Merge Webkit at r70949: Initial merge by git.

Change-Id: I77b8645c083b5d0da8dba73ed01d4014aab9848e

21 files changed, 346 insertions, 93 deletions

diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index 9ad263c..272387d 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -62,6 +62,7 @@
 #include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HashChangeEvent.h"
@@ -381,7 +382,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
     , m_frameElementsShouldIgnoreScrolling(false)
     , m_containsValidityStyleRules(false)
     , m_updateFocusAppearanceRestoresSelection(false)
-    , m_writeDisabled(false)
+    , m_ignoreDestructiveWriteCount(0)
     , m_title("")
     , m_rawTitle("")
     , m_titleSetExplicitly(false)
@@ -425,6 +426,8 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
 #endif
     , m_loadEventDelayCount(0)
     , m_loadEventDelayTimer(this, &Document::loadEventDelayTimerFired)
+    , m_directionSetOnDocumentElement(false)
+    , m_writingModeSetOnDocumentElement(false)
 {
     m_document = this;
 
@@ -2178,10 +2181,8 @@ void Document::write(const SegmentedString& text, Document* ownerDocument)
         printf("Beginning a document.write at %d\n", elapsedTime());
 #endif
 
-    // If the insertion point is undefined and the Document has the
-    // "write-neutralised" flag set, then abort these steps.
     bool hasInsertionPoint = m_parser && m_parser->hasInsertionPoint();
-    if (!hasInsertionPoint && writeDisabled())
+    if (!hasInsertionPoint && m_ignoreDestructiveWriteCount)
         return;
 
     if (!hasInsertionPoint)
@@ -3924,6 +3925,9 @@ void Document::documentDidBecomeActive()
     if (renderer())
         renderView()->didMoveOnscreen();
 #endif
+
+    ASSERT(m_frame);
+    m_frame->loader()->client()->dispatchDidBecomeFrameset(isFrameSet());
 }
 
 void Document::registerForDocumentActivationCallbacks(Element* e)
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index 25122b5..2d169e7 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -841,6 +841,11 @@ public:
 
     DocumentMarkerController* markers() const { return m_markers.get(); }
 
+    bool directionSetOnDocumentElement() const { return m_directionSetOnDocumentElement; }
+    bool writingModeSetOnDocumentElement() const { return m_writingModeSetOnDocumentElement; }
+    void setDirectionSetOnDocumentElement(bool b) { m_directionSetOnDocumentElement = b; }
+    void setWritingModeSetOnDocumentElement(bool b) { m_writingModeSetOnDocumentElement = b; }
+
     bool execCommand(const String& command, bool userInterface = false, const String& value = String());
     bool queryCommandEnabled(const String& command);
     bool queryCommandIndeterm(const String& command);
@@ -1043,9 +1048,6 @@ public:
     void webkitDidExitFullScreenForElement(Element*);
 #endif
 
-    bool writeDisabled() const { return m_writeDisabled; }
-    void setWriteDisabled(bool flag) { m_writeDisabled = flag; }
-
     // Used to allow element that loads data without going through a FrameLoader to delay the 'load' event.
     void incrementLoadEventDelayCount() { ++m_loadEventDelayCount; }
     void decrementLoadEventDelayCount();
@@ -1063,6 +1065,8 @@ protected:
 
 
 private:
+    friend class IgnoreDestructiveWriteCountIncrementer;
+
     void detachParser();
 
     typedef void (*ArgumentsCallback)(const String& keyString, const String& valueString, Document*, void* data);
@@ -1220,8 +1224,8 @@ private:
     bool m_containsValidityStyleRules;
     bool m_updateFocusAppearanceRestoresSelection;
 
-    // http://www.whatwg.org/specs/web-apps/current-work/#write-neutralised
-    bool m_writeDisabled;
+    // http://www.whatwg.org/specs/web-apps/current-work/#ignore-destructive-writes-counter
+    unsigned m_ignoreDestructiveWriteCount;
 
     String m_title;
     String m_rawTitle;
@@ -1353,6 +1357,9 @@ private:
     Timer<Document> m_loadEventDelayTimer;
 
