true;
@@ -98,45 +123,113 @@ bool XSSAuditor::canLoadObject(const String& url) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(url)) {
+    if (findInRequest(url, false, false)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
-        m_frame->domWindow()->console()->addMessage(OtherMessageSource, ErrorMessageLevel, consoleMessage, 1, String());
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
     return true;
 }
 
-String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowControlCharacters)
+bool XSSAuditor::canSetBaseElementURL(const String& url) const
+{
+    if (!isEnabled())
+        return true;
+    
+    KURL baseElementURL(m_frame->document()->url(), url);
+    if (m_frame->document()->url().host() != baseElementURL.host() && findInRequest(url)) {
+        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request"));
+        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
+        return false;
+    }
+    return true;
+}
+
+String XSSAuditor::decodeURL(const String& str, const TextEncoding& encoding, bool allowNullCharacters,
+                             bool allowNonNullControlCharacters, bool decodeHTMLentities, bool leaveUndecodableHTMLEntitiesUntouched)
 {
     String result;
     String url = str;
 
     url.replace('+', ' ');
     result = decodeURLEscapeSequences(url);
-    if (!allowControlCharacters)
-        result.removeCharacters(&isControlCharacter);
-    result = encoding.decode(result.utf8().data(), result.length());
-    if (!allowControlCharacters)
-        result.removeCharacters(&isControlCharacter);
+    String decodedResult = encoding.decode(result.utf8().data(), result.length());
+    if (!decodedResult.isEmpty())
+        result = decodedResult;
+    if (decodeHTMLentities)
+        result = decodeHTMLEntities(result, leaveUndecodableHTMLEntitiesUntouched);
+    if (!allowNullCharacters)
+        result = StringImpl::createStrippingNullCharacters(result.characters(), result.length());
+    if (!allowNonNullControlCharacters) {
+        decodedResult = result.removeCharacters(&isNonNullControlCharacter);
+        if (!decodedResult.isEmpty())
+            result = decodedResult;
+    }
     return result;
 }
 
-bool XSSAuditor::findInRequest(const String& string) const
+String XSSAuditor::decodeHTMLEntities(const String& str, bool leaveUndecodableHTMLEntitiesUntouched)
+{
+    SegmentedString source(str);
+    SegmentedString sourceShadow;
+    Vector<UChar> result;
+    
+    while (!source.isEmpty()) {
+        UChar cc = *source;
+        source.advance();
+        
+        if (cc != '&') {
+            result.append(cc);
+            continue;
+        }
+        
+        if (leaveUndecodableHTMLEntitiesUntouched)
+            sourceShadow = source;
+        bool notEnoughCharacters = false;
+        unsigned entity = PreloadScanner::consumeEntity(source, notEnoughCharacters);
+        // We ignore notEnoughCharacters because we might as well use this loop
+        // to copy the remaining characters into |result|.
+
+        if (entity > 0xFFFF) {
+            result.append(U16_LEAD(entity));
+            result.append(U16_TRAIL(entity));
+        } else if (!leaveUndecodableHTMLEntitiesUntouched || entity != 0xFFFD){
+            result.append(entity);
+        } else {
+            result.append('&');
+            if (leaveUndecodableHTMLEntitiesUntouched)
+                source = sourceShadow;
+        }
+    }
+    
+    return String::adopt(result);
+}
+
+bool XSSAuditor::findInRequest(const String& string, bool matchNullCharacters, bool matchNonNullControlCharacters,
+                               bool decodeHTMLentities, bool leaveUndecodableHTMLEntitiesUntouched) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string);
+        result = findInRequest(parentFrame, string, matchNullCharacters, matchNonNullControlCharacters, 
+                               decodeHTMLentities, leaveUndecodableHTMLEntitiesUntouched);
     if (!result)
-        result = findInRequest(m_frame, string);
+        result = findInRequest(m_frame, string, matchNullCharacters, matchNonNullControlCharacters, 
+                               decodeHTMLentities, leaveUndecodableHTMLEntitiesUntouched);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool matchNullCharacters, bool matchNonNullControlCharacters,
+                               bool decodeHTMLentities, bool leaveUndecodableHTMLEntitiesUntouched) const
 {
     ASSERT(frame->document());
     String pageURL = frame->document()->url().string();
 
+    if (!frame->document()->decoder()) {
+        // Note, JavaScript URLs do not have a charset.
+        return false;
+    }
+
     if (protocolIs(pageURL, "data"))
         return false;
 
