Merge webkit.org at r54127 : Initial merge by git

Change-Id: Ib661abb595522f50ea406f72d3a0ce17f7193c82

52 files changed, 323 insertions, 209 deletions

diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 46fb068..fdd9b25 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -31,6 +31,7 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "FrameLoader.h"
+#include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
@@ -123,19 +124,21 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
         
         resource->load(docLoader);
         
+        if (resource->errorOccurred()) {
+            // We don't support immediate loads, but we do support immediate failure.
+            // In that case we should to delete the resource now and return 0 because otherwise
+            // it would leak if no ref/deref was ever done on it.
+            resource->setInCache(false);
+            delete resource;
+            return 0;
+        }
+
         if (!disabled())
             m_resources.set(url.string(), resource);  // The size will be added in later once the resource is loaded and calls back to us with the new size.
         else {
             // Kick the resource out of the cache, because the cache is disabled.
             resource->setInCache(false);
             resource->setDocLoader(docLoader);
-            if (resource->errorOccurred()) {
-                // We don't support immediate loads, but we do support immediate failure.
-                // In that case we should to delete the resource now and return 0 because otherwise
-                // it would leak if no ref/deref was ever done on it.
-                delete resource;
-                return 0;
-            }
         }
     }
 
@@ -164,7 +167,7 @@ CachedCSSStyleSheet* Cache::requestUserCSSStyleSheet(DocLoader* docLoader, const
         // FIXME: CachedResource should just use normal refcounting instead.
         userSheet->setInCache(true);
         // Don't load incrementally, skip load checks, don't send resource load callbacks.
-        userSheet->load(docLoader, false, true, false);
+        userSheet->load(docLoader, false, SkipSecurityCheck, false);
         if (!disabled())
             m_resources.set(url, userSheet);
         else
@@ -292,7 +295,7 @@ void Cache::pruneLiveResources()
                 return;
 
             // Destroy our decoded data. This will remove us from 
-            // m_liveDecodedResources, and possibly move us to a differnt LRU 
+            // m_liveDecodedResources, and possibly move us to a different LRU 
             // list in m_allResources.
             current->destroyDecodedData();
 
@@ -344,7 +347,7 @@ void Cache::pruneDeadResources()
             CachedResource* prev = current->m_prevInAllResourcesList;
             if (!current->hasClients() && !current->isPreloaded() && current->isLoaded()) {
                 // Destroy our decoded data. This will remove us from 
-                // m_liveDecodedResources, and possibly move us to a differnt 
+                // m_liveDecodedResources, and possibly move us to a different 
                 // LRU list in m_allResources.
                 current->destroyDecodedData();
                 
@@ -465,13 +468,13 @@ void Cache::removeFromLRUList(CachedResource* resource)
     if (resource->accessCount() == 0)
         return;
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     unsigned oldListIndex = resource->m_lruIndex;
 #endif
 
     LRUList* list = lruListFor(resource);
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     // Verify that the list we got is the list we want.
     ASSERT(resource->m_lruIndex == oldListIndex);
 
diff --git a/WebCore/loader/Cache.h b/WebCore/loader/Cache.h
index 68be2d6..0a5b74d 100644
--- a/WebCore/loader/Cache.h
+++ b/WebCore/loader/Cache.h
@@ -195,7 +195,7 @@ private:
     unsigned m_deadSize; // The number of bytes currently consumed by "dead" resources in the cache.
 
     // Size-adjusted and popularity-aware LRU list collection for cache objects.  This collection can hold
-    // more resources than the cached resource map, since it can also hold "stale" muiltiple versions of objects that are
+    // more resources than the cached resource map, since it can also hold "stale" multiple versions of objects that are
     // waiting to die when the clients referencing them go away.
     Vector<LRUList, 32> m_allResources;
     
diff --git a/WebCore/loader/CachePolicy.h b/WebCore/loader/CachePolicy.h
index 93f92b1..2639caa 100644
--- a/WebCore/loader/CachePolicy.h
+++ b/WebCore/loader/CachePolicy.h
@@ -32,7 +32,8 @@ namespace WebCore {
         CachePolicyCache,
         CachePolicyVerify,
         CachePolicyRevalidate,
-        CachePolicyReload
+        CachePolicyReload,
+        CachePolicyAllowStale
     };
 
 }
diff --git a/WebCore/loader/CachedCSSStyleSheet.cpp b/WebCore/loader/CachedCSSStyleSheet.cpp
index 4c466fa..b2e03b9 100644
--- a/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -52,9 +52,9 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 void CachedCSSStyleSheet::didAddClient(CachedResourceClient *c)
 {
     if (!m_loading)
-        c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), this);
+        c->setCSSStyleSheet(m_url, m_response.url(), m_decoder->encoding().name(), this);
 }
-    
+
 void CachedCSSStyleSheet::allClientsRemoved()
 {
     if (isSafeToMakePurgeable())
@@ -71,11 +71,11 @@ String CachedCSSStyleSheet::encoding() const
     return m_decoder->encoding().name();
 }
     
-const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType) const 
+const String CachedCSSStyleSheet::sheetText(bool enforceMIMEType, bool* hasValidMIMEType) const 
 { 
     ASSERT(!isPurgeable());
 
-    if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType))
+    if (!m_data || m_data->isEmpty() || !canUseSheet(enforceMIMEType, hasValidMIMEType))
         return String();
     
     if (!m_decodedSheetText.isNull())
@@ -112,7 +112,7 @@ void CachedCSSStyleSheet::checkNotify()
 
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
-        c->setCSSStyleSheet(m_response.url().string(), m_decoder->encoding().name(), this);
+        c->setCSSStyleSheet(m_url, m_response.url(), m_decoder->encoding().name(), this);
 }
 
 void CachedCSSStyleSheet::error()
@@ -122,12 +122,12 @@ void CachedCSSStyleSheet::error()
     checkNotify();
 }
 
-bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
+bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const
 {
     if (errorOccurred())
         return false;
         
-    if (!enforceMIMEType)
+    if (!enforceMIMEType && !hasValidMIMEType)
         return true;
 
     // This check exactly matches Firefox.  Note that we grab the Content-Type
@@ -138,7 +138,12 @@ bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
     // This code defaults to allowing the stylesheet for non-HTTP protocols so
     // folks can use standards mode for local HTML documents.
     String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
-    return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
+    bool typeOK = mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
+    if (hasValidMIMEType)
+        *hasValidMIMEType = typeOK;
+    if (!enforceMIMEType)
+        return true;
+    return typeOK;
 }
  
 }
diff --git a/WebCore/loader/CachedCSSStyleSheet.h b/WebCore/loader/CachedCSSStyleSheet.h
index e782f2e..908c4c0 100644
--- a/WebCore/loader/CachedCSSStyleSheet.h
+++ b/WebCore/loader/CachedCSSStyleSheet.h
@@ -40,7 +40,7 @@ namespace WebCore {
         CachedCSSStyleSheet(const String& URL, const String& charset);
         virtual ~CachedCSSStyleSheet();
 
-        const String sheetText(bool enforceMIMEType = true) const;
+        const String sheetText(bool enforceMIMEType = true, bool* hasValidMIMEType = 0) const;
 
         virtual void didAddClient(CachedResourceClient*);
         
@@ -56,7 +56,7 @@ namespace WebCore {
         void checkNotify();
     
     private:
-        bool canUseSheet(bool enforceMIMEType) const;
+        bool canUseSheet(bool enforceMIMEType, bool* hasValidMIMEType) const;
 
     protected:
         RefPtr<TextResourceDecoder> m_decoder;
diff --git a/WebCore/loader/CachedFont.cpp b/WebCore/loader/CachedFont.cpp
index 7fb25fb..3d3fd8d 100644
--- a/WebCore/loader/CachedFont.cpp
+++ b/WebCore/loader/CachedFont.cpp
@@ -27,7 +27,11 @@
 #include "config.h"
 #include "CachedFont.h"
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) || PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX))) || PLATFORM(HAIKU) || PLATFORM(WINCE)
+=======
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (OS(WINDOWS) || OS(LINUX))) || PLATFORM(HAIKU) || OS(WINCE)
+>>>>>>> webkit.org at r54127
 #define STORE_FONT_CUSTOM_PLATFORM_DATA
 #endif
 