     ViewportArguments m_viewportArguments;
+    
+    bool m_directionSetOnDocumentElement;
+    bool m_writingModeSetOnDocumentElement;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/WebCore/dom/DocumentMarker.h b/WebCore/dom/DocumentMarker.h
index dd5e981..2be60f8 100644
--- a/WebCore/dom/DocumentMarker.h
+++ b/WebCore/dom/DocumentMarker.h
@@ -33,18 +33,17 @@ namespace WebCore {
 // It also optionally includes a flag specifying whether the match is active, which is ignored
 // for all types other than type TextMatch.
 struct DocumentMarker {
-
     enum MarkerType {
-        AllMarkers  = -1,
-        Spelling,
-        Grammar,
-        TextMatch,
-        Replacement,
-        CorrectionIndicator,
-        RejectedCorrection
+        Spelling = 1 << 0,
+        Grammar = 1 << 1,
+        TextMatch = 1 << 2,
+        Replacement = 1 << 3,
+        CorrectionIndicator = 1 << 4,
+        RejectedCorrection = 1 << 5,
+        AllMarkers = Spelling | Grammar | TextMatch | Replacement | CorrectionIndicator | RejectedCorrection
     };
-
     MarkerType type;
+    typedef unsigned MarkerTypes;
     unsigned startOffset;
     unsigned endOffset;
     String description;
diff --git a/WebCore/dom/DocumentMarkerController.cpp b/WebCore/dom/DocumentMarkerController.cpp
index 2b7fd85..3b7abcc 100644
--- a/WebCore/dom/DocumentMarkerController.cpp
+++ b/WebCore/dom/DocumentMarkerController.cpp
@@ -321,15 +321,11 @@ Vector<IntRect> DocumentMarkerController::renderedRectsForMarkers(DocumentMarker
     return result;
 }
 
-void DocumentMarkerController::removeMarkers(Node* node)
+void DocumentMarkerController::removeMarkers(Node* node, DocumentMarker::MarkerType markerType)
 {
-    MarkerMap::iterator i = m_markers.find(node);
-    if (i != m_markers.end()) {
-        delete i->second;
-        m_markers.remove(i);
-        if (RenderObject* renderer = node->renderer())
-            renderer->repaint();
-    }
+    MarkerMap::iterator iterator = m_markers.find(node);
+    if (iterator != m_markers.end())
+        removeMarkersFromMarkerMapVectorPair(node, iterator->second, markerType);
 }
 
 void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerType)
@@ -339,10 +335,21 @@ void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerTy
     MarkerMap::iterator end = markerMapCopy.end();
     for (MarkerMap::iterator i = markerMapCopy.begin(); i != end; ++i) {
         Node* node = i->first.get();
-        bool nodeNeedsRepaint = false;
-
-        // inner loop: process each marker in the current node
         MarkerMapVectorPair* vectorPair = i->second;
+        removeMarkersFromMarkerMapVectorPair(node, vectorPair, markerType);
+    }
+}
+
+// This function may release node and vectorPair.
+void DocumentMarkerController::removeMarkersFromMarkerMapVectorPair(Node* node, MarkerMapVectorPair* vectorPair, DocumentMarker::MarkerType markerType)
+{
+    if (markerType == DocumentMarker::AllMarkers) {
+        delete vectorPair;
+        m_markers.remove(node);
+        if (RenderObject* renderer = node->renderer())
+            renderer->repaint();
+    } else {
+        bool needsRepaint = false;
         Vector<DocumentMarker>& markers = vectorPair->first;
         Vector<IntRect>& rects = vectorPair->second;
         ASSERT(markers.size() == rects.size());
@@ -350,7 +357,7 @@ void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerTy
             DocumentMarker marker = markers[i];
 
             // skip nodes that are not of the specified type
-            if (marker.type != markerType && markerType != DocumentMarker::AllMarkers) {
+            if (marker.type != markerType) {
                 ++i;
                 continue;
             }
@@ -358,13 +365,13 @@ void DocumentMarkerController::removeMarkers(DocumentMarker::MarkerType markerTy
             // pitch the old marker
             markers.remove(i);
             rects.remove(i);
-            nodeNeedsRepaint = true;
-            // markerIterator now points to the next node
+            needsRepaint = true;
+            // i now is the index of the next marker
         }
 