@@ -145,7 +238,8 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string) const
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = decodeURL(pageURL, frame->document()->decoder()->encoding());
+        String decodedPageURL = decodeURL(pageURL, frame->document()->decoder()->encoding(), matchNullCharacters,
+                                          matchNonNullControlCharacters, decodeHTMLentities, leaveUndecodableHTMLEntitiesUntouched);
         if (decodedPageURL.find(string, 0, false) != -1)
            return true;  // We've found the smoking gun.
     }
@@ -158,7 +252,8 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string) const
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = decodeURL(formData, frame->document()->decoder()->encoding());
+            String decodedFormData = decodeURL(formData, frame->document()->decoder()->encoding(), matchNullCharacters,
+                                               matchNonNullControlCharacters, decodeHTMLentities, leaveUndecodableHTMLEntitiesUntouched);
             if (decodedFormData.find(string, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
index 7974d1c823..6c6a56c2b6 100644
--- a/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
+++ b/src/3rdparty/webkit/WebCore/page/XSSAuditor.h
@@ -74,13 +74,17 @@ namespace WebCore {
         // based on the content of any user-submitted data.
         bool canEvaluate(const String& sourceCode) const;
 
+        // Determines whether the JavaScript URL should be allowed or denied execution
+        // based on the content of any user-submitted data.
+        bool canEvaluateJavaScriptURL(const String& code) const;
+
         // Determines whether the event listener should be created based on the
         // content of any user-submitted data.
         bool canCreateInlineEventListener(const String& functionName, const String& code) const;
 
         // Determines whether the external script should be loaded based on the
         // content of any user-submitted data.
-        bool canLoadExternalScriptFromSrc(const String& url) const;
+        bool canLoadExternalScriptFromSrc(const String& context, const String& url) const;
 
         // Determines whether object should be loaded based on the content of
         // any user-submitted data.
@@ -88,12 +92,24 @@ namespace WebCore {
         // This method is called by FrameLoader::requestObject.
         bool canLoadObject(const String& url) const;
 
+        // Determines whether the base URL should be changed based on the content
+        // of any user-submitted data.
+        //
+        // This method is called by HTMLBaseElement::process.
+        bool canSetBaseElementURL(const String& url) const;
+
     private:
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowControlCharacters = false);
+        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool allowNullCharacters = false,
+                                bool allowNonNullControlCharacters = true, bool decodeHTMLentities = true, 
+                                bool leaveUndecodableHTMLEntitiesUntouched = false);
+        
+        static String decodeHTMLEntities(const String&, bool leaveUndecodableHTMLEntitiesUntouched = false);
 
-        bool findInRequest(const String&) const;
+        bool findInRequest(const String&, bool matchNullCharacters = true, bool matchNonNullControlCharacters = true,
+                           bool decodeHTMLentities = true, bool leaveUndecodableHTMLEntitiesUntouched = false) const;
 
-        bool findInRequest(Frame*, const String&) const;
+        bool findInRequest(Frame*, const String&, bool matchNullCharacters = true, bool matchNonNullControlCharacters = true,
+                           bool decodeHTMLentities = true, bool leaveUndecodableHTMLEntitiesUntouched = false) const;
 
         // The frame to audit.
         Frame* m_frame;
diff --git a/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
index 94c1cbb51e..19d02c621f 100644
--- a/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/DragControllerAndroid.cpp
@@ -44,7 +44,7 @@ DragOperation DragController::dragOperation(DragData* dragData)
     if (dragData->containsURL())
         return DragOperationCopy;
 
-   return DragOperationNone;
+    return DragOperationNone;
 } 
 
 const float DragController::DragImageAlpha = 1.0f;
diff --git a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
index 24644296ca..c6bce4fbe8 100644
--- a/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
+++ b/src/3rdparty/webkit/WebCore/page/android/EventHandlerAndroid.cpp
@@ -41,7 +41,7 @@ namespace WebCore {
 
 unsigned EventHandler::s_accessKeyModifiers = PlatformKeyboardEvent::AltKey;
 
-bool EventHandler::tabsToAllControls(KeyboardEvent* ) const
+bool EventHandler::tabsToAllControls(KeyboardEvent*) const
 {
     return true;
 }
@@ -75,7 +75,7 @@ bool EventHandler::passMouseDownEventToWidget(Widget* )
     return false;
 }
 
