Merge WebKit at r59636: Initial merge by git

Change-Id: I59b289c4e6b18425f06ce41cc9d34c522515de91

22 files changed, 222 insertions, 86 deletions

diff --git a/WebCore/dom/CanvasSurface.cpp b/WebCore/dom/CanvasSurface.cpp
index 3b0f397..424f913 100644
--- a/WebCore/dom/CanvasSurface.cpp
+++ b/WebCore/dom/CanvasSurface.cpp
@@ -87,11 +87,13 @@ String CanvasSurface::toDataURL(const String& mimeType, ExceptionCode& ec)
     if (m_size.isEmpty() || !buffer())
         return String("data:,");
 
+    String lowercaseMimeType = mimeType.lower();
+
     // FIXME: Make isSupportedImageMIMETypeForEncoding threadsafe (to allow this method to be used on a worker thread).
-    if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType))
+    if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(lowercaseMimeType))
         return buffer()->toDataURL("image/png");
 
-    return buffer()->toDataURL(mimeType);
+    return buffer()->toDataURL(lowercaseMimeType);
 }
 
 void CanvasSurface::willDraw(const FloatRect&)
diff --git a/WebCore/dom/Clipboard.idl b/WebCore/dom/Clipboard.idl
index 6509677..1024a36 100644
--- a/WebCore/dom/Clipboard.idl
+++ b/WebCore/dom/Clipboard.idl
@@ -38,8 +38,8 @@ module core {
             raises(DOMException);
         [Custom] void getData(in DOMString type)
             raises(DOMException);
-        [Custom] void setData(in DOMString type, in DOMString data)
-            raises(DOMException);
+        // FIXME: RequiresAllArguments is probably bogus here.
+        [RequiresAllArguments] boolean setData(in DOMString type, in DOMString data);
         [Custom] void setDragImage(in HTMLImageElement image, in long x, in long y)
             raises(DOMException);
     };
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index b063998..9e27dea 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -299,19 +299,32 @@ void ContainerNode::willRemove()
     Node::willRemove();
 }
 
-static ExceptionCode willRemoveChild(Node *child)
+static void willRemoveChild(Node* child)
 {
-    ExceptionCode ec = 0;
+    // update auxiliary doc info (e.g. iterators) to note that node is being removed
+    child->document()->nodeWillBeRemoved(child);
+    child->document()->incDOMTreeVersion();
 
     // fire removed from document mutation events.
     dispatchChildRemovalEvents(child);
-    if (ec)
-        return ec;
 
     if (child->attached())
         child->willRemove();
-    
-    return 0;
+}
+
+static void willRemoveChildren(ContainerNode* container)
+{
+    container->document()->nodeChildrenWillBeRemoved(container);
+    container->document()->incDOMTreeVersion();
+
+    // FIXME: Adding new children from event handlers can cause an infinite loop here.
+    for (RefPtr<Node> child = container->firstChild(); child; child = child->nextSibling()) {
+        // fire removed from document mutation events.
+        dispatchChildRemovalEvents(child.get());
+
+        if (child->attached())
+            child->willRemove();
+    }
 }
 
 bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
@@ -335,10 +348,7 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
     }
 
     RefPtr<Node> child = oldChild;
-
-    ec = willRemoveChild(child.get());
-    if (ec)
-        return false;
+    willRemoveChild(child.get());
 
     // Mutation events might have moved this child into a different parent.
     if (child->parentNode() != this) {
@@ -406,14 +416,12 @@ bool ContainerNode::removeChildren()
         return false;
 
     // The container node can be removed from event handlers.
-    RefPtr<Node> protect(this);
-    
+    RefPtr<ContainerNode> protect(this);
+
     // Do any prep work needed before actually starting to detach
     // and remove... e.g. stop loading frames, fire unload events.
-    // FIXME: Adding new children from event handlers can cause an infinite loop here.
-    for (RefPtr<Node> n = m_firstChild; n; n = n->nextSibling())
-        willRemoveChild(n.get());
-    
+    willRemoveChildren(protect.get());
+
     // exclude this node when looking for removed focusedNode since only children will be removed
     document()->removeFocusedNodeOfSubtree(this, true);
 