-        // Redraw the node if it changed. Do this before the node is removed from m_markers, since 
+        // Redraw the node if it changed. Do this before the node is removed from m_markers, since
         // m_markers might contain the last reference to the node.
-        if (nodeNeedsRepaint) {
+        if (needsRepaint) {
             RenderObject* renderer = node->renderer();
             if (renderer)
                 renderer->repaint();
@@ -524,4 +531,40 @@ void DocumentMarkerController::setMarkersActive(Node* node, unsigned startOffset
         node->renderer()->repaint();
 }
 
+bool DocumentMarkerController::hasMarkers(Range* range, DocumentMarker::MarkerTypes markerTypes)
+{
+    if (m_markers.isEmpty())
+        return false;
+
+    Node* startContainer = range->startContainer();
+    ASSERT(startContainer);
+    Node* endContainer = range->endContainer();
+    ASSERT(endContainer);
+
+    Node* pastLastNode = range->pastLastNode();
+    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
+        Vector<DocumentMarker> markers = markersForNode(node);
+        Vector<DocumentMarker>::const_iterator end = markers.end();
+        for (Vector<DocumentMarker>::const_iterator it = markers.begin(); it != end; ++it) {
+            if (!(markerTypes & it->type))
+                continue;
+            if (node == startContainer && node == endContainer) {
+                // The range spans only one node.
+                if (it->endOffset > static_cast<unsigned>(range->startOffset()) && it->startOffset < static_cast<unsigned>(range->endOffset()))
+                    return true;
+            } else {
+                if (node == startContainer) {
+                    if (it->endOffset > static_cast<unsigned>(range->startOffset()))
+                        return true;
+                } else if (node == endContainer) {
+                    if (it->startOffset < static_cast<unsigned>(range->endOffset()))
+                        return true;
+                } else
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/dom/DocumentMarkerController.h b/WebCore/dom/DocumentMarkerController.h
index 8921baa..96fb7f3 100644
--- a/WebCore/dom/DocumentMarkerController.h
+++ b/WebCore/dom/DocumentMarkerController.h
@@ -46,10 +46,11 @@ public:
     void addMarker(Range*, DocumentMarker::MarkerType, String description = String());
     void addMarker(Node*, DocumentMarker);
     void copyMarkers(Node* srcNode, unsigned startOffset, int length, Node* dstNode, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    bool hasMarkers(Range*, DocumentMarker::MarkerTypes = DocumentMarker::AllMarkers);
     void removeMarkers(Range*, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(Node*, unsigned startOffset, int length, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void removeMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
-    void removeMarkers(Node*);
+    void removeMarkers(Node*, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void repaintMarkers(DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     void setRenderedRectForMarker(Node*, const DocumentMarker&, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
@@ -65,6 +66,7 @@ private:
     typedef std::pair<Vector<DocumentMarker>, Vector<IntRect> > MarkerMapVectorPair;
     typedef HashMap<RefPtr<Node>, MarkerMapVectorPair*> MarkerMap;
     MarkerMap m_markers;
+    void removeMarkersFromMarkerMapVectorPair(Node*, MarkerMapVectorPair*, DocumentMarker::MarkerType);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 10ba71b..a86f30a 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -31,6 +31,7 @@
 #include "CSSParser.h"
 #include "CSSSelectorList.h"
 #include "CSSStyleSelector.h"
+#include "ClassList.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "DOMTokenList.h"
@@ -52,13 +53,13 @@
 #include "RenderLayer.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
-#include "SVGStyledLocatableElement.h"
 #include "Settings.h"
 #include "TextIterator.h"
 #include "XMLNames.h"
 #include <wtf/text/CString.h>
 