@@ -165,7 +169,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
         Node* node = list->item(i);
         ASSERT(node);
 
-        if (static_cast<Element*>(node)->getAttribute(HTMLNames::idAttr) != fontName)
+        if (static_cast<Element*>(node)->getAttribute(static_cast<Element*>(node)->idAttributeName()) != fontName)
             continue;
 
         ASSERT(node->hasTagName(SVGNames::fontTag));
diff --git a/WebCore/loader/CachedImage.cpp b/WebCore/loader/CachedImage.cpp
index 780d7ee..1105f66 100644
--- a/WebCore/loader/CachedImage.cpp
+++ b/WebCore/loader/CachedImage.cpp
@@ -30,6 +30,7 @@
 #include "CachedResourceClientWalker.h"
 #include "DocLoader.h"
 #include "Frame.h"
+#include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "Request.h"
 #include "Settings.h"
@@ -84,8 +85,12 @@ void CachedImage::load(DocLoader* docLoader)
     if (!docLoader || (docLoader->autoLoadImages() && !docLoader->shouldBlockNetworkImage(m_url)))
 #else
     if (!docLoader || docLoader->autoLoadImages())
+<<<<<<< HEAD
 #endif
         CachedResource::load(docLoader, true, false, true);
+=======
+        CachedResource::load(docLoader, true, DoSecurityCheck, true);
+>>>>>>> webkit.org at r54127
     else
         m_loading = false;
 }
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index f2f52b0..640d1f7 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -103,10 +103,10 @@ CachedResource::~CachedResource()
         m_docLoader->removeCachedResource(this);
 }
     
-void CachedResource::load(DocLoader* docLoader, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks)
+void CachedResource::load(DocLoader* docLoader, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
     m_sendResourceLoadCallbacks = sendResourceLoadCallbacks;
-    cache()->loader()->load(docLoader, this, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
+    cache()->loader()->load(docLoader, this, incremental, securityCheck, sendResourceLoadCallbacks);
     m_loading = true;
 }
 
@@ -431,7 +431,7 @@ bool CachedResource::makePurgeable(bool purgeable)
         if (!m_data)
             return false;
         
-        // Should not make buffer purgeable if it has refs othen than this since we don't want two copies.
+        // Should not make buffer purgeable if it has refs other than this since we don't want two copies.
         if (!m_data->hasOneRef())
             return false;
         
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 66ca1b1..0f46a62 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -24,6 +24,7 @@
 #define CachedResource_h
 
 #include "CachePolicy.h"
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "ResourceResponse.h"
 #include "SharedBuffer.h"
@@ -75,8 +76,8 @@ public:
     CachedResource(const String& url, Type);
     virtual ~CachedResource();
     
-    virtual void load(DocLoader* docLoader)  { load(docLoader, false, false, true); }
-    void load(DocLoader*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
+    virtual void load(DocLoader* docLoader)  { load(docLoader, false, DoSecurityCheck, true); }
+    void load(DocLoader*, bool incremental, SecurityCheckPolicy, bool sendResourceLoadCallbacks);
 
     virtual void setEncoding(const String&) { }
     virtual String encoding() const { return String(); }
@@ -148,7 +149,7 @@ public:
 
     virtual bool schedule() const { return false; }
 
-    // List of acceptable MIME types seperated by ",".
+    // List of acceptable MIME types separated by ",".
     // A MIME type may contain a wildcard, e.g. "text/*".
     String accept() const { return m_accept; }
     void setAccept(const String& accept) { m_accept = accept; }
diff --git a/WebCore/loader/CachedResourceClient.h b/WebCore/loader/CachedResourceClient.h
index dd9bb94..be3f87e 100644
--- a/WebCore/loader/CachedResourceClient.h
+++ b/WebCore/loader/CachedResourceClient.h
@@ -42,6 +42,7 @@ namespace WebCore {
     class String;
     class Image;
     class IntRect;
+    class KURL;
 
     /**
      * @internal
@@ -65,8 +66,8 @@ namespace WebCore {
         // e.g., in the b/f cache or in a background tab).
         virtual bool willRenderImage(CachedImage*) { return false; }
 
-        virtual void setCSSStyleSheet(const String& /*URL*/, const String& /*charset*/, const CachedCSSStyleSheet*) { }
-        virtual void setXSLStyleSheet(const String& /*URL*/, const String& /*sheet*/) { }
+        virtual void setCSSStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* charset */, const CachedCSSStyleSheet*) { }
+        virtual void setXSLStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* sheet */) { }
 
         virtual void fontLoaded(CachedFont*) {};
 
diff --git a/WebCore/loader/CachedResourceHandle.h b/WebCore/loader/CachedResourceHandle.h
index 0956e0c..7d485bf 100644
--- a/WebCore/loader/CachedResourceHandle.h
+++ b/WebCore/loader/CachedResourceHandle.h
@@ -72,7 +72,7 @@ namespace WebCore {
         bool operator!=(const CachedResourceHandleBase& o) const { return get() != o.get(); }
     };
 
-    // Don't inline for winscw compiler to prevent the compiler agressively resolving
+    // Don't inline for winscw compiler to prevent the compiler aggressively resolving
     // the base class of R* when CachedResourceHandler<T>(R*) is inlined.  The bug is
     // reported at: https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
     template <class R>
diff --git a/WebCore/loader/CachedXSLStyleSheet.cpp b/WebCore/loader/CachedXSLStyleSheet.cpp
index 5da0abf..59c3907 100644
--- a/WebCore/loader/CachedXSLStyleSheet.cpp
+++ b/WebCore/loader/CachedXSLStyleSheet.cpp
@@ -48,7 +48,7 @@ CachedXSLStyleSheet::CachedXSLStyleSheet(const String &url)
 void CachedXSLStyleSheet::didAddClient(CachedResourceClient* c)
 {  
     if (!m_loading)
-        c->setXSLStyleSheet(m_url, m_sheet);
+        c->setXSLStyleSheet(m_url, m_response.url(), m_sheet);
 }
 
 void CachedXSLStyleSheet::setEncoding(const String& chs)
@@ -83,10 +83,9 @@ void CachedXSLStyleSheet::checkNotify()
     
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
-        c->setXSLStyleSheet(m_url, m_sheet);
+        c->setXSLStyleSheet(m_url, m_response.url(), m_sheet);
 }
 
-
 void CachedXSLStyleSheet::error()
 {
     m_loading = false;
diff --git a/WebCore/loader/CrossOriginAccessControl.cpp b/WebCore/loader/CrossOriginAccessControl.cpp
index 7a21280..01596e2 100644
--- a/WebCore/loader/CrossOriginAccessControl.cpp
+++ b/WebCore/loader/CrossOriginAccessControl.cpp
@@ -100,8 +100,7 @@ bool passesAccessControlCheck(const ResourceResponse& response, bool includeCred
     if (accessControlOriginString == "*" && !includeCredentials)
         return true;
 
-    // A sandboxed frame has a unique origin (for same-origin purposes).
-    if (securityOrigin->isSandboxed(SandboxOrigin))
+    if (securityOrigin->isUnique())
         return false;
 
     RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
diff --git a/WebCore/loader/CrossOriginPreflightResultCache.h b/WebCore/loader/CrossOriginPreflightResultCache.h
index 97b526a..faf55e5 100644
--- a/WebCore/loader/CrossOriginPreflightResultCache.h
+++ b/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -26,6 +26,8 @@
 