@@ -936,6 +944,8 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+    ASSERT(!eventDispatchForbidden());
+
 #if ENABLE(INSPECTOR)    
     if (Page* page = child->document()->page()) {
         if (InspectorController* inspectorController = page->inspectorController())
@@ -946,11 +956,6 @@ static void dispatchChildRemovalEvents(Node* child)
     RefPtr<Node> c = child;
     RefPtr<Document> document = child->document();
 
-    // update auxiliary doc info (e.g. iterators) to note that node is being removed
-    document->nodeWillBeRemoved(child);
-
-    document->incDOMTreeVersion();
-
     // dispatch pre-removal mutation events
     if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER))
         c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, c->parentNode()));
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index c6920bf..7fc7aa9 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -223,29 +223,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-class SynchronousHTMLTokenizerGuard {
-public:
-    SynchronousHTMLTokenizerGuard(Tokenizer* tokenizer)
-        : m_htmlTokenizer(tokenizer->asHTMLTokenizer())
-        , m_savedForceSynchronous(false)
-    {
-        if (m_htmlTokenizer) {
-            m_savedForceSynchronous = m_htmlTokenizer->forceSynchronous();
-            m_htmlTokenizer->setForceSynchronous(true);
-        }
-    }
-
-    ~SynchronousHTMLTokenizerGuard()
-    {
-        if (m_htmlTokenizer)
-            m_htmlTokenizer->setForceSynchronous(m_savedForceSynchronous);
-    }
-
-private:
-    HTMLTokenizer* m_htmlTokenizer;
-    bool m_savedForceSynchronous;
-};
-
 // #define INSTRUMENT_LAYOUT_SCHEDULING 1
 
 // This amount of time must have elapsed before we will even consider scheduling a layout without a delay.
@@ -2024,12 +2001,19 @@ void Document::write(const SegmentedString& text, Document* ownerDocument)
     if (!m_tokenizer)
         open(ownerDocument);
 
-    {
-        ASSERT(m_tokenizer);
-        SynchronousHTMLTokenizerGuard tokenizerGuard(m_tokenizer.get());
-        m_tokenizer->write(text, false);
+    ASSERT(m_tokenizer);
+    bool wasForcedSynchronous = false;
+    HTMLTokenizer* tokenizer = m_tokenizer->asHTMLTokenizer();
+    if (tokenizer) {
+        wasForcedSynchronous = tokenizer->forceSynchronous();
+        tokenizer->setForceSynchronous(true);
     }
 
+    m_tokenizer->write(text, false);
+
+    if (m_tokenizer && tokenizer && m_tokenizer->asHTMLTokenizer() == tokenizer)
+        tokenizer->setForceSynchronous(wasForcedSynchronous);
+
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Ending a document.write at %d\n", elapsedTime());
@@ -2378,6 +2362,9 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
             frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
+
+            DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to display document because display forbidden by X-Frame-Options.\n"));
+            frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         }
     }
 }
@@ -3075,6 +3062,28 @@ void Document::nodeChildrenChanged(ContainerNode* container)
     }
 }
 
+void Document::nodeChildrenWillBeRemoved(ContainerNode* container)
+{
+    if (!disableRangeMutation(page())) {
+        HashSet<Range*>::const_iterator end = m_ranges.end();
+        for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
+            (*it)->nodeChildrenWillBeRemoved(container);
+    }
+
+    HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = m_nodeIterators.end();
+    for (HashSet<NodeIterator*>::const_iterator it = m_nodeIterators.begin(); it != nodeIteratorsEnd; ++it) {
+        for (Node* n = container->firstChild(); n; n = n->nextSibling())
+            (*it)->nodeWillBeRemoved(n);
+    }
+
+    if (Frame* frame = this->frame()) {
+        for (Node* n = container->firstChild(); n; n = n->nextSibling()) {
+            frame->selection()->nodeWillBeRemoved(n);
+            frame->dragCaretController()->nodeWillBeRemoved(n);
+        }
+    }
+}
+
 void Document::nodeWillBeRemoved(Node* n)
 {
     HashSet<NodeIterator*>::const_iterator nodeIteratorsEnd = m_nodeIterators.end();
@@ -4955,6 +4964,28 @@ void Document::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stateObjec
     dispatchWindowEvent(PopStateEvent::create(stateObject));
 }
 
