Merge in WebKit r47029.

1 files changed, 139 insertions, 163 deletions

diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index af0fdad..bffe8af 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -31,7 +31,11 @@
 #include "config.h"
 #include "FrameLoader.h"
 
+#ifdef MANUAL_MERGE_REQUIRED
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+#else // MANUAL_MERGE_REQUIRED
+#include "ApplicationCacheHost.h"
+#endif // MANUAL_MERGE_REQUIRED
 #include "Archive.h"
 #include "ArchiveFactory.h"
 #endif
@@ -56,7 +60,6 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "HTMLAnchorElement.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
@@ -73,6 +76,7 @@
 #include "Page.h"
 #include "PageCache.h"
 #include "PageGroup.h"
+#include "PlaceholderDocument.h"
 #include "PluginData.h"
 #include "PluginDocument.h"
 #include "ProgressTracker.h"
@@ -92,13 +96,10 @@
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
 #include "XMLTokenizer.h"
+#include "XSSAuditor.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheResource.h"
-#endif
 
 #if ENABLE(SVG)
 #include "SVGDocument.h"
@@ -126,35 +127,6 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
-
-static URLSchemesMap& localSchemes()
-{
-    DEFINE_STATIC_LOCAL(URLSchemesMap, localSchemes, ());
-
-    if (localSchemes.isEmpty()) {
-        localSchemes.add("file");
-#if PLATFORM(MAC)
-        localSchemes.add("applewebdata");
-#endif
-#if PLATFORM(QT)
-        localSchemes.add("qrc");
-#endif
-    }
-
-    return localSchemes;
-}
-
-static URLSchemesMap& noAccessSchemes()
-{
-    DEFINE_STATIC_LOCAL(URLSchemesMap, noAccessSchemes, ());
-
-    if (noAccessSchemes.isEmpty())
-        noAccessSchemes.add("data");
-
-    return noAccessSchemes;
-}
-
 struct ScheduledRedirection {
     enum Type { redirection, locationChange, historyNavigation, formSubmission };
 
@@ -252,6 +224,7 @@ bool isBackForwardLoadType(FrameLoadType type)
         case FrameLoadTypeReplace:
             return false;
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
             return true;
@@ -310,9 +283,6 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
-#if ENABLE(WML)
-    , m_forceReloadWmlDeck(false)
-#endif
 {
 }
 
@@ -463,7 +433,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, userGestureHint());
+        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -506,7 +476,7 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     RenderObject* renderer = ownerElement->renderer();
     FrameView* view = frame->view();
     if (renderer && renderer->isWidget() && view)
-        static_cast<RenderWidget*>(renderer)->setWidget(view);
+        toRenderWidget(renderer)->setWidget(view);
     
     checkCallImplicitClose();
     
@@ -526,7 +496,7 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
 
 void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<FormData> formData,
     const String& target, const String& contentType, const String& boundary,
-    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
 {
     ASSERT(action);
     ASSERT(strcmp(action, "GET") == 0 || strcmp(action, "POST") == 0);
@@ -598,6 +568,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
+#ifdef MANUAL_MERGE_REQUIRED
     // Navigation of a subframe during loading of the main frame does not create a new back/forward item.
     // Strangely, we only implement this rule for form submission; time will tell if we need it for other types of navigation.
     // The definition of "during load" is any time before the load event has been handled.
@@ -612,6 +583,9 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     }
 
     targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, lockBackForwardList, event, formState);
+#else // MANUAL_MERGE_REQUIRED
+    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
+#endif // MANUAL_MERGE_REQUIRED
 }
 
 void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
@@ -780,15 +754,16 @@ bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool
     if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
         return true;
 
-    String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
+    const int javascriptSchemeLength = sizeof("javascript:") - 1;
+
+    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
     ScriptValue result = executeScript(script, userGesture);
 
     String scriptResult;
     if (!result.getString(scriptResult))
         return true;
 
-    SecurityOrigin* currentSecurityOrigin = 0;
-    currentSecurityOrigin = m_frame->document()->securityOrigin();
+    SecurityOrigin* currentSecurityOrigin = m_frame->document()->securityOrigin();
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
@@ -949,6 +924,8 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     // Create a new document before clearing the frame, because it may need to inherit an aliased security context.
     if (!m_isDisplayingInitialEmptyDocument && m_client->shouldUsePluginDocument(m_responseMIMEType))
         document = PluginDocument::create(m_frame);
+    else if (!m_client->hasHTMLView())
+        document = PlaceholderDocument::create(m_frame);
     else
         document = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
 