 #include "KURLHash.h"
 #include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 
 namespace WebCore {
 
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index fff8e59..54dc733 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -40,6 +40,7 @@
 #include "HTMLElement.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "loader.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -114,8 +115,8 @@ void DocLoader::checkForReload(const KURL& fullURL)
     case CachePolicyRevalidate:
         cache()->revalidateResource(existing, this);
         break;
-    default:
-        ASSERT_NOT_REACHED();
+    case CachePolicyAllowStale:
+        return;
     }
 
     m_reloadedURLs.add(fullURL.string());
@@ -123,6 +124,11 @@ void DocLoader::checkForReload(const KURL& fullURL)
 
 CachedImage* DocLoader::requestImage(const String& url)
 {
+    if (Frame* f = frame()) {
+        Settings* settings = f->settings();
+        if (!f->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
+            return 0;
+    }
     CachedImage* resource = static_cast<CachedImage*>(requestResource(CachedResource::ImageResource, url, String()));
     if (autoLoadImages() && resource && resource->stillNeedsLoad()) {
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index e8c3652..dca416e 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -50,7 +50,6 @@
 #include "PlatformString.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-#include "StringBuffer.h"
 #include "XMLTokenizer.h"
 
 #include <wtf/Assertions.h>
@@ -58,67 +57,6 @@
 
 namespace WebCore {
 
-/*
- * Performs four operations:
- *  1. Convert backslashes to currency symbols
- *  2. Convert control characters to spaces
- *  3. Trim leading and trailing spaces
- *  4. Collapse internal whitespace.
- */
-static inline String canonicalizedTitle(const String& title, Frame* frame)
-{
-    ASSERT(!title.isEmpty());
-
-    const UChar* characters = title.characters();
-    unsigned length = title.length();
-    unsigned i;
-
-    StringBuffer buffer(length);
-    unsigned builderIndex = 0;
-
-    // Skip leading spaces and leading characters that would convert to spaces
-    for (i = 0; i < length; ++i) {
-        UChar c = characters[i];
-        if (!(c <= 0x20 || c == 0x7F))
-            break;
-    }
-
-    if (i == length)
-        return "";
-
-    // Replace control characters with spaces, and backslashes with currency symbols, and collapse whitespace.
-    bool previousCharWasWS = false;
-    for (; i < length; ++i) {
-        UChar c = characters[i];
-        if (c <= 0x20 || c == 0x7F || (WTF::Unicode::category(c) & (WTF::Unicode::Separator_Line | WTF::Unicode::Separator_Paragraph))) {
-            if (previousCharWasWS)
-                continue;
-            buffer[builderIndex++] = ' ';
-            previousCharWasWS = true;
-        } else {
-            buffer[builderIndex++] = c;
-            previousCharWasWS = false;
-        }
-    }
-
-    // Strip trailing spaces
-    while (builderIndex > 0) {
-        --builderIndex;
-        if (buffer[builderIndex] != ' ')
-            break;
-    }
-
-    if (!builderIndex && buffer[builderIndex] == ' ')
-        return "";
-
-    buffer.shrink(builderIndex + 1);
-    
-    // Replace the backslashes with currency symbols if the encoding requires it.
-    frame->document()->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
-
-    return String::adopt(buffer);
-}
-
 static void cancelAll(const ResourceLoaderSet& loaders)
 {
     const ResourceLoaderSet copy = loaders;
@@ -672,10 +610,9 @@ void DocumentLoader::setTitle(const String& title)
     if (title.isEmpty())
         return;
 
-    String trimmed = canonicalizedTitle(title, m_frame);
-    if (!trimmed.isEmpty() && m_pageTitle != trimmed) {
+    if (m_pageTitle != title) {
         frameLoader()->willChangeTitle(this);
-        m_pageTitle = trimmed;
+        m_pageTitle = title;
         frameLoader()->didChangeTitle(this);
     }
 }
diff --git a/WebCore/loader/DocumentLoader.h b/WebCore/loader/DocumentLoader.h
index b8e659c..440cfc4 100644
--- a/WebCore/loader/DocumentLoader.h
+++ b/WebCore/loader/DocumentLoader.h
@@ -158,7 +158,7 @@ namespace WebCore {
         KURL urlForHistory() const;
         bool urlForHistoryReflectsFailure() const;
 
-        // These accessors accomodate WebCore's somewhat fickle custom of creating history
+        // These accessors accommodate WebCore's somewhat fickle custom of creating history
         // items for redirects, but only sometimes. For "source" and "destination",
         // these accessors return the URL that would have been used if a history
         // item were created. This allows WebKit to link history items reflecting
diff --git a/WebCore/loader/DocumentThreadableLoader.cpp b/WebCore/loader/DocumentThreadableLoader.cpp
index 8a223fd..de0a0b0 100644
--- a/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/WebCore/loader/DocumentThreadableLoader.cpp
@@ -70,8 +70,7 @@ DocumentThreadableLoader::DocumentThreadableLoader(Document* document, Threadabl
     ASSERT(client);
 
     if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
-        bool skipCanLoadCheck = false;
-        loadRequest(request, skipCanLoadCheck);
+        loadRequest(request, DoSecurityCheck);
         return;
     }
 
@@ -111,8 +110,7 @@ void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const Resource
     crossOriginRequest.setAllowCookies(m_options.allowCredentials);
     crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
 
-    bool skipCanLoadCheck = false;
-    loadRequest(crossOriginRequest, skipCanLoadCheck);
+    loadRequest(crossOriginRequest, DoSecurityCheck);
 }
 
 void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
@@ -142,8 +140,7 @@ void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const R
         preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
     }
 
-    bool skipCanLoadCheck = false;
-    loadRequest(preflightRequest, skipCanLoadCheck);
+    loadRequest(preflightRequest, DoSecurityCheck);
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader()
@@ -284,8 +281,8 @@ void DocumentThreadableLoader::preflightSuccess()
     OwnPtr<ResourceRequest> actualRequest;
     actualRequest.swap(m_actualRequest);
 
-    bool skipCanLoadCheck = true;  // ok to skip load check since we already asked about the preflight request
-    loadRequest(*actualRequest, skipCanLoadCheck);
+    // It should be ok to skip the security check since we already asked about the preflight request.
+    loadRequest(*actualRequest, SkipSecurityCheck);
 }
 
 void DocumentThreadableLoader::preflightFailure()
@@ -293,7 +290,7 @@ void DocumentThreadableLoader::preflightFailure()
     m_client->didFail(ResourceError());
 }
 
-void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool skipCanLoadCheck)
+void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, SecurityCheckPolicy securityCheck)
 {
     if (m_async) {
         // Don't sniff content or send load callbacks for the preflight request.
@@ -302,7 +299,7 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool
 
         // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
         m_loader = 0;
-        m_loader = SubresourceLoader::create(m_document->frame(), this, request, skipCanLoadCheck, sendLoadCallbacks, sniffContent);
+        m_loader = SubresourceLoader::create(m_document->frame(), this, request, securityCheck, sendLoadCallbacks, sniffContent);
         return;
     }
     
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index 7eb7f1c..48d1551 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -31,6 +31,7 @@
 #ifndef DocumentThreadableLoader_h
 #define DocumentThreadableLoader_h
 
+#include "FrameLoaderTypes.h"
 #include "SubresourceLoaderClient.h"
 #include "ThreadableLoader.h"
 #include <wtf/OwnPtr.h>
@@ -85,7 +86,7 @@ namespace WebCore {
         void preflightSuccess();
         void preflightFailure();
 
-        void loadRequest(const ResourceRequest&, bool skipCanLoadCheck);
+        void loadRequest(const ResourceRequest&, SecurityCheckPolicy);
         bool isAllowedRedirect(const KURL&);
 