+void Document::addMediaCanStartListener(MediaCanStartListener* listener)
+{
+    ASSERT(!m_mediaCanStartListeners.contains(listener));
+    m_mediaCanStartListeners.add(listener);
+}
+
+void Document::removeMediaCanStartListener(MediaCanStartListener* listener)
+{
+    ASSERT(m_mediaCanStartListeners.contains(listener));
+    m_mediaCanStartListeners.remove(listener);
+}
+
+MediaCanStartListener* Document::takeAnyMediaCanStartListener()
+{
+    HashSet<MediaCanStartListener*>::iterator slot = m_mediaCanStartListeners.begin();
+    if (slot == m_mediaCanStartListeners.end())
+        return 0;
+    MediaCanStartListener* listener = *slot;
+    m_mediaCanStartListeners.remove(slot);
+    return listener;
+}
+
 #if ENABLE(XHTMLMP)
 bool Document::isXHTMLMPDocument() const
 {
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index 45031c3..676caf9 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -36,13 +36,14 @@
 #include "DocumentMarker.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
-#if USE(JSC)
-#include <runtime/WeakGCMap.h>
-#endif
 #include <wtf/HashCountedSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
+#if USE(JSC)
+#include <runtime/WeakGCMap.h>
+#endif
+
 namespace WebCore {
 
     class Attr;
@@ -87,6 +88,7 @@ namespace WebCore {
     class IntPoint;
     class DOMWrapperWorld;
     class JSNode;
+    class MediaCanStartListener;
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
@@ -618,6 +620,9 @@ public:
     void detachRange(Range*);
 
     void nodeChildrenChanged(ContainerNode*);
+    // nodeChildrenWillBeRemoved is used when removing all node children at once.
+    void nodeChildrenWillBeRemoved(ContainerNode*);
+    // nodeWillBeRemoved is only safe when removing one node at a time.
     void nodeWillBeRemoved(Node*);
 
     void textInserted(Node*, unsigned offset, unsigned length);
@@ -978,6 +983,10 @@ public:
     void enqueuePageshowEvent(PageshowEventPersistence);
     void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
 
+    void addMediaCanStartListener(MediaCanStartListener*);
+    void removeMediaCanStartListener(MediaCanStartListener*);
+    MediaCanStartListener* takeAnyMediaCanStartListener();
+
 protected:
     Document(Frame*, bool isXHTML, bool isHTML);
 
@@ -1149,7 +1158,6 @@ private:
     
     bool m_processingLoadEvent;
     RefPtr<SerializedScriptValue> m_pendingStateObject;
-    HashSet<RefPtr<HistoryItem> > m_associatedHistoryItems;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
     // This is used to increase the minimum delay between re-layouts. It is set
@@ -1252,6 +1260,8 @@ private:
 #endif
 
     RefPtr<DocumentWeakReference> m_weakReference;
+
+    HashSet<MediaCanStartListener*> m_mediaCanStartListeners;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 171a869..3e88071 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -44,7 +44,6 @@
 #include "HTMLNames.h"
 #include "HTMLTokenizer.h"
 #include "InspectorController.h"
-#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
@@ -219,19 +218,15 @@ bool Element::hasAttribute(const QualifiedName& name) const
 
 const AtomicString& Element::getAttribute(const QualifiedName& name) const
 {
-    if (name == styleAttr && !isStyleAttributeValid())
+    if (UNLIKELY(name == styleAttr) && !isStyleAttributeValid())
         updateStyleAttribute();
 
 #if ENABLE(SVG)
-    if (!areSVGAttributesValid())
+    if (UNLIKELY(!areSVGAttributesValid()))
         updateAnimatedSVGAttribute(name);
 #endif
 