-bool EventHandler::eventActivatedView(const PlatformMouseEvent& ) const
+bool EventHandler::eventActivatedView(const PlatformMouseEvent&) const
 {
     notImplemented();
     return false;
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
index 7b8a189d02..a4916e90b6 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationBase.cpp
@@ -1041,7 +1041,7 @@ void AnimationBase::getTimeToNextEvent(double& time, bool& isLooping) const
     double nextIterationTime = m_totalDuration;
 
     if (m_totalDuration < 0 || elapsedDuration < m_totalDuration) {
-        durationLeft = m_animation->duration() - fmod(elapsedDuration, m_animation->duration());
+        durationLeft = m_animation->duration() > 0 ? (m_animation->duration() - fmod(elapsedDuration, m_animation->duration())) : 0;
         nextIterationTime = elapsedDuration + durationLeft;
     }
     
diff --git a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
index 58a1f5b723..ed241e10ab 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/AnimationController.cpp
@@ -136,9 +136,9 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
     for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
-            it->element->dispatchWebKitTransitionEvent(it->eventType,it->name, it->elapsedTime);
+            it->element->dispatchWebKitTransitionEvent(it->eventType, it->name, it->elapsedTime);
         else
-            it->element->dispatchWebKitAnimationEvent(it->eventType,it->name, it->elapsedTime);
+            it->element->dispatchWebKitAnimationEvent(it->eventType, it->name, it->elapsedTime);
     }
     
     m_eventsToDispatch.clear();
@@ -152,20 +152,6 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     
     if (m_frame)
         m_frame->document()->updateStyleIfNeeded();
-
-    // We can now safely remove any animations or transitions that are finished.
-    // We can't remove them any earlier because we might get a false restart of
-    // a transition. This can happen because we have not yet set the final property
-    // value until we call the rendering dispatcher. So this can make the current
-    // style slightly different from the desired final style (because our last 
-    // animation step was, say 0.9999 or something). And we need to remove them
-    // here because if there are no more animations running we'll never get back
-    // into the animation code to clean them up.
-    RenderObjectAnimationMap::const_iterator animationsEnd = m_compositeAnimations.end();
-    for (RenderObjectAnimationMap::const_iterator it = m_compositeAnimations.begin(); it != animationsEnd; ++it) {
-        CompositeAnimation* compAnim = it->second.get();
-        compAnim->cleanupFinishedAnimations(); // will not modify m_compositeAnimations, so OK to call while iterating
-    }
 }
 
 void AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher()
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
index b03dfe35ee..9481b8d986 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.cpp
@@ -117,7 +117,10 @@ void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle*
                 bool equal = true;
 
                 if (implAnim) {
-                    implAnim->setActive(true);
+                    // If we are post active don't bother setting the active flag. This will cause
+                    // this animation to get removed at the end of this function.
+                    if (!implAnim->postActive())
+                        implAnim->setActive(true);
                     
                     // This might be a transition that is just finishing. That would be the case
                     // if it were postActive. But we still need to check for equality because
@@ -183,52 +186,62 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
     if (m_keyframeAnimations.isEmpty() && !targetStyle->hasAnimations())
         return;
 
-    // Nothing to do if the current and target animations are the same
-    if (currentStyle && currentStyle->hasAnimations() && targetStyle->hasAnimations() && *(currentStyle->animations()) == *(targetStyle->animations()))
-        return;
-        
-    // Mark all existing animations as no longer active
     AnimationNameMap::const_iterator kfend = m_keyframeAnimations.end();
-    for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it)
-        it->second->setIndex(-1);
-        
-    // Toss the animation order map
-    m_keyframeAnimationOrderMap.clear();
     
-    // Now mark any still active animations as active and add any new animations
-    if (targetStyle->animations()) {
-        int numAnims = targetStyle->animations()->size();
-        for (int i = 0; i < numAnims; ++i) {
-            const Animation* anim = targetStyle->animations()->animation(i);
-            AtomicString animationName(anim->name());
-
-            if (!anim->isValidAnimation())
-                continue;
+    if (currentStyle && currentStyle->hasAnimations() && targetStyle->hasAnimations() && *(currentStyle->animations()) == *(targetStyle->animations())) {
+        // The current and target animations are the same so we just need to toss any 
+        // animation which is finished (postActive).
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it) {
+            if (it->second->postActive())
+                it->second->setIndex(-1);
+        }
+    } else {
+        // Mark all existing animations as no longer active.
+        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it)
+            it->second->setIndex(-1);
             