         RefPtr<SubresourceLoader> m_loader;
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index e5385c5..2da2fb2 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -175,7 +175,7 @@ public:
 #endif
 };
 
-class EmptyFrameLoaderClient : public FrameLoaderClient {
+class EmptyFrameLoaderClient : public FrameLoaderClient, public Noncopyable {
 public:
     virtual ~EmptyFrameLoaderClient() {  }
     virtual void frameLoaderDestroyed() { }
@@ -328,7 +328,7 @@ public:
 
 };
 
-class EmptyEditorClient : public EditorClient {
+class EmptyEditorClient : public EditorClient, public Noncopyable {
 public:
     virtual ~EmptyEditorClient() { }
     virtual void pageDestroyed() { }
@@ -433,7 +433,7 @@ public:
 };
 
 #if ENABLE(CONTEXT_MENUS)
-class EmptyContextMenuClient : public ContextMenuClient {
+class EmptyContextMenuClient : public ContextMenuClient, public Noncopyable {
 public:
     virtual ~EmptyContextMenuClient() {  }
     virtual void contextMenuDestroyed() { }
@@ -456,7 +456,7 @@ public:
 #endif // ENABLE(CONTEXT_MENUS)
 
 #if ENABLE(DRAG_SUPPORT)
-class EmptyDragClient : public DragClient {
+class EmptyDragClient : public DragClient, public Noncopyable {
 public:
     virtual ~EmptyDragClient() {}
     virtual void willPerformDragDestinationAction(DragDestinationAction, DragData*) { }
@@ -469,7 +469,7 @@ public:
 };
 #endif // ENABLE(DRAG_SUPPORT)
 
-class EmptyInspectorClient : public InspectorClient {
+class EmptyInspectorClient : public InspectorClient, public Noncopyable {
 public:
     virtual ~EmptyInspectorClient() { }
 
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index ee0f4ca..7a71d02 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -43,7 +43,7 @@
 #if PLATFORM(QT)
 #include <QDateTime>
 // On Windows, use the threadsafe *_r functions provided by pthread.
-#elif PLATFORM(WIN_OS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
+#elif OS(WINDOWS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
 #include <pthread.h>
 #endif
 
@@ -234,7 +234,7 @@ static struct tm *localTimeQt(const time_t *const timep, struct tm *result)
 }
 
 #define localtime_r(x, y) localTimeQt(x, y)
-#elif PLATFORM(WIN_OS) && !defined(localtime_r)
+#elif OS(WINDOWS) && !defined(localtime_r)
 #if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define localtime_r(x, y) localtime_s((y), (x))
 #else /* !_MSC_VER */ 
diff --git a/WebCore/loader/FTPDirectoryParser.cpp b/WebCore/loader/FTPDirectoryParser.cpp
index 40bd714..34c19a4 100644
--- a/WebCore/loader/FTPDirectoryParser.cpp
+++ b/WebCore/loader/FTPDirectoryParser.cpp
@@ -27,7 +27,7 @@
 #if PLATFORM(QT)
 #include <QDateTime>
 // On Windows, use the threadsafe *_r functions provided by pthread.
-#elif PLATFORM(WIN_OS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
+#elif OS(WINDOWS) && (USE(PTHREADS) || HAVE(PTHREAD_H))
 #include <pthread.h>
 #endif
 
@@ -49,7 +49,7 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 }
 
 #define gmtime_r(x, y) gmtimeQt(x, y)
-#elif PLATFORM(WIN_OS) && !defined(gmtime_r)
+#elif OS(WINDOWS) && !defined(gmtime_r)
 #if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define gmtime_r(x, y) gmtime_s((y), (x))
 #else /* !_MSC_VER */ 
@@ -1185,7 +1185,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        
         } /* time/year */
         
-        // there is exacly 1 space between filename and previous token in all
+        // there is exactly 1 space between filename and previous token in all
         // outputs except old Hellsoft
         if (!isOldHellsoft)
           result.filename = tokens[tokmarker+3] + toklen[tokmarker+3] + 1;
diff --git a/WebCore/loader/FormState.cpp b/WebCore/loader/FormState.cpp
index bd37086..552789a 100644
--- a/WebCore/loader/FormState.cpp
+++ b/WebCore/loader/FormState.cpp
@@ -34,16 +34,17 @@
 
 namespace WebCore {
 
-inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame, FormSubmissionTrigger formSubmissionTrigger)
     : m_form(form)
     , m_sourceFrame(sourceFrame)
+    , m_formSubmissionTrigger(formSubmissionTrigger)
 {
     m_textFieldValues.swap(textFieldValuesToAdopt);
 }
 
-PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame, FormSubmissionTrigger formSubmissionTrigger)
 {
-    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame));
+    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame, formSubmissionTrigger));
 }
 
 }
diff --git a/WebCore/loader/FormState.h b/WebCore/loader/FormState.h
index 03317b1..8f7166e 100644
--- a/WebCore/loader/FormState.h
+++ b/WebCore/loader/FormState.h
@@ -36,22 +36,29 @@ namespace WebCore {
     class Frame;
     class HTMLFormElement;
 
+    enum FormSubmissionTrigger {
+        SubmittedByJavaScript,
+        NotSubmittedByJavaScript
+    };
+    
     typedef Vector<std::pair<String, String> > StringPairVector;
 
     class FormState : public RefCounted<FormState> {
     public:
-        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
+        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>, FormSubmissionTrigger);
 
         HTMLFormElement* form() const { return m_form.get(); }
         const StringPairVector& textFieldValues() const { return m_textFieldValues; }
         Frame* sourceFrame() const { return m_sourceFrame.get(); }
+        FormSubmissionTrigger formSubmissionTrigger() const { return m_formSubmissionTrigger; }
 
     private:
-        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
+        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>, FormSubmissionTrigger);
 
         RefPtr<HTMLFormElement> m_form;
         StringPairVector m_textFieldValues;
         RefPtr<Frame> m_sourceFrame;
+        FormSubmissionTrigger m_formSubmissionTrigger;
     };
 
 }
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index e07ee92..b88485e 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -37,7 +37,11 @@
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
 #include "Archive.h"
 #include "ArchiveFactory.h"
+<<<<<<< HEAD
 #endif
+=======
+#include "BackForwardList.h"
+>>>>>>> webkit.org at r54127
 #include "CString.h"
 #include "Cache.h"
 #include "CachedPage.h"
@@ -416,6 +420,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         return 0;
     }
     
+    // All new frames will have m_isComplete set to true at this point due to synchronously loading
+    // an empty document in FrameLoader::init(). But many frames will now be starting an
+    // asynchronous load of url, so we set m_isComplete to false and then check if the load is
+    // actually completed below. (Note that we set m_isComplete to false even for synchronous
+    // loads, so that checkCompleted() below won't bail early.)
+    // FIXME: Can we remove this entirely? m_isComplete normally gets set to false when a load is committed.
     frame->loader()->m_isComplete = false;
    
     RenderObject* renderer = ownerElement->renderer();
@@ -425,16 +435,17 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     
     checkCallImplicitClose();
     
+    // Some loads are performed synchronously (e.g., about:blank and loads
+    // cancelled by returning a null ResourceRequest from requestFromDelegate).
     // In these cases, the synchronous load would have finished
     // before we could connect the signals, so make sure to send the 
-    // completed() signal for the child by hand
+    // completed() signal for the child by hand and mark the load as being
+    // complete.
     // FIXME: In this case the Frame will have finished loading before 
     // it's being added to the child list. It would be a good idea to
     // create the child first, then invoke the loader separately.
-    if (url.isEmpty() || url == blankURL()) {
-        frame->loader()->completed();
+    if (frame->loader()->state() == FrameStateComplete)
         frame->loader()->checkCompleted();
-    }
 
     return frame.get();
 }
@@ -577,7 +588,9 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
 