-    if (namedAttrMap)
-        if (Attribute* a = namedAttrMap->getAttributeItem(name))
-            return a->value();
-
-    return nullAtom;
+    return fastGetAttribute(name);
 }
 
 void Element::scrollIntoView(bool alignToTop) 
@@ -878,6 +873,12 @@ bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderS
             if (pseudoId < FIRST_INTERNAL_PSEUDOID)
                 newStyle->setHasPseudoStyle(pseudoId);
             newStyle->addCachedPseudoStyle(newPseudoStyle);
+            if (pseudoId == FIRST_LINE || pseudoId == FIRST_LINE_INHERITED) {
+                // FIXME: We should do an actual diff to determine whether a repaint vs. layout
+                // is needed, but for now just assume a layout will be required.  The diff code
+                // in RenderObject::setStyle would need to be factored out so that it could be reused.
+                renderer()->setNeedsLayoutAndPrefWidthsRecalc();
+            }
             return true;
         }
     }
@@ -1425,9 +1426,15 @@ void Element::normalizeAttributes()
     NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
-    unsigned numAttrs = attrs->length();
-    for (unsigned i = 0; i < numAttrs; i++) {
-        if (Attr* attr = attrs->attributeItem(i)->attr())
+
+    if (attrs->isEmpty())
+        return;
+
+    Vector<RefPtr<Attribute> > attributeVector;
+    attrs->copyAttributesToVector(attributeVector);
+    size_t numAttrs = attributeVector.size();
+    for (size_t i = 0; i < numAttrs; ++i) {
+        if (Attr* attr = attributeVector[i]->attr())
             attr->normalize();
     }
 }
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index 3d02f1b..e89cf37 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -101,12 +101,19 @@ public:
 
     virtual PassRefPtr<DocumentFragment> createContextualFragment(const String&, FragmentScriptingPermission = FragmentScriptingAllowed);
 
-    const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
     const AtomicString& getAttribute(const QualifiedName&) const;
     void setAttribute(const QualifiedName&, const AtomicString& value, ExceptionCode&);
     void removeAttribute(const QualifiedName&, ExceptionCode&);
 
+    // Call this to get the value of an attribute that is known not to be the style
+    // attribute or one of the SVG animatable attributes.
+    bool fastHasAttribute(const QualifiedName&) const;
+    const AtomicString& fastGetAttribute(const QualifiedName&) const;
+
+    // Call this to get the value of the id attribute. Faster than calling fastGetAttribute.
+    const AtomicString& getIDAttribute() const;
+
     bool hasAttributes() const;
 
     bool hasAttribute(const String& name) const;
@@ -390,6 +397,20 @@ inline void Element::updateId(const AtomicString& oldId, const AtomicString& new
         doc->addElementById(newId, this);
 }
 
+inline bool Element::fastHasAttribute(const QualifiedName& name) const
+{
+    return namedAttrMap && namedAttrMap->getAttributeItem(name);
+}
+
+inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name) const
+{
+    if (namedAttrMap) {
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name))
+            return attribute->value();
+    }
+    return nullAtom;
+}
+
 } //namespace
 
 #endif
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index 506d945..876f8a8 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -186,6 +186,18 @@ bool Event::isStorageEvent() const
 }
 #endif
 
+#if ENABLE(INDEXED_DATABASE)
+bool Event::isIDBErrorEvent() const
+{
+    return false;
+}
+
+bool Event::isIDBSuccessEvent() const
+{
+    return false;
+}
+#endif
+
 #if ENABLE(WORKERS)
 bool Event::isErrorEvent() const
 {
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index 00b3341..fbcdc94 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -129,6 +129,10 @@ namespace WebCore {
 #if ENABLE(DOM_STORAGE)
         virtual bool isStorageEvent() const;
 #endif
+#if ENABLE(INDEXED_DATABASE)
+        virtual bool isIDBErrorEvent() const;
+        virtual bool isIDBSuccessEvent() const;
+#endif
 #if ENABLE(WORKERS)
         virtual bool isErrorEvent() const;
 #endif
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 91a5d0c..cb6be7a 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -163,6 +163,13 @@ FileReader* EventTarget::toFileReader()
 }
 #endif
 
+#if ENABLE(INDEXED_DATABASE)
+IDBRequest* EventTarget::toIDBRequest()
+{
+    return 0;
+}
+#endif
+
 bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     EventTargetData* d = ensureEventTargetData();
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 96d2d29..2aaeef5 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class EventListener;
     class EventSource;
     class FileReader;
+    class IDBRequest;
     class MessagePort;
     class Node;
     class Notification;
@@ -123,6 +124,10 @@ namespace WebCore {
         virtual FileReader* toFileReader();
 #endif
 