 #if ENABLE(SVG)
+#include "SVGElement.h"
 #include "SVGNames.h"
 #endif
 
@@ -457,6 +458,41 @@ int Element::scrollHeight() const
     return 0;
 }
 
+IntRect Element::boundsInWindowSpace() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+
+    FrameView* view = document()->view();
+    if (!view)
+        return IntRect();
+
+    Vector<FloatQuad> quads;
+#if ENABLE(SVG)
+    if (isSVGElement() && renderer()) {
+        // Get the bounding rectangle from the SVG model.
+        const SVGElement* svgElement = static_cast<const SVGElement*>(this);
+        FloatRect localRect;
+        if (svgElement->boundingBox(localRect))
+            quads.append(renderer()->localToAbsoluteQuad(localRect));
+    } else
+#endif
+    {
+        // Get the bounding rectangle from the box model.
+        if (renderBoxModelObject())
+            renderBoxModelObject()->absoluteQuads(quads);
+    }
+
+    if (quads.isEmpty())
+        return IntRect();
+
+    IntRect result = quads[0].enclosingBoundingBox();
+    for (size_t i = 1; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    result = view->contentsToWindow(result);
+    return result;
+}
+
 PassRefPtr<ClientRectList> Element::getClientRects() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -488,15 +524,12 @@ PassRefPtr<ClientRect> Element::getBoundingClientRect() const
 
     Vector<FloatQuad> quads;
 #if ENABLE(SVG)
-    if (isSVGElement()) {
+    if (isSVGElement() && renderer()) {
         // Get the bounding rectangle from the SVG model.
         const SVGElement* svgElement = static_cast<const SVGElement*>(this);
-        if (svgElement->isStyledLocatable()) {
-            if (renderer()) {
-                const FloatRect& localRect = static_cast<const SVGStyledLocatableElement*>(svgElement)->getBBox();
-                quads.append(renderer()->localToAbsoluteQuad(localRect));
-            }
-        }
+        FloatRect localRect;
+        if (svgElement->boundingBox(localRect))
+            quads.append(renderer()->localToAbsoluteQuad(localRect));
     } else
 #endif
     {
@@ -517,9 +550,7 @@ PassRefPtr<ClientRect> Element::getBoundingClientRect() const
         result.move(-visibleContentRect.x(), -visibleContentRect.y());
     }
 
-    if (renderBoxModelObject())
-        adjustIntRectForAbsoluteZoom(result, renderBoxModelObject());
-
+    adjustIntRectForAbsoluteZoom(result, renderer());
     return ClientRect::create(result);
 }
 
@@ -1588,7 +1619,7 @@ DOMTokenList* Element::classList()
 {
     ElementRareData* data = ensureRareData();
     if (!data->m_classList)
-        data->m_classList = DOMTokenList::create(this);
+        data->m_classList = ClassList::create(this);
     return data->m_classList.get();
 }
 
@@ -1681,4 +1712,37 @@ void Element::webkitRequestFullScreen(unsigned short flags)
 }
 #endif    
 
+SpellcheckAttributeState Element::spellcheckAttributeState() const
+{
+    if (!hasAttribute(HTMLNames::spellcheckAttr))
+        return SpellcheckAttributeDefault;
+
+    const AtomicString& value = getAttribute(HTMLNames::spellcheckAttr);
+    if (equalIgnoringCase(value, "true") || equalIgnoringCase(value, ""))
+        return SpellcheckAttributeTrue;
+    if (equalIgnoringCase(value, "false"))
+        return SpellcheckAttributeFalse;
+
+    return SpellcheckAttributeDefault;
+}
+
+bool Element::isSpellCheckingEnabled() const
+{
+    const Element* element = this;
+    while (element) {
+        switch (element->spellcheckAttributeState()) {
+        case SpellcheckAttributeTrue:
+            return true;
+        case SpellcheckAttributeFalse:
+            return false;
+        case SpellcheckAttributeDefault:
+            break;
+        }
+
+        element = element->parentElement();
+    }
+
+    return true;
+}
+
 } // namespace WebCore
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index b890ecd..67887cc 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -40,6 +40,12 @@ class DOMTokenList;
 class ElementRareData;
 class IntSize;
 
+enum SpellcheckAttributeState {
+    SpellcheckAttributeTrue,
+    SpellcheckAttributeFalse,
+    SpellcheckAttributeDefault
+};
+
 class Element : public ContainerNode {
 public:
     static PassRefPtr<Element> create(const QualifiedName&, Document*);
@@ -159,6 +165,8 @@ public:
     virtual int scrollWidth() const;
     virtual int scrollHeight() const;
 