 #if ENABLE(DATABASE)
         if (databasePolicy == DatabasePolicyStop)
-            doc->stopDatabases();
+            doc->stopDatabases(0);
+#else
+    UNUSED_PARAM(databasePolicy);
 #endif
     }
 
@@ -629,7 +642,8 @@ KURL FrameLoader::iconURL()
         return KURL();
 
     KURL url;
-    url.setProtocol(m_URL.protocol());
+    bool couldSetProtocol = url.setProtocol(m_URL.protocol());
+    ASSERT_UNUSED(couldSetProtocol, couldSetProtocol);
     url.setHost(m_URL.host());
     if (m_URL.hasPort())
         url.setPort(m_URL.port());
@@ -679,7 +693,7 @@ void FrameLoader::didExplicitOpen()
     
     // Prevent window.open(url) -- eg window.open("about:blank") -- from blowing away results
     // from a subsequent window.document.open / window.document.write call. 
-    // Cancelling redirection here works for all cases because document.open 
+    // Canceling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
     m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
@@ -846,6 +860,11 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     document->setURL(m_URL);
     m_frame->setDocument(document);
 
+    if (m_pendingStateObject) {
+        document->statePopped(m_pendingStateObject.get());
+        m_pendingStateObject.clear();
+    }
+    
     if (m_decoder)
         document->setDecoder(m_decoder.get());
     if (forcedSecurityOrigin)
@@ -1289,8 +1308,8 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
     bool useFallback;
     if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback)) {
         Settings* settings = m_frame->settings();
-        if (!settings || !settings->arePluginsEnabled() || 
-            (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
+        if (!m_client->allowPlugins(settings && settings->arePluginsEnabled())
+            || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
             return false;
         if (isSandboxed(SandboxPlugins))
             return false;
@@ -1412,7 +1431,7 @@ bool FrameLoader::isMixedContent(SecurityOrigin* context, const KURL& url)
     if (context->protocol() != "https")
         return false;  // We only care about HTTPS security origins.
 
-    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+    if (!url.isValid() || url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
         return false;  // Loading these protocols is secure.
 
     return true;
@@ -1483,7 +1502,7 @@ void FrameLoader::provisionalLoadStarted()
 bool FrameLoader::isProcessingUserGesture()
 {
     Frame* frame = m_frame->tree()->top();
-    if (!frame->script()->isEnabled())
+    if (!frame->script()->canExecuteScripts())
         return true; // If JavaScript is disabled, a user gesture must have initiated the navigation.
     return frame->script()->processingUserGesture(); // FIXME: Use pageIsProcessingUserGesture.
 }
@@ -2358,6 +2377,8 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
         m_documentLoader->clearArchiveResources();
 #endif
 
+    m_checkTimer.stop();
+
     m_inStopAllLoaders = false;    
 }
 
@@ -2581,10 +2602,13 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeBack:
         case FrameLoadTypeBackWMLDeckNotAccessible:
         case FrameLoadTypeIndexedBackForward:
-            if (Page* page = m_frame->page())
+            if (Page* page = m_frame->page()) {
                 if (page->backForwardList()) {
                     history()->updateForBackForwardNavigation();
 
+                    if (history()->currentItem())
+                        m_pendingStateObject = history()->currentItem()->stateObject();
+                        
                     // Create a document view for this document, or used the cached view.
                     if (cachedPage) {
                         DocumentLoader* cachedDocumentLoader = cachedPage->documentLoader();
@@ -2595,6 +2619,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
                     } else
                         m_client->transitionToCommittedForNewPage();
                 }
+            }
             break;
 
         case FrameLoadTypeReload:
@@ -2719,7 +2744,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     closeURL();
     
     // Delete old status bar messages (if it _was_ activated on last URL).
-    if (m_frame->script()->isEnabled()) {
+    if (m_frame->script()->canExecuteScripts()) {
         m_frame->setJSStatusBarText(String());
         m_frame->setJSDefaultStatusBarText(String());
     }
@@ -2947,6 +2972,9 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     if (m_loadType == FrameLoadTypeReload)
         return CachePolicyRevalidate;
 
+    if (request.cachePolicy() == ReturnCacheDataElseLoad)
+        return CachePolicyAllowStale;
+
     return CachePolicyVerify;
 }
 
@@ -2986,6 +3014,10 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 stopLoadingSubframes();
                 pdl->stopLoading();
 
+                // If we're in the middle of loading multipart data, we need to restore the document loader.
+                if (isReplacing() && !m_documentLoader.get())
+                    setDocumentLoader(m_provisionalDocumentLoader.get());
+
                 // Finish resetting the load state, but only if another load hasn't been started by the
                 // delegate callback.
                 if (pdl == m_provisionalDocumentLoader)
@@ -3191,6 +3223,10 @@ void FrameLoader::tokenizerProcessedData()
 void FrameLoader::handledOnloadEvents()
 {
     m_client->dispatchDidHandleOnloadEvents();
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (documentLoader())
+        documentLoader()->applicationCacheHost()->stopDeferringEvents();
+#endif
 }
 
 void FrameLoader::frameDetached()
@@ -3266,7 +3302,8 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
         request.setCachePolicy(ReloadIgnoringCacheData);
         request.setHTTPHeaderField("Cache-Control", "no-cache");
         request.setHTTPHeaderField("Pragma", "no-cache");
-    }
+    } else if (isBackForwardLoadType(loadType) && !request.url().protocolIs("https"))
+        request.setCachePolicy(ReturnCacheDataElseLoad);
     
     if (mainResource)
         request.setHTTPAccept(defaultAcceptHeader);
@@ -3745,7 +3782,7 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
 
 void FrameLoader::navigateWithinDocument(HistoryItem* item)
 {
-    ASSERT(!item->document() || item->document() == m_frame->document());
+    ASSERT(item->documentSequenceNumber() == history()->currentItem()->documentSequenceNumber());
 
     // Save user view state to the current history item here since we don't do a normal load.
     // FIXME: Does form state need to be saved here too?
@@ -3759,9 +3796,6 @@ void FrameLoader::navigateWithinDocument(HistoryItem* item)
     loadInSameDocument(item->url(), item->stateObject(), false);
 
     // Restore user view state from the current history item here since we don't do a normal load.
-    // Even though we just manually set the current history item, this ASSERT verifies nothing 
-    // inside of loadInSameDocument() caused it to change.
-    ASSERT(history()->currentItem() == item);
     history()->restoreScrollPositionAndViewState();
 }
 
@@ -3869,7 +3903,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // - The HistoryItem has a history state object
     // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
     //   and the URLs in the frame tree match the history item for fragment scrolling.
-    bool sameDocumentNavigation = (!item->formData() && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item)) || item->document() == m_frame->document();
+    bool sameDocumentNavigation = (!item->formData() && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item)) || item->documentSequenceNumber() == history()->currentItem()->documentSequenceNumber();
 
 #if ENABLE(WML)
     // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
@@ -3957,7 +3991,7 @@ void FrameLoader::dispatchDocumentElementAvailable()
 
 void FrameLoader::dispatchDidClearWindowObjectsInAllWorlds()
 {
-    if (!m_frame->script()->isEnabled())
+    if (!m_frame->script()->canExecuteScripts())
         return;
 
     Vector<DOMWrapperWorld*> worlds;
@@ -3968,7 +4002,7 @@ void FrameLoader::dispatchDidClearWindowObjectsInAllWorlds()
 
 void FrameLoader::dispatchDidClearWindowObjectInWorld(DOMWrapperWorld* world)
 {
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(world))
+    if (!m_frame->script()->canExecuteScripts() || !m_frame->script()->existingWindowShell(world))
         return;
 
     m_client->dispatchDidClearWindowObjectInWorld(world);
@@ -3996,14 +4030,14 @@ void FrameLoader::updateSandboxFlags()
 
     if (m_sandboxFlags == flags)
         return;
-        
+
     m_sandboxFlags = flags;
 
     m_frame->document()->updateSandboxFlags();
 