+#if ENABLE(INDEXED_DATABASE)
+        virtual IDBRequest* toIDBRequest();
+#endif
+
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
         virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index d8a6ba8..ee979cf 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -172,6 +172,11 @@ PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
     return m_attributes[index]->createAttrIfNeeded(m_element);
 }
 
+void NamedNodeMap::copyAttributesToVector(Vector<RefPtr<Attribute> >& copy)
+{
+    copy = m_attributes;
+}
+
 Attribute* NamedNodeMap::getAttributeItemSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
diff --git a/WebCore/dom/NamedAttrMap.h b/WebCore/dom/NamedAttrMap.h
index d5136b5..e292576 100644
--- a/WebCore/dom/NamedAttrMap.h
+++ b/WebCore/dom/NamedAttrMap.h
@@ -72,6 +72,8 @@ public:
     Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
     Attribute* getAttributeItem(const QualifiedName&) const;
 
+    void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
+
     void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
     void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
 
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index ccea070..eb36417 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -421,6 +421,7 @@ static void setDidMoveToNewOwnerDocumentWasCalled(bool wasCalled)
     
 void Node::setDocument(Document* document)
 {
+    ASSERT(!inDocument() || m_document == document);
     if (inDocument() || m_document == document)
         return;
 
@@ -929,8 +930,8 @@ void Node::removeCachedTagNodeList(TagNodeList* list, const QualifiedName& name)
     ASSERT_UNUSED(list, list->hasOwnCaches());
 
     NodeListsNodeData* data = rareData()->nodeLists();
-    ASSERT_UNUSED(list, list == data->m_tagNodeListCache.get(name));
-    data->m_tagNodeListCache.remove(name);
+    ASSERT_UNUSED(list, list == data->m_tagNodeListCache.get(name.impl()));
+    data->m_tagNodeListCache.remove(name.impl());
 }
 
 Node *Node::traverseNextNode(const Node *stayWithin) const
@@ -1564,7 +1565,7 @@ PassRefPtr<NodeList> Node::getElementsByTagNameNS(const AtomicString& namespaceU
     
     AtomicString localNameAtom = name;
         
-    pair<NodeListsNodeData::TagNodeListCache::iterator, bool> result = data->nodeLists()->m_tagNodeListCache.add(QualifiedName(nullAtom, localNameAtom, namespaceURI), 0);
+    pair<NodeListsNodeData::TagNodeListCache::iterator, bool> result = data->nodeLists()->m_tagNodeListCache.add(QualifiedName(nullAtom, localNameAtom, namespaceURI).impl(), 0);
     if (!result.second)
         return PassRefPtr<TagNodeList>(result.first->second);
     
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index b165615..a01ff62 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -354,6 +354,9 @@ public:
         ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
         return m_document;
     }
+
+    // Do not use this method to change the document of a node until after the node has been
+    // removed from its previous document.
     void setDocument(Document*);
 
     // Returns true if this node is associated with a document and is in its associated document's
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index 3d2cf0c..8456db1 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -48,7 +48,7 @@ struct NodeListsNodeData : Noncopyable {
     typedef HashMap<String, NameNodeList*> NameNodeListCache;
     NameNodeListCache m_nameNodeListCache;
     
-    typedef HashMap<QualifiedName, TagNodeList*> TagNodeListCache;
+    typedef HashMap<RefPtr<QualifiedName::QualifiedNameImpl>, TagNodeList*> TagNodeListCache;
     TagNodeListCache m_tagNodeListCache;
 
     static PassOwnPtr<NodeListsNodeData> create()
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index fdcd7e5..db9e3c6 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -1030,10 +1030,6 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             inlineBox = toRenderBox(renderer)->inlineBoxWrapper();
             if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
                 return;
-        } else if (!node()->isLink() && node()->isContentEditable()) {
-            Position pos = positionInParentBeforeNode(node()).upstream();
-            pos.getInlineBoxAndOffset(DOWNSTREAM, primaryDirection, inlineBox, caretOffset);
-            return;
         }
     } else {
         RenderText* textRenderer = toRenderText(renderer);
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index c704262..a5abdd4 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -1714,6 +1714,31 @@ void Range::nodeChildrenChanged(ContainerNode* container)
     boundaryNodeChildrenChanged(m_end, container);
 }
 