@@ -966,7 +943,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     KURL ref(url);
     ref.setUser(String());
     ref.setPass(String());
-    ref.setRef(String());
+    ref.removeFragmentIdentifier();
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
@@ -1007,8 +984,8 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     restoreDocumentState();
 
     document->implicitOpen();
-
-    if (m_frame->view())
+    
+    if (m_frame->view() && m_client->hasHTMLView())
         m_frame->view()->setContentsSize(IntSize());
 }
 
@@ -1170,6 +1147,12 @@ void FrameLoader::startIconLoader()
         }
     }
 
+    // People who want to avoid loading images generally want to avoid loading all images.
+    // Now that we've accounted for URL mapping, avoid starting the network load if images aren't set to display automatically.
+    Settings* settings = m_frame->settings();
+    if (settings && !settings->loadsImagesAutomatically())
+        return;
+
     // This is either a reload or the icon database said "yes, load the icon", so kick off the load!
     if (!m_iconLoader)
         m_iconLoader.set(IconLoader::create(m_frame).release());
@@ -1213,6 +1196,7 @@ void FrameLoader::restoreDocumentState()
         case FrameLoadTypeReplace:
             break;
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
         case FrameLoadTypeRedirectWithLockedBackForwardList:
@@ -1233,16 +1217,16 @@ void FrameLoader::gotoAnchor()
     // OTOH If CSS target was set previously, we want to set it to 0, recalc
     // and possibly repaint because :target pseudo class may have been
     // set (see bug 11321).
-    if (!m_URL.hasRef() && !m_frame->document()->cssTarget())
+    if (!m_URL.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
         return;
 
-    String ref = m_URL.ref();
-    if (gotoAnchor(ref))
+    String fragmentIdentifier = m_URL.fragmentIdentifier();
+    if (gotoAnchor(fragmentIdentifier))
         return;
 
     // Try again after decoding the ref, based on the document's encoding.
     if (m_decoder)
-        gotoAnchor(decodeURLEscapeSequences(ref, m_decoder->encoding()));
+        gotoAnchor(decodeURLEscapeSequences(fragmentIdentifier, m_decoder->encoding()));
 }
 
 void FrameLoader::finishedParsing()
@@ -1378,6 +1362,20 @@ void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
         scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
 }
 
+static bool mustLockBackForwardList(Frame* targetFrame)
+{
+    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
+    // The definition of "during load" is any time before all handlers for the load event have been run.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    
+    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
+        Document* document = ancestor->document();
+        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+            return true;
+    }
+    return false;
+}    
+
 void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
 {
     if (!m_frame->page())
@@ -1386,10 +1384,12 @@ void FrameLoader::scheduleLocationChange(const String& url, const String& referr
     if (url.isEmpty())
         return;
 
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
+
     // If the URL we're going to navigate to is the same as the current one, except for the
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(url);
-    if (parsedURL.hasRef() && equalIgnoringRef(m_URL, parsedURL)) {
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
         changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
         return;
     }
@@ -1402,7 +1402,7 @@ void FrameLoader::scheduleLocationChange(const String& url, const String& referr
 }
 
 void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
-    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
 {
     ASSERT(m_frame->page());
     ASSERT(!frameRequest.isEmpty());
@@ -1414,7 +1414,7 @@ void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_committedFirstRealDocumentLoad;
 
-    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
+    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
 }
 
 void FrameLoader::scheduleRefresh(bool wasUserGesture)
@@ -1632,6 +1632,7 @@ bool FrameLoader::gotoAnchor(const String& name)
     if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
         return false;
 