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         child->loader()->updateSandboxFlags();
- }
+}
 
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 875736f..aa1913c 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -257,7 +257,7 @@ public:
     void dispatchDocumentElementAvailable();
 
     void ownerElementSandboxFlagsChanged() { updateSandboxFlags(); }
-    
+
     bool isSandboxed(SandboxFlags mask) const { return m_sandboxFlags & mask; }
     SandboxFlags sandboxFlags() const { return m_sandboxFlags; }
 
@@ -494,6 +494,8 @@ private:
     bool m_isComplete;
     bool m_isLoadingMainResource;
 
+    RefPtr<SerializedScriptValue> m_pendingStateObject;
+
     KURL m_URL;
     KURL m_workingURL;
 
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index 434e163..2668958 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -260,6 +260,8 @@ namespace WebCore {
         virtual void didChangeScrollOffset() { }
 
         virtual bool allowJavaScript(bool enabledPerSettings) { return enabledPerSettings; }
+        virtual bool allowPlugins(bool enabledPerSettings) { return enabledPerSettings; }
+        virtual bool allowImages(bool enabledPerSettings) { return enabledPerSettings; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index af3dde4..8288bce 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -102,6 +102,11 @@ namespace WebCore {
         SandboxScripts = 1 << 4,
         SandboxAll = -1 // Mask with all bits set to 1.
     };
+    
+    enum SecurityCheckPolicy {
+        SkipSecurityCheck,
+        DoSecurityCheck
+    };
 
     typedef int SandboxFlags;
 }
diff --git a/WebCore/loader/HistoryController.cpp b/WebCore/loader/HistoryController.cpp
index d30b231..43c9979 100644
--- a/WebCore/loader/HistoryController.cpp
+++ b/WebCore/loader/HistoryController.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "HistoryController.h"
 
+#include "BackForwardList.h"
 #include "CachedPage.h"
 #include "CString.h"
 #include "DocumentLoader.h"
@@ -105,6 +106,10 @@ void HistoryController::restoreScrollPositionAndViewState()
 void HistoryController::updateBackForwardListForFragmentScroll()
 {
     updateBackForwardListClippedAtTarget(false);
+    
+    // Since the document isn't changed as a result of a fragment scroll, we should
+    // preserve the DocumentSequenceNumber of the previous item.
+    m_currentItem->setDocumentSequenceNumber(m_previousItem->documentSequenceNumber());
 }
 
 void HistoryController::saveDocumentState()
@@ -631,14 +636,16 @@ void HistoryController::pushState(PassRefPtr<SerializedScriptValue> stateObject,
 
     // Get a HistoryItem tree for the current frame tree.
     RefPtr<HistoryItem> item = createItemTree(m_frame, false);
+    ASSERT(item->isTargetItem());
     
     // Override data in the target item to reflect the pushState() arguments.
-    HistoryItem* targetItem = item->targetItem();
-    ASSERT(targetItem->isTargetItem());
-    targetItem->setDocument(m_frame->document());
-    targetItem->setTitle(title);
-    targetItem->setStateObject(stateObject);
-    targetItem->setURLString(urlString);
+    item->setTitle(title);
+    item->setStateObject(stateObject);
+    item->setURLString(urlString);
+
+    // Since the document isn't changed as a result of a pushState call, we
+    // should preserve the DocumentSequenceNumber of the previous item.
+    item->setDocumentSequenceNumber(m_previousItem->documentSequenceNumber());
     
     page->backForwardList()->pushStateItem(item.release());
 }
@@ -649,10 +656,7 @@ void HistoryController::replaceState(PassRefPtr<SerializedScriptValue> stateObje
     ASSERT(page);
     HistoryItem* current = page->backForwardList()->currentItem();
     ASSERT(current);
-    
-    ASSERT(!current->document() || current->document() == m_frame->document());
-    current->setDocument(m_frame->document());
-    
+
     if (!urlString.isEmpty())
         current->setURLString(urlString);
     current->setTitle(title);
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index 9b5598d..2f564cc 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
@@ -115,8 +116,13 @@ void ImageTokenizer::write(const SegmentedString&, bool)
 
 bool ImageTokenizer::writeRawData(const char*, int)
 {
+    Frame* frame = m_doc->frame();
+    Settings* settings = frame->settings();
+    if (!frame->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
+        return false;
+    
     CachedImage* cachedImage = m_doc->cachedImage();
-    cachedImage->data(m_doc->frame()->loader()->documentLoader()->mainResourceData(), false);
+    cachedImage->data(frame->loader()->documentLoader()->mainResourceData(), false);
 
     m_doc->imageChanged();
     
diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index e09d574..9c237cd 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -186,7 +186,7 @@ void ImageLoader::notifyFinished(CachedResource*)
 void ImageLoader::updateRenderer()
 {
     if (RenderObject* renderer = m_element->renderer()) {
-        if (!renderer->isImage())
+        if (!renderer->isImage() && !renderer->isVideo())
             return;
         RenderImage* imageRenderer = toRenderImage(renderer);
         
@@ -231,9 +231,13 @@ void ImageLoader::dispatchPendingLoadEvent()
     dispatchLoadEvent();
 }
 
-void ImageLoader::dispatchPendingEvents()
+void ImageLoader::dispatchPendingBeforeLoadEvents()
 {
     beforeLoadEventSender().dispatchPendingEvents();
+}
+
+void ImageLoader::dispatchPendingLoadEvents()
+{
     loadEventSender().dispatchPendingEvents();
 }
 
diff --git a/WebCore/loader/ImageLoader.h b/WebCore/loader/ImageLoader.h
index 7f42e33..e7463d5 100644
--- a/WebCore/loader/ImageLoader.h
+++ b/WebCore/loader/ImageLoader.h
@@ -56,7 +56,8 @@ public:
     bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
-    static void dispatchPendingEvents();
+    static void dispatchPendingBeforeLoadEvents();
+    static void dispatchPendingLoadEvents();
 
 protected:
     virtual void notifyFinished(CachedResource*);
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index c37daef..3e75880 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -38,6 +38,9 @@
 #include "FrameLoaderClient.h"
 #include "HTMLFormElement.h"
 #include "Page.h"
+#if PLATFORM(QT)
+#include "PluginDatabase.h"
+#endif
 #include "ResourceError.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
@@ -279,6 +282,29 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction policy)
     deref(); // balances ref in didReceiveResponse
 }
 
+#if PLATFORM(QT)
+void MainResourceLoader::substituteMIMETypeFromPluginDatabase(const ResourceResponse& r)
+{
+    if (!m_frame->settings()->arePluginsEnabled())
+        return;
+
+    String filename = r.url().lastPathComponent();
+    if (filename.endsWith("/"))
+        return;
+
+    int extensionPos = filename.reverseFind('.');
+    if (extensionPos == -1)
+        return;
+
+    String extension = filename.substring(extensionPos + 1);
+    String mimeType = PluginDatabase::installedPlugins()->MIMETypeForExtension(extension);
+    if (!mimeType.isEmpty()) {
+        ResourceResponse* response = const_cast<ResourceResponse*>(&r);
+        response->setMimeType(mimeType);
+    }
+}
+#endif
+
 void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
 {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -301,6 +327,11 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(shouldLoadAsEmptyDocument(r.url()) || !defersLoading());
 #endif
 