+static inline void boundaryNodeChildrenWillBeRemoved(RangeBoundaryPoint& boundary, ContainerNode* container)
+{
+    for (Node* nodeToBeRemoved = container->firstChild(); nodeToBeRemoved; nodeToBeRemoved = nodeToBeRemoved->nextSibling()) {
+        if (boundary.childBefore() == nodeToBeRemoved) {
+            boundary.setToStartOfNode(container);
+            return;
+        }
+
+        for (Node* n = boundary.container(); n; n = n->parentNode()) {
+            if (n == nodeToBeRemoved) {
+                boundary.setToStartOfNode(container);
+                return;
+            }
+        }
+    }
+}
+
+void Range::nodeChildrenWillBeRemoved(ContainerNode* container)
+{
+    ASSERT(container);
+    ASSERT(container->document() == m_ownerDocument);
+    boundaryNodeChildrenWillBeRemoved(m_start, container);
+    boundaryNodeChildrenWillBeRemoved(m_end, container);
+}
+
 static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node* nodeToBeRemoved)
 {
     if (boundary.childBefore() == nodeToBeRemoved) {
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index b1ed786..c81bf45 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -111,6 +111,7 @@ public:
     void textQuads(Vector<FloatQuad>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
+    void nodeChildrenWillBeRemoved(ContainerNode*);
     void nodeWillBeRemoved(Node*);
 
     void textInserted(Node*, unsigned offset, unsigned length);
diff --git a/WebCore/dom/UserGestureIndicator.cpp b/WebCore/dom/UserGestureIndicator.cpp
index 9fb30d3..06a3831 100644
--- a/WebCore/dom/UserGestureIndicator.cpp
+++ b/WebCore/dom/UserGestureIndicator.cpp
@@ -28,13 +28,12 @@
 
 namespace WebCore {
 
-bool UserGestureIndicator::s_processingUserGesture = false;
+ProcessingUserGestureState UserGestureIndicator::s_processingUserGesture = PossiblyProcessingUserGesture;
 
 UserGestureIndicator::UserGestureIndicator(ProcessingUserGestureState state)
     : m_previousValue(s_processingUserGesture)
 {
-    if (state == DefinitelyProcessingUserGesture)
-        s_processingUserGesture = true;
+    s_processingUserGesture = state;
 }
 
 UserGestureIndicator::~UserGestureIndicator()
diff --git a/WebCore/dom/UserGestureIndicator.h b/WebCore/dom/UserGestureIndicator.h
index d83d968..17ea319 100644
--- a/WebCore/dom/UserGestureIndicator.h
+++ b/WebCore/dom/UserGestureIndicator.h
@@ -32,19 +32,21 @@ namespace WebCore {
 
 enum ProcessingUserGestureState {
     DefinitelyProcessingUserGesture,
-    PossiblyProcessingUserGesture
+    PossiblyProcessingUserGesture,
+    DefinitelyNotProcessingUserGesture
 };
 
 class UserGestureIndicator : public Noncopyable {
 public:
-    static bool processingUserGesture() { return s_processingUserGesture; }
+    static bool processingUserGesture() { return s_processingUserGesture == DefinitelyProcessingUserGesture; }
+    static ProcessingUserGestureState getUserGestureState() { return s_processingUserGesture; }
 
     explicit UserGestureIndicator(ProcessingUserGestureState);
     ~UserGestureIndicator();
 
 private:
-    static bool s_processingUserGesture;
-    bool m_previousValue;
+    static ProcessingUserGestureState s_processingUserGesture;
+    ProcessingUserGestureState m_previousValue;
 };    
 
 } // namespace WebCore
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index c0976a9..06cf4a5 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -1245,9 +1245,7 @@ static void externalSubsetHandler(void* closure, const xmlChar*, const xmlChar*
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-#if ENABLE(XHTMLMP)
         || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
-#endif
        )
         getTokenizer(closure)->setIsXHTMLDocument(true); // controls if we replace entities or not.
 }