+#ifdef MANUAL_MERGE_REQUIRED
     // We need to update the layout before scrolling, otherwise we could
     // really mess things up if an anchor scroll comes at a bad moment.
     m_frame->document()->updateStyleIfNeeded();
@@ -1660,6 +1661,10 @@ bool FrameLoader::gotoAnchor(const String& name)
 #ifdef ANDROID_SCROLL_ON_GOTO_ANCHOR
     android::WebFrame::getWebFrame(m_frame)->setUserInitiatedClick(false);
 #endif
+#else // MANUAL_MERGE_REQUIRED
+    if (FrameView* view = m_frame->view())
+        view->maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
+#endif // MANUAL_MERGE_REQUIRED
 
     return true;
 }
@@ -1669,6 +1674,11 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
+    
+    if (!m_frame->script()->xssAuditor()->canLoadObject(url)) {
+        // It is unsafe to honor the request for this object.
+        return false;
+    }
 
     KURL completedURL;
     if (!url.isEmpty())
@@ -1733,7 +1743,7 @@ static HTMLPlugInElement* toPlugInElement(Node* node)
 bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String& mimeType, 
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
 {
-    Widget* widget = 0;
+    RefPtr<Widget> widget;
 
     if (renderer && !useFallback) {
         HTMLPlugInElement* element = toPlugInElement(renderer->node());
@@ -1819,7 +1829,7 @@ void FrameLoader::provisionalLoadStarted()
     m_client->provisionalLoadStarted();
 }
 
-bool FrameLoader::userGestureHint()
+bool FrameLoader::isProcessingUserGesture()
 {
     Frame* frame = m_frame->tree()->top();
     if (!frame->script()->isEnabled())
@@ -1848,6 +1858,17 @@ void FrameLoader::addData(const char* bytes, int length)
     write(bytes, length);
 }
 
+#if ENABLE(WML)
+static inline bool frameContainsWMLContent(Frame* frame)
+{
+    Document* document = frame ? frame->document() : 0;
+    if (!document)
+        return false;
+
+    return document->containsWMLContent() || document->isWMLDocument();
+}
+#endif
+
 bool FrameLoader::canCachePageContainingThisFrame()
 {
     return m_documentLoader
@@ -1873,8 +1894,10 @@ bool FrameLoader::canCachePageContainingThisFrame()
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
-        && !m_documentLoader->applicationCache()
-        && !m_documentLoader->candidateApplicationCacheGroup()
+        && m_documentLoader->applicationCacheHost()->canCacheInPageCache()
+#endif
+#if ENABLE(WML)
+        && !frameContainsWMLContent(m_frame)
 #endif
         && m_client->canCachePage()
         ;
@@ -2021,10 +2044,8 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
         if (!m_frame->document()->canSuspendActiveDOMObjects())
             { PCLOG("   -The document cannot suspect its active DOM Objects"); cannotCache = true; }
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        if (m_documentLoader->applicationCache())
-            { PCLOG("   -The DocumentLoader has an active application cache"); cannotCache = true; }
-        if (m_documentLoader->candidateApplicationCacheGroup())
-            { PCLOG("   -The DocumentLoader has a candidateApplicationCacheGroup"); cannotCache = true; }
+        if (!m_documentLoader->applicationCacheHost()->canCacheInPageCache())
+            { PCLOG("   -The DocumentLoader uses an application cache"); cannotCache = true; }
 #endif
         if (!m_client->canCachePage())
             { PCLOG("   -The client says this frame cannot be cached"); cannotCache = true; }
@@ -2056,10 +2077,39 @@ void FrameLoader::setFirstPartyForCookies(const KURL& url)
         child->loader()->setFirstPartyForCookies(url);
 }
 
+class HashChangeEventTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<HashChangeEventTask> create(PassRefPtr<Document> document)
+    {
+        return adoptRef(new HashChangeEventTask(document));
+    }
+    
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        ASSERT_UNUSED(context, context->isDocument());
+        m_document->dispatchWindowEvent(eventNames().hashchangeEvent, false, false);
+    }
+    
+private:
+    HashChangeEventTask(PassRefPtr<Document> document)
+        : m_document(document)
+    {
+        ASSERT(m_document);
+    }
+    
+    RefPtr<Document> m_document;
+};
+    
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
 {
+    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
+    if (equalIgnoringFragmentIdentifier(url, m_URL) && !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
+        Document* currentDocument = frame()->document();
+        currentDocument->postTask(HashChangeEventTask::create(currentDocument));
+    }
+    
     m_URL = url;
     updateHistoryForAnchorScroll();
 