+#if PLATFORM(QT)
+    if (r.mimeType() == "application/octet-stream")
+        substituteMIMETypeFromPluginDatabase(r);
+#endif
+
     if (m_loadingMultipartContent) {
         frameLoader()->setupForReplaceByMIMEType(r.mimeType());
         clearResourceData();
diff --git a/WebCore/loader/MainResourceLoader.h b/WebCore/loader/MainResourceLoader.h
index 1d5be45..eaaf2e8 100644
--- a/WebCore/loader/MainResourceLoader.h
+++ b/WebCore/loader/MainResourceLoader.h
@@ -92,6 +92,10 @@ namespace WebCore {
         static void callContinueAfterContentPolicy(void*, PolicyAction);
         void continueAfterContentPolicy(PolicyAction);
         void continueAfterContentPolicy(PolicyAction, const ResourceResponse&);
+        
+#if PLATFORM(QT)
+        void substituteMIMETypeFromPluginDatabase(const ResourceResponse&);
+#endif
 
         ResourceRequest m_initialRequest;
         SubstituteData m_substituteData;
diff --git a/WebCore/loader/PlaceholderDocument.cpp b/WebCore/loader/PlaceholderDocument.cpp
index af14c72..81222b3 100644
--- a/WebCore/loader/PlaceholderDocument.cpp
+++ b/WebCore/loader/PlaceholderDocument.cpp
@@ -35,11 +35,6 @@ void PlaceholderDocument::attach()
 {
     ASSERT(!attached());
 
-    if (!styleSelector()) {
-        RefPtr<StyleSheetList> styleSheetList = StyleSheetList::create(this);
-        setStyleSelector(new CSSStyleSelector(this, styleSheetList.get(), 0, pageUserSheet(), pageGroupUserSheets(), true, false));
-    }
-
     // Skipping Document::attach().
     ContainerNode::attach();
 }
diff --git a/WebCore/loader/PlaceholderDocument.h b/WebCore/loader/PlaceholderDocument.h
index a759266..5b76a9c 100644
--- a/WebCore/loader/PlaceholderDocument.h
+++ b/WebCore/loader/PlaceholderDocument.h
@@ -40,7 +40,7 @@ public:
     virtual void attach();
 
 private:
-    PlaceholderDocument(Frame* frame) : Document(frame, false) { }
+    PlaceholderDocument(Frame* frame) : Document(frame, false, false) { }
 };
 
 } // namespace WebCore
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
index f2202cc..4b44422 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -32,13 +32,16 @@
 #include "config.h"
 #include "RedirectScheduler.h"
 
+#include "BackForwardList.h"
 #include "DocumentLoader.h"
 #include "Event.h"
 #include "FormState.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
+#include "HistoryItem.h"
 #include "HTMLFormElement.h"
+#include "HTMLFrameOwnerElement.h"
 #include "Page.h"
 #include <wtf/CurrentTime.h>
 
@@ -218,7 +221,13 @@ void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequ
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
 
-    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+    // If this is a child frame and the form submission was triggered by a script, lock the back/forward list
+    // to match IE and Opera.
+    // See https://bugs.webkit.org/show_bug.cgi?id=32383 for the original motivation for this.
+
+    bool lockBackForwardList = mustLockBackForwardList(m_frame) || (formState->formSubmissionTrigger() == SubmittedByJavaScript && m_frame->tree()->parent());
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
 }
 
 void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
@@ -258,11 +267,23 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
 
     // Invalid history navigations (such as history.forward() during a new load) have the side effect of cancelling any scheduled
     // redirects. We also avoid the possibility of cancelling the current load by avoiding the scheduled redirection altogether.
-    if (!m_frame->page()->canGoBackOrForward(steps)) { 
-        cancel(); 
-        return; 
-    } 
-
+    HistoryItem* specifiedEntry = m_frame->page()->backForwardList()->itemAtIndex(steps);
+    if (!specifiedEntry) {
+        cancel();
+        return;
+    }
+    
+#if !ENABLE(HISTORY_ALWAYS_ASYNC)
+    // If the specified entry and the current entry have the same document, this is either a state object traversal or a fragment 
+    // traversal (or both) and should be performed synchronously.
+    HistoryItem* currentEntry = m_frame->loader()->history()->currentItem();
+    if (currentEntry != specifiedEntry && currentEntry->documentSequenceNumber() == specifiedEntry->documentSequenceNumber()) {
+        m_frame->loader()->history()->goToItem(specifiedEntry, FrameLoadTypeIndexedBackForward);
+        return;
+    }
+#endif
+    
+    // In all other cases, schedule the history traversal to occur asynchronously.
     schedule(new ScheduledRedirection(steps));
 }
 
diff --git a/WebCore/loader/Request.cpp b/WebCore/loader/Request.cpp
index 7791a48..630a4bb 100644
--- a/WebCore/loader/Request.cpp
+++ b/WebCore/loader/Request.cpp
@@ -28,12 +28,12 @@
 
 namespace WebCore {
 
-Request::Request(DocLoader* docLoader, CachedResource* object, bool incremental, bool shouldSkipCanLoadCheck, bool sendResourceLoadCallbacks)
+Request::Request(DocLoader* docLoader, CachedResource* object, bool incremental, SecurityCheckPolicy shouldDoSecurityCheck, bool sendResourceLoadCallbacks)
     : m_object(object)
     , m_docLoader(docLoader)
     , m_incremental(incremental)
     , m_multipart(false)
-    , m_shouldSkipCanLoadCheck(shouldSkipCanLoadCheck)
+    , m_shouldDoSecurityCheck(shouldDoSecurityCheck)
     , m_sendResourceLoadCallbacks(sendResourceLoadCallbacks)
 {
     m_object->setRequest(this);
diff --git a/WebCore/loader/Request.h b/WebCore/loader/Request.h
index 1e02d77..468f8ff 100644
--- a/WebCore/loader/Request.h
+++ b/WebCore/loader/Request.h
@@ -23,6 +23,7 @@
 #ifndef Request_h
 #define Request_h
 
+#include "FrameLoaderTypes.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -32,7 +33,7 @@ namespace WebCore {
 
     class Request : public Noncopyable {
     public:
-        Request(DocLoader*, CachedResource*, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks);
+        Request(DocLoader*, CachedResource*, bool incremental, SecurityCheckPolicy, bool sendResourceLoadCallbacks);
         ~Request();
         
         Vector<char>& buffer() { return m_buffer; }
@@ -45,7 +46,7 @@ namespace WebCore {
         bool isMultipart() { return m_multipart; }
         void setIsMultipart(bool b = true) { m_multipart = b; }
 
-        bool shouldSkipCanLoadCheck() const { return m_shouldSkipCanLoadCheck; }
+        SecurityCheckPolicy shouldDoSecurityCheck() const { return m_shouldDoSecurityCheck; }
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
         
     private:
@@ -54,7 +55,7 @@ namespace WebCore {
         DocLoader* m_docLoader;
         bool m_incremental;
         bool m_multipart;
-        bool m_shouldSkipCanLoadCheck;
+        SecurityCheckPolicy m_shouldDoSecurityCheck;
         bool m_sendResourceLoadCallbacks;
     };
 
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index fcc9f61..95ce209 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -320,7 +320,7 @@ void ResourceLoader::didCancel(const ResourceError& error)
     // load itself to be cancelled (which could happen with a javascript that 
     // changes the window location). This is used to prevent both the body
     // of this method and the body of connectionDidFinishLoading: running
-    // for a single delegate. Cancelling wins.
+    // for a single delegate. Canceling wins.
     m_cancelled = true;
     
     if (m_handle)
diff --git a/WebCore/loader/SubresourceLoader.cpp b/WebCore/loader/SubresourceLoader.cpp
index 2ee4626..f92a074 100644
--- a/WebCore/loader/SubresourceLoader.cpp
+++ b/WebCore/loader/SubresourceLoader.cpp
@@ -61,18 +61,18 @@ SubresourceLoader::~SubresourceLoader()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, bool skipCanLoadCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
 {
     if (!frame)
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (!skipCanLoadCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
+    if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
 