+    IntRect boundsInWindowSpace() const;
+
     PassRefPtr<ClientRectList> getClientRects() const;
     PassRefPtr<ClientRect> getBoundingClientRect() const;
 
@@ -318,6 +326,8 @@ public:
     void webkitRequestFullScreen(unsigned short flags);
 #endif
 
+    bool isSpellCheckingEnabled() const;
+
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
         : ContainerNode(document, type)
@@ -373,7 +383,9 @@ private:
 
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
-    
+
+    SpellcheckAttributeState spellcheckAttributeState() const;
+
 private:
     mutable RefPtr<NamedNodeMap> m_attributeMap;
 };
diff --git a/WebCore/dom/ElementRareData.h b/WebCore/dom/ElementRareData.h
index f1e6334..06bfe0c 100644
--- a/WebCore/dom/ElementRareData.h
+++ b/WebCore/dom/ElementRareData.h
@@ -22,7 +22,7 @@
 #ifndef ElementRareData_h
 #define ElementRareData_h
 
-#include "DOMTokenList.h"
+#include "ClassList.h"
 #include "DatasetDOMStringMap.h"
 #include "Element.h"
 #include "NodeRareData.h"
@@ -43,7 +43,7 @@ public:
     RefPtr<RenderStyle> m_computedStyle;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
-    OwnPtr<DOMTokenList> m_classList;
+    OwnPtr<ClassList> m_classList;
 };
 
 inline IntSize defaultMinimumSizeForResizing()
diff --git a/WebCore/dom/EventListener.h b/WebCore/dom/EventListener.h
index 96bc858..96d0beb 100644
--- a/WebCore/dom/EventListener.h
+++ b/WebCore/dom/EventListener.h
@@ -43,7 +43,8 @@ namespace WebCore {
             ObjCEventListenerType,
             CPPEventListenerType,
             ConditionEventListenerType,
-            GObjectEventListenerType
+            GObjectEventListenerType,
+            NativeEventListenerType
         };
 
         virtual ~EventListener() { }
diff --git a/WebCore/dom/ExceptionCode.cpp b/WebCore/dom/ExceptionCode.cpp
index 9303f9e..f048fe5 100644
--- a/WebCore/dom/ExceptionCode.cpp
+++ b/WebCore/dom/ExceptionCode.cpp
@@ -42,6 +42,10 @@
 #include "SQLException.h"
 #endif
 
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#include "FileException.h"
+#endif
+
 namespace WebCore {
 
 static const char* const exceptionNames[] = {
@@ -173,6 +177,38 @@ static const char* const sqlExceptionDescriptions[] = {
 };
 #endif
 