@@ -2162,7 +2212,7 @@ void FrameLoader::completed()
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
     if (m_frame->view())
-        m_frame->view()->setLockedToAnchor(false);
+        m_frame->view()->maintainScrollPositionAtAnchor(0);
 }
 
 void FrameLoader::started()
@@ -2224,7 +2274,7 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
         referrer = m_outgoingReferrer;
 
     ASSERT(frame()->document());
-    if (shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
+    if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
         if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
@@ -2439,7 +2489,7 @@ bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Documen
 bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
 {
     // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!shouldTreatURLAsLocal(url.string()))
+    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
         return true;
 
     // If we were provided a document, we let its local file policy dictate the result,
@@ -2447,7 +2497,7 @@ bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Securit
     if (securityOrigin)
         return securityOrigin->canLoadLocalResources();
     if (!referrer.isEmpty())
-        return shouldTreatURLAsLocal(referrer);
+        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
     return false;
 }
 
@@ -2457,7 +2507,7 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     if (!frame)
         return;
 
-    frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
+    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
 }
 
 bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
@@ -2674,7 +2724,7 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
             targetDocument->url().string().utf8().data(), activeDocument->url().string().utf8().data());
 
         // FIXME: should we print to the console of the activeFrame as well?
-        targetFrame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String());
+        targetFrame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String());
     }
     
     return false;
@@ -2933,6 +2983,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
     switch (m_loadType) {
         case FrameLoadTypeForward:
         case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeIndexedBackForward:
             if (Page* page = m_frame->page())
                 if (page->backForwardList()) {
@@ -2990,10 +3041,12 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
     
     m_committedFirstRealDocumentLoad = true;
 
-    // For non-cached HTML pages, these methods are called in FrameLoader::begin.
-    if (cachedPage || !m_client->hasHTMLView()) {
-        dispatchDidCommitLoad(); 
-            
+    if (!m_client->hasHTMLView())
+        receivedFirstData();
+    else if (cachedPage) {
+        // For non-cached HTML pages, these methods are called in receivedFirstData().
+        dispatchDidCommitLoad();
+
         // If we have a title let the WebView know about it. 
         if (!ptitle.isNull()) 
             m_client->dispatchDidReceiveTitle(ptitle);         
@@ -3028,27 +3081,20 @@ void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireD
     m_quickRedirectComing = lockBackForwardList && m_documentLoader && !m_isExecutingJavaScriptFormAction;
 }
 
-#if ENABLE(WML)
-void FrameLoader::setForceReloadWmlDeck(bool reload)
-{
-    m_forceReloadWmlDeck = reload;
-}
-#endif
-
 bool FrameLoader::shouldReload(const KURL& currentURL, const KURL& destinationURL)
 {
 #if ENABLE(WML)
-    // As for WML deck, sometimes it's supposed to be reloaded even if the same URL with fragment
-    if (m_forceReloadWmlDeck)
+    // All WML decks are supposed to be reloaded, even within the same URL fragment
+    if (frameContainsWMLContent(m_frame))
         return true;
 #endif
 
     // This function implements the rule: "Don't reload if navigating by fragment within
     // the same URL, but do reload if going to a new URL or to the same URL with no
     // fragment identifier at all."
-    if (!destinationURL.hasRef())
+    if (!destinationURL.hasFragmentIdentifier())
         return true;
-    return !equalIgnoringRef(currentURL, destinationURL);
+    return !equalIgnoringFragmentIdentifier(currentURL, destinationURL);
 }
 
 void FrameLoader::closeOldDataSources()
@@ -3083,6 +3129,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     }
 
     open(*cachedPage.cachedMainFrame());
+    cachedPage.restore(m_frame->page());
 
     checkCompleted();
 }
@@ -3753,30 +3800,11 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         ASSERT(!newRequest.isNull());
         