-            // See if there is a current animation for this name
-            RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(animationName.impl());
+        // Toss the animation order map.
+        m_keyframeAnimationOrderMap.clear();
+        
+        // Now mark any still active animations as active and add any new animations.
+        if (targetStyle->animations()) {
+            int numAnims = targetStyle->animations()->size();
+            for (int i = 0; i < numAnims; ++i) {
+                const Animation* anim = targetStyle->animations()->animation(i);
+                AtomicString animationName(anim->name());
+
+                if (!anim->isValidAnimation())
+                    continue;
+                
+                // See if there is a current animation for this name.
+                RefPtr<KeyframeAnimation> keyframeAnim = m_keyframeAnimations.get(animationName.impl());
+                
+                if (keyframeAnim) {
+                    // If this animation is postActive, skip it so it gets removed at the end of this function.
+                    if (keyframeAnim->postActive())
+                        continue;
+                    
+                    // This one is still active.
+
+                    // Animations match, but play states may differ. Update if needed.
+                    keyframeAnim->updatePlayState(anim->playState() == AnimPlayStatePlaying);
+                                
+                    // Set the saved animation to this new one, just in case the play state has changed.
+                    keyframeAnim->setAnimation(anim);
+                    keyframeAnim->setIndex(i);
+                } else if ((anim->duration() || anim->delay()) && anim->iterationCount()) {
+                    keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, this, currentStyle ? currentStyle : targetStyle);
+                    m_keyframeAnimations.set(keyframeAnim->name().impl(), keyframeAnim);
+                }
                 
-            if (keyframeAnim) {
-                // There is one so it is still active
-
-                // Animations match, but play states may differ. update if needed
-                keyframeAnim->updatePlayState(anim->playState() == AnimPlayStatePlaying);
-                            
-                // Set the saved animation to this new one, just in case the play state has changed
-                keyframeAnim->setAnimation(anim);
-                keyframeAnim->setIndex(i);
-            } else if ((anim->duration() || anim->delay()) && anim->iterationCount()) {
-                keyframeAnim = KeyframeAnimation::create(const_cast<Animation*>(anim), renderer, i, this, currentStyle ? currentStyle : targetStyle);
-                m_keyframeAnimations.set(keyframeAnim->name().impl(), keyframeAnim);
+                // Add this to the animation order map.
+                if (keyframeAnim)
+                    m_keyframeAnimationOrderMap.append(keyframeAnim->name().impl());
             }
-            
-            // Add this to the animation order map
-            if (keyframeAnim)
-                m_keyframeAnimationOrderMap.append(keyframeAnim->name().impl());
         }
     }
-
-    // Make a list of animations to be removed
+    
+    // Make a list of animations to be removed.
     Vector<AtomicStringImpl*> animsToBeRemoved;
     kfend = m_keyframeAnimations.end();
     for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it) {
@@ -237,7 +250,7 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
             animsToBeRemoved.append(keyframeAnim->name().impl());
     }
     
-    // Now remove the animations from the list
+    // Now remove the animations from the list.
     for (size_t j = 0; j < animsToBeRemoved.size(); ++j)
         m_keyframeAnimations.remove(animsToBeRemoved[j]);
 }
@@ -246,11 +259,9 @@ PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, Rend
 {
     RefPtr<RenderStyle> resultStyle;
 
-    // Update animations first so we can see if any transitions are overridden
-    updateKeyframeAnimations(renderer, currentStyle, targetStyle);
-
-    // We don't do any transitions if we don't have a currentStyle (on startup)
+    // We don't do any transitions if we don't have a currentStyle (on startup).
     updateTransitions(renderer, currentStyle, targetStyle);
+    updateKeyframeAnimations(renderer, currentStyle, targetStyle);
 
     if (currentStyle) {
         // Now that we have transition objects ready, let them know about the new goal state.  We want them
@@ -272,8 +283,6 @@ PassRefPtr<RenderStyle> CompositeAnimation::animate(RenderObject* renderer, Rend
             keyframeAnim->animate(this, renderer, currentStyle, targetStyle, resultStyle);
     }
 
-    cleanupFinishedAnimations();
-
     return resultStyle ? resultStyle.release() : targetStyle;
 }
 
@@ -364,50 +373,6 @@ PassRefPtr<KeyframeAnimation> CompositeAnimation::getAnimationForProperty(int pr
     return retval;
 }
 