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+static const char* const fileExceptionNames[] = {
+    "NOT_FOUND_ERR",
+    "SECURITY_ERR",
+    "ABORT_ERR",
+    "NOT_READABLE_ERR",
+    "ENCODING_ERR",
+    "NO_MODIFICATION_ALLOWED_ERR",
+    "INVALID_STATE_ERR",
+    "SYNTAX_ERR",
+    "INVALID_MODIFICATION_ERR",
+    "QUOTA_EXCEEDED_ERR",
+    "TYPE_MISMATCH_ERR",
+    "PATH_EXISTS_ERR"
+};
+
+static const char* const fileExceptionDescriptions[] = {
+    "A requested file or directory could not be found at the time an operation was processed.",
+    "It was determined that certain files are unsafe for access within a Web application, or that too many calls are being made on file resources.",
+    "An ongoing operation was aborted, typically with a call to abort().",
+    "The requested file could not be read, typically due to permission problems that have occured after a reference to a file was acquired.",
+    "A URI supplied to the API was malformed, or the resulting Data URL has exceeded the URL length limitations for Data URLs.",
+    "An attempt was made to write to a file or directory which could not be modified due to the state of the underlying filesystem.",
+    "An operation that depends on state cached in an interface object was made but the state had changed since it was read from disk.",
+    "An invalid or unsupported argument was given, like an invalid line ending specifier.",
+    "The modification request was illegal.",
+    "The operation failed because it would cause the application to exceed its storage quota.",
+    "The path supplied exists, but was not an entry of requested type.",
+    "An attempt was made to create a file or directory where an element already exists."
+};
+#endif
+
 void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& description)
 {
     ASSERT(ec);
@@ -241,6 +277,16 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         nameTableSize = sizeof(sqlExceptionNames) / sizeof(sqlExceptionNames[0]);
         nameTableOffset = SQLException::UNKNOWN_ERR;
 #endif
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+    } else if (code >= FileException::FileExceptionOffset && code <= FileException::FileExceptionMax) {
+        type = FileExceptionType;
+        typeName = "DOM File";
+        code -= FileException::FileExceptionOffset;
+        nameTable = fileExceptionNames;
+        descriptionTable = fileExceptionDescriptions;
+        nameTableSize = sizeof(fileExceptionNames) / sizeof(fileExceptionNames[0]);
+        nameTableOffset = FileException::NOT_FOUND_ERR;
+#endif
     } else {
         type = DOMExceptionType;
         typeName = "DOM";
diff --git a/WebCore/dom/ExceptionCode.h b/WebCore/dom/ExceptionCode.h
index cbbf650..6ea9f7d 100644
--- a/WebCore/dom/ExceptionCode.h
+++ b/WebCore/dom/ExceptionCode.h
@@ -81,6 +81,9 @@ namespace WebCore {
 #if ENABLE(DATABASE)
         , SQLExceptionType
 #endif
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+        , FileExceptionType
+#endif
     };
 
 
diff --git a/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h b/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h
new file mode 100644
index 0000000..9d1835a
--- /dev/null
+++ b/WebCore/dom/IgnoreDestructiveWriteCountIncrementer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IgnoreDestructiveWriteCountIncrementer_h
+#define IgnoreDestructiveWriteCountIncrementer_h
+
+#include "Document.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class IgnoreDestructiveWriteCountIncrementer : public Noncopyable {
+public:
+    explicit IgnoreDestructiveWriteCountIncrementer(Document* document)
+        : m_count(document ? &document->m_ignoreDestructiveWriteCount : 0)
+    {
+        if (!m_count)
+            return;
+        ++(*m_count);
+    }
+
+    ~IgnoreDestructiveWriteCountIncrementer()
+    {
+        if (!m_count)
+            return;
+        --(*m_count);
+    }
+
+private:
+    unsigned* m_count;
+};
+
+}
+
+#endif
diff --git a/WebCore/dom/InputElement.cpp b/WebCore/dom/InputElement.cpp
index ecae206..85f37e1 100644
--- a/WebCore/dom/InputElement.cpp
+++ b/WebCore/dom/InputElement.cpp
@@ -107,10 +107,7 @@ void InputElement::updateSelectionRange(InputElement* inputElement, Element* ele
     if (!inputElement->isTextField())
         return;
 
-    element->document()->updateLayoutIgnorePendingStylesheets();
-
-    if (RenderTextControl* renderer = toRenderTextControl(element->renderer()))
-        renderer->setSelectionRange(start, end);
+    setSelectionRange(element, start, end);
 }
 
 void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
diff --git a/WebCore/dom/KeyboardEvent.h b/WebCore/dom/KeyboardEvent.h
index 793ac41..30a2ef0 100644
--- a/WebCore/dom/KeyboardEvent.h
+++ b/WebCore/dom/KeyboardEvent.h
@@ -33,8 +33,9 @@ namespace WebCore {
 
 #if PLATFORM(MAC)
     struct KeypressCommand {
-        KeypressCommand(const String& commandName) : commandName(commandName) {}
-        KeypressCommand(const String& commandName, const String& text) : commandName(commandName), text(text) { ASSERT(commandName == "insertText:"); }
+        KeypressCommand() { }
+        KeypressCommand(const String& commandName) : commandName(commandName) { }
+        KeypressCommand(const String& commandName, const String& text) : commandName(commandName), text(text) { ASSERT(commandName == "insertText:" || commandName == "insertText"); }
 