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        ApplicationCacheResource* resource;
-        if (documentLoader()->shouldLoadResourceFromApplicationCache(newRequest, resource)) {
-            if (resource) {
-                response = resource->response();
-                data.append(resource->data()->data(), resource->data()->size());
-            } else
-                error = cannotShowURLError(newRequest);
-        } else {
+        if (!documentLoader()->applicationCacheHost()->maybeLoadSynchronously(newRequest, error, response, data)) {
 #endif
             ResourceHandle::loadResourceSynchronously(newRequest, storedCredentials, error, response, data, m_frame);
-
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-            // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
-            // or if there were network errors (but not if the user canceled the download), then instead get, from the cache, the resource of the fallback entry
-            // corresponding to the matched namespace.
-            if ((!error.isNull() && !error.isCancellation())
-                 || response.httpStatusCode() / 100 == 4 || response.httpStatusCode() / 100 == 5
-                 || !protocolHostAndPortAreEqual(newRequest.url(), response.url())) {
-                if (documentLoader()->getApplicationCacheFallbackResource(newRequest, resource)) {
-                    response = resource->response();
-                    data.clear();
-                    data.append(resource->data()->data(), resource->data()->size());
-                }
-            }
+            documentLoader()->applicationCacheHost()->maybeLoadFallbackSynchronously(newRequest, error, response, data);
         }
 #endif
     }
@@ -4505,7 +4533,8 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
 
 #if ENABLE(WML)
-    if (m_frame->document()->isWMLDocument())
+    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
+    if (frameContainsWMLContent(m_frame))
         shouldScroll = false;
 #endif
 
@@ -4591,7 +4620,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 // have the item vanish when we try to use it in the ensuing nav.  This should be
                 // extremely rare, but in that case the user will get an error on the navigation.
                 
-                if (ResourceHandle::willLoadFromCache(request))
+                if (ResourceHandle::willLoadFromCache(request, m_frame))
                     action = NavigationAction(itemURL, loadType, false);
                 else {
                     request.setCachePolicy(ReloadIgnoringCacheData);
@@ -4604,6 +4633,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                         request.setCachePolicy(ReloadIgnoringCacheData);
                         break;
                     case FrameLoadTypeBack:
+                    case FrameLoadTypeBackWMLDeckNotAccessible:
                     case FrameLoadTypeForward:
                     case FrameLoadTypeIndexedBackForward:
                         if (itemURL.protocol() != "https")
@@ -4632,7 +4662,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 bool FrameLoader::urlsMatchItem(HistoryItem* item) const
 {
     const KURL& currentURL = documentLoader()->url();
-    if (!equalIgnoringRef(currentURL, item->url()))
+    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
         return false;
 
     const HistoryItemVector& childItems = item->children();
@@ -5130,7 +5160,7 @@ void FrameLoader::dispatchWindowObjectAvailable()
     }
 }
 
-Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
+PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
     String codeBaseURLString;
@@ -5158,7 +5188,7 @@ Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletEleme
         baseURLString = m_frame->document()->baseURL().string();
     KURL baseURL = completeURL(baseURLString);
 
-    Widget* widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
+    RefPtr<Widget> widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
     if (!widget)
         return 0;
 
@@ -5170,8 +5200,7 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
 {
     m_client->didChangeTitle(loader);
 
-    // The title doesn't get communicated to the WebView until we are committed.
-    if (loader->isCommitted()) {
+    if (loader == m_documentLoader) {
         // Must update the entries in the back-forward list too.
         if (m_currentHistoryItem)
             m_currentHistoryItem->setTitle(loader->title());
@@ -5182,59 +5211,6 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
     }
 }
 
-void FrameLoader::registerURLSchemeAsLocal(const String& scheme)
-{
-    localSchemes().add(scheme);
-}
-
-bool FrameLoader::shouldTreatURLAsLocal(const String& url)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (url.length() >= 5) {
-        const UChar* s = url.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p' && s[4] == ':')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e' && s[4] == ':')
-            return true;
-    }
-
-    int loc = url.find(':');
-    if (loc == -1)
-        return false;
-
-    String scheme = url.left(loc);
-    return localSchemes().contains(scheme);
-}
-
-bool FrameLoader::shouldTreatURLSchemeAsLocal(const String& scheme)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (scheme.length() == 4) {
-        const UChar* s = scheme.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e')
-            return true;
-    }
-
-    if (scheme.isEmpty())
-        return false;
-
-    return localSchemes().contains(scheme);
-}
-
-void FrameLoader::registerURLSchemeAsNoAccess(const String& scheme)
-{
-    noAccessSchemes().add(scheme);
-}
-
-bool FrameLoader::shouldTreatURLSchemeAsNoAccess(const String& scheme)
-{
-    return noAccessSchemes().contains(scheme);
-}
-
 void FrameLoader::dispatchDidCommitLoad()
 {
     if (m_creatingInitialEmptyDocument)