-void CompositeAnimation::cleanupFinishedAnimations()
-{
-    if (isSuspended())
-        return;
-
-    // Make a list of transitions to be deleted
-    Vector<int> finishedTransitions;
-    if (!m_transitions.isEmpty()) {
-        CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
-
-        for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
-            ImplicitAnimation* anim = it->second.get();
-            if (!anim)
-                continue;
-            if (anim->postActive())
-                finishedTransitions.append(anim->animatingProperty());
-        }
-        
-        // Delete them
-        size_t finishedTransitionCount = finishedTransitions.size();
-        for (size_t i = 0; i < finishedTransitionCount; ++i)
-            m_transitions.remove(finishedTransitions[i]);
-    }
-
-    // Make a list of animations to be deleted
-    Vector<AtomicStringImpl*> finishedAnimations;
-    if (!m_keyframeAnimations.isEmpty()) {
-        AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
-
-        for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
-            KeyframeAnimation* anim = it->second.get();
-            if (!anim)
-                continue;
-            if (anim->postActive())
-                finishedAnimations.append(anim->name().impl());
-        }
-
-        // Delete them
-        size_t finishedAnimationCount = finishedAnimations.size();
-        for (size_t i = 0; i < finishedAnimationCount; ++i)
-            m_keyframeAnimations.remove(finishedAnimations[i]);
-    }
-}
-
 void CompositeAnimation::suspendAnimations()
 {
     if (m_isSuspended)
diff --git a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
index 739cfdcc65..b7db442452 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
+++ b/src/3rdparty/webkit/WebCore/page/animation/CompositeAnimation.h
@@ -74,8 +74,6 @@ public:
     
     PassRefPtr<KeyframeAnimation> getAnimationForProperty(int property) const;
 
-    void cleanupFinishedAnimations();
-
     void overrideImplicitAnimations(int property);
     void resumeOverriddenImplicitAnimations(int property);
 
diff --git a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
index 8edcd5a69c..8e6349d5dd 100644
--- a/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/src/3rdparty/webkit/WebCore/page/animation/ImplicitAnimation.cpp
@@ -212,6 +212,10 @@ bool ImplicitAnimation::affectsProperty(int property) const
 
 bool ImplicitAnimation::isTargetPropertyEqual(int prop, const RenderStyle* targetStyle)
 {
+    // We can get here for a transition that has not started yet. This would make m_toStyle unset and null. 
+    // So we check that here (see <https://bugs.webkit.org/show_bug.cgi?id=26706>)
+    if (!m_toStyle)
+        return false;
     return propertiesEqual(prop, m_toStyle.get(), targetStyle);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp b/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
index 1fe56b447a..e6c76825d1 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/page/qt/DragControllerQt.cpp
@@ -31,8 +31,7 @@
 #include "FrameView.h"
 #include "Page.h"
 
-namespace WebCore
-{
+namespace WebCore {
 
 // FIXME: These values are straight out of DragControllerMac, so probably have 
 // little correlation with Qt standards...
diff --git a/src/3rdparty/webkit/WebCore/page/win/DragControllerWin.cpp b/src/3rdparty/webkit/WebCore/page/win/DragControllerWin.cpp
index dca8ea201e..f0404ff349 100644
--- a/src/3rdparty/webkit/WebCore/page/win/DragControllerWin.cpp
+++ b/src/3rdparty/webkit/WebCore/page/win/DragControllerWin.cpp
@@ -50,7 +50,8 @@ DragOperation DragController::dragOperation(DragData* dragData)
     return dragData->containsURL() && !m_didInitiateDrag ? DragOperationCopy : DragOperationNone;
 }
 
-bool DragController::isCopyKeyDown() {
+bool DragController::isCopyKeyDown()
+{
     return ::GetAsyncKeyState(VK_CONTROL);
 }
     
diff --git a/src/3rdparty/webkit/WebCore/page/win/FrameWin.h b/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
index 405c7b2de6..2924291621 100644
--- a/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
+++ b/src/3rdparty/webkit/WebCore/page/win/FrameWin.h
@@ -34,7 +34,7 @@ typedef struct HBITMAP__* HBITMAP;
 namespace WebCore {
 
     HBITMAP imageFromSelection(Frame* frame, bool forceWhiteText);
-    void computePageRectsForFrame(Frame*, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor,Vector<IntRect>& pages, int& pageHeight);
+    void computePageRectsForFrame(Frame*, const IntRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, Vector<IntRect>& pages, int& pageHeight);
 
 }