         String commandName;
         String text;
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 5c67bfd..cea2e07 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -1085,13 +1085,13 @@ static bool isChildTypeAllowed(Node* newParent, Node* child)
     if (child->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
         if (!newParent->childTypeAllowed(child->nodeType()))
             return false;
+        return true;
     }
     
     for (Node *n = child->firstChild(); n; n = n->nextSibling()) {
         if (!newParent->childTypeAllowed(n->nodeType()))
             return false;
     }
-
     return true;
 }
 
@@ -2992,7 +2992,7 @@ void Node::defaultEventHandler(Event* event)
             if (Frame* frame = document()->frame())
                 frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
 #if ENABLE(PAN_SCROLLING)
-    } else if (eventType == eventNames().mousedownEvent) {
+    } else if (eventType == eventNames().mousedownEvent && event->isMouseEvent()) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         if (mouseEvent->button() == MiddleButton) {
             if (enclosingLinkEventParentOrSelf())
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index 46c85e3..28c7594 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -33,6 +33,7 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "HTMLScriptElement.h"
+#include "IgnoreDestructiveWriteCountIncrementer.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "ScriptController.h"
@@ -57,14 +58,6 @@ void ScriptElement::insertedIntoDocument(ScriptElementData& data, const String&
 
     // http://www.whatwg.org/specs/web-apps/current-work/#script
 
-    // If the element's Document has an active parser, and the parser's script
-    // nesting level is non-zero, but this script element does not have the
-    // "parser-inserted" flag set, the user agent must set the element's
-    // "write-neutralised" flag.
-    DocumentParser* parser = data.element()->document()->parser();
-    if (parser && parser->hasInsertionPoint())
-        data.setWriteDisabled(true);
-
     if (!sourceUrl.isEmpty()) {
         data.requestScript(sourceUrl);
         return;
@@ -142,7 +135,6 @@ ScriptElementData::ScriptElementData(ScriptElement* scriptElement, Element* elem
     , m_element(element)
     , m_cachedScript(0)
     , m_createdByParser(false)
-    , m_writeDisabled(false)
     , m_requested(false)
     , m_evaluated(false)
     , m_firedLoad(false)
@@ -191,7 +183,9 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
     if (m_evaluated || sourceCode.isEmpty() || !shouldExecuteAsJavaScript())
         return;
 
-    if (Frame* frame = m_element->document()->frame()) {
+    RefPtr<Document> document = m_element->document();
+    ASSERT(document);
+    if (Frame* frame = document->frame()) {
         if (!frame->script()->canExecuteScripts(AboutToExecuteScript))
             return;
 
@@ -199,25 +193,12 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
 
         // http://www.whatwg.org/specs/web-apps/current-work/#script
 
-        // If the script element's "write-neutralised" flag is set, then flag
-        // the Document the script element was in when the "write-neutralised"
-        // flag was set as being itself "write-neutralised". Let neutralised doc
-        // be that Document.
-        if (m_writeDisabled) {
-            ASSERT(!m_element->document()->writeDisabled());
-            m_element->document()->setWriteDisabled(true);
-        }
-
-        // Create a script from the script element node, using the script
-        // block's source and the script block's type.
-        // Note: This is where the script is compiled and actually executed.
-        frame->script()->evaluate(sourceCode);
-
-        // Remove the "write-neutralised" flag from neutralised doc, if it was
-        // set in the earlier step.
-        if (m_writeDisabled) {
-            ASSERT(m_element->document()->writeDisabled());
-            m_element->document()->setWriteDisabled(false);
+        {
+            IgnoreDestructiveWriteCountIncrementer ignoreDesctructiveWriteCountIncrementer(m_requested ? document.get() : 0);
+            // Create a script from the script element node, using the script
+            // block's source and the script block's type.
+            // Note: This is where the script is compiled and actually executed.
+            frame->script()->evaluate(sourceCode);
         }
 
         Document::updateStyleForAllDocuments();
diff --git a/WebCore/dom/ScriptElement.h b/WebCore/dom/ScriptElement.h
index 698ffbc..c663e43 100644
--- a/WebCore/dom/ScriptElement.h
+++ b/WebCore/dom/ScriptElement.h
@@ -82,8 +82,6 @@ public:
     Element* element() const { return m_element; }
     bool createdByParser() const { return m_createdByParser; }
     void setCreatedByParser(bool value) { m_createdByParser = value; }
-    bool writeDisabled() const { return m_writeDisabled; }
-    void setWriteDisabled(bool value) { m_writeDisabled = value; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
     void setHaveFiredLoadEvent(bool firedLoad) { m_firedLoad = firedLoad; }
 
@@ -101,7 +99,6 @@ private:
     Element* m_element;
     CachedResourceHandle<CachedScript> m_cachedScript;
     bool m_createdByParser; // HTML5: "parser-inserted"
-    bool m_writeDisabled; // http://www.whatwg.org/specs/web-apps/current-work/#write-neutralised
     bool m_requested;
     bool m_evaluated; // HTML5: "already started"
     bool m_firedLoad;
diff --git a/WebCore/dom/SpaceSplitString.cpp b/WebCore/dom/SpaceSplitString.cpp
index 8a2710c..4bd5b1b 100644
--- a/WebCore/dom/SpaceSplitString.cpp
+++ b/WebCore/dom/SpaceSplitString.cpp
@@ -23,6 +23,7 @@
 
 #include "HTMLParserIdioms.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace WTF;
 
@@ -90,4 +91,37 @@ bool SpaceSplitStringData::containsAll(SpaceSplitStringData& other)
     return true;
 }
 
+void SpaceSplitStringData::add(const AtomicString& string)
+{
+    if (contains(string))
+        return;
+
+    m_vector.append(string);
+}
+
+void SpaceSplitStringData::remove(const AtomicString& string)
+{
+    ensureVector();
+
+    size_t position = 0;
+    while (position < m_vector.size()) {
+        if (m_vector[position] == string)
+            m_vector.remove(position);
+        else
+            ++position;
+    }
+}
+
+void SpaceSplitString::add(const AtomicString& string)
+{
+    if (m_data)
+        m_data->add(string);
+}
+
+void SpaceSplitString::remove(const AtomicString& string)
+{
+    if (m_data)
+        m_data->remove(string);
+}
+
 } // namespace WebCore
diff --git a/WebCore/dom/SpaceSplitString.h b/WebCore/dom/SpaceSplitString.h
index 09ca8d9..826e6bd 100644
--- a/WebCore/dom/SpaceSplitString.h
+++ b/WebCore/dom/SpaceSplitString.h
@@ -48,6 +48,9 @@ namespace WebCore {
 
         bool containsAll(SpaceSplitStringData&);
 
+        void add(const AtomicString&);
+        void remove(const AtomicString&);
+
         size_t size() { ensureVector(); return m_vector.size(); }
         const AtomicString& operator[](size_t i) { ensureVector(); ASSERT(i < size()); return m_vector[i]; }
 
@@ -72,6 +75,8 @@ namespace WebCore {
 
         bool contains(const AtomicString& string) const { return m_data && m_data->contains(string); }
         bool containsAll(const SpaceSplitString& names) const { return !names.m_data || (m_data && m_data->containsAll(*names.m_data)); }
+        void add(const AtomicString&);
+        void remove(const AtomicString&);
 
         size_t size() const { return m_data ? m_data->size() : 0; }
         bool isNull() const { return !m_data; }
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index 12744cb..7384c0b 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -25,6 +25,7 @@
 #include "StyledElement.h"
 
 #include "Attribute.h"
+#include "ClassList.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -222,7 +223,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     if (hasClass) {
         attributes()->setClass(newClassString);
         if (DOMTokenList* classList = optionalClassList())
-            classList->reset(newClassString);
+            static_cast<ClassList*>(classList)->reset(newClassString);
     } else if (attributeMap())
         attributeMap()->clearClass();
     setNeedsStyleRecalc();
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 4b62388..8040dbf 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -32,7 +32,6 @@
 namespace WebCore {
 
 class Attribute;
-class ClassList;
 class CSSMappedAttributeDeclaration;
 
 class StyledElement : public Element {