-    if (!skipCanLoadCheck
+    if (securityCheck == DoSecurityCheck
             && SecurityOrigin::restrictAccessToLocal()
             && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
diff --git a/WebCore/loader/SubresourceLoader.h b/WebCore/loader/SubresourceLoader.h
index 1a94c73..907d917 100644
--- a/WebCore/loader/SubresourceLoader.h
+++ b/WebCore/loader/SubresourceLoader.h
@@ -28,7 +28,8 @@
 
 #ifndef SubresourceLoader_h
 #define SubresourceLoader_h
- 
+
+#include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
  
 namespace WebCore {
@@ -38,7 +39,7 @@ namespace WebCore {
     
     class SubresourceLoader : public ResourceLoader {
     public:
-        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, bool skipCanLoadCheck = false, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
 
         void clearClient() { m_client = 0; }
 
diff --git a/WebCore/loader/WorkerThreadableLoader.cpp b/WebCore/loader/WorkerThreadableLoader.cpp
index bd362f4..6837ca1 100644
--- a/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/WebCore/loader/WorkerThreadableLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -147,7 +147,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionC
 void WorkerThreadableLoader::MainThreadBridge::cancel()
 {
     m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
-    ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
+    ThreadableLoaderClientWrapper* clientWrapper = m_workerClientWrapper.get();
     if (!clientWrapper->done()) {
         // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
         // Note: no more client callbacks will be done after this method -- the clearClientWrapper() call ensures that.
@@ -160,7 +160,7 @@ void WorkerThreadableLoader::MainThreadBridge::cancel()
 
 void WorkerThreadableLoader::MainThreadBridge::clearClientWrapper()
 {
-    static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get())->clearClient();
+    m_workerClientWrapper->clearClient();
 }
 
 static void workerContextDidSendData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 86083f5..09f8f85 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -82,7 +82,7 @@ namespace WebCore {
         //
         // all cases. All tasks posted from the worker context's thread are ok because
         //    the last task posted always is "mainThreadDestroy", so MainThreadBridge is
-        //    around for all tasks that use it on the mian thread.
+        //    around for all tasks that use it on the main thread.
         //
         // case 1. worker.terminate is called.
         //    In this case, no more tasks are posted from the worker object's thread to the worker
@@ -124,7 +124,7 @@ namespace WebCore {
 
             // ThreadableLoaderClientWrapper is to be used on the worker context thread.
             // The ref counting is done on either thread.
-            RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
+            RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
 
             // May be used on either thread.
             WorkerLoaderProxy& m_loaderProxy;
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 7398ef4..c8a485a 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -32,6 +32,7 @@
 #include "ApplicationCacheHost.h"
 #include "ApplicationCacheResource.h"
 #include "ApplicationCacheStorage.h"
+#include "Chrome.h"
 #include "ChromeClient.h"
 #include "DocumentLoader.h"
 #include "DOMApplicationCache.h"
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.cpp b/WebCore/loader/appcache/ApplicationCacheHost.cpp
index 751efc1..fc98746 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -46,6 +46,7 @@ namespace WebCore {
 ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
     : m_domApplicationCache(0)
     , m_documentLoader(documentLoader)
+    , m_defersEvents(true)
     , m_candidateApplicationCacheGroup(0)
 {
     ASSERT(m_documentLoader);
@@ -229,6 +230,11 @@ void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplic
 
 void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
 {
+    if (m_defersEvents) {
+        // Events are deferred until document.onload has fired.
+        m_deferredEvents.append(id);
+        return;
+    }
     if (m_domApplicationCache) {
         ExceptionCode ec = 0;
         m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
@@ -236,6 +242,21 @@ void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
     }
 }
 
+void ApplicationCacheHost::stopDeferringEvents()
+{
+    RefPtr<DocumentLoader> protect(documentLoader());
+    for (unsigned i = 0; i < m_deferredEvents.size(); ++i) {
+        EventID id = m_deferredEvents[i];
+        if (m_domApplicationCache) {
+            ExceptionCode ec = 0;
+            m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
+            ASSERT(!ec);
+        }
+    }
+    m_deferredEvents.clear();
+    m_defersEvents = false;
+}
+
 void ApplicationCacheHost::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
 {
     ASSERT(!m_applicationCache);
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index 9c355de..52d4d40 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
+#include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -110,12 +111,16 @@ namespace WebCore {
         void setDOMApplicationCache(DOMApplicationCache* domApplicationCache);
         void notifyDOMApplicationCache(EventID id);
 
+        void stopDeferringEvents(); // Also raises the events that have been queued up.
+
     private:
         bool isApplicationCacheEnabled();
         DocumentLoader* documentLoader() { return m_documentLoader; }
 
         DOMApplicationCache* m_domApplicationCache;
         DocumentLoader* m_documentLoader;
+        bool m_defersEvents; // Events are deferred until after document onload.
+        Vector<EventID> m_deferredEvents;
 
 #if PLATFORM(CHROMIUM)
         friend class ApplicationCacheHostInternal;
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index d6ee723..1e97d78 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -405,7 +405,7 @@ int64_t ApplicationCacheStorage::spaceNeeded(int64_t cacheToSave)
         totalAvailableSize = (m_maximumSize - currentSize) + m_database.freeSpaceSize();
     }
 
-    // The space needed to be freed in order to accomodate the failed cache is
+    // The space needed to be freed in order to accommodate the failed cache is
     // the size of the failed cache minus any already available free space.
     spaceNeeded = cacheToSave - totalAvailableSize;
     // The space needed value must be positive (or else the total already
diff --git a/WebCore/loader/appcache/DOMApplicationCache.cpp b/WebCore/loader/appcache/DOMApplicationCache.cpp
index 29c1bd5..b9297b1 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -42,7 +42,6 @@ namespace WebCore {
 DOMApplicationCache::DOMApplicationCache(Frame* frame)
     : m_frame(frame)
 {
-    ASSERT(!m_frame || applicationCacheHost());
     ApplicationCacheHost* cacheHost = applicationCacheHost();
     if (cacheHost)
         cacheHost->setDOMApplicationCache(this);
@@ -87,8 +86,9 @@ void DOMApplicationCache::swapCache(ExceptionCode& ec)
 
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
-    ASSERT(m_frame);
-    return m_frame->document();
+    if (m_frame)
+        return m_frame->document();
+    return 0;
 }
 
 const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::EventID id)
diff --git a/WebCore/loader/appcache/DOMApplicationCache.idl b/WebCore/loader/appcache/DOMApplicationCache.idl
index dd5468a..9c3a359 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -27,7 +27,8 @@ module offline {
  
     interface [
         Conditional=OFFLINE_WEB_APPLICATIONS,
-        EventTarget
+        EventTarget,
+        OmitConstructor
     ] DOMApplicationCache {
         // update status
         const unsigned short UNCACHED = 0;
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index c98a2f0..d693341 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -117,14 +117,15 @@ Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 #endif
 }
 
-void Loader::load(DocLoader* docLoader, CachedResource* resource, bool incremental, bool skipCanLoadCheck, bool sendResourceLoadCallbacks)
+void Loader::load(DocLoader* docLoader, CachedResource* resource, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
     ASSERT(docLoader);
-    Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
+    Request* request = new Request(docLoader, resource, incremental, securityCheck, sendResourceLoadCallbacks);
 
     RefPtr<Host> host;
     KURL url(ParsedURLString, resource->url());
     if (url.protocolInHTTPFamily()) {
+        m_hosts.checkConsistency();
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
@@ -169,6 +170,7 @@ void Loader::servePendingRequests(Priority minimumPriority)
     m_nonHTTPProtocolHost->servePendingRequests(minimumPriority);
 
     Vector<Host*> hostsToServe;
+    m_hosts.checkConsistency();
     HostMap::iterator i = m_hosts.begin();
     HostMap::iterator end = m_hosts.end();
     for (;i != end; ++i)
@@ -205,6 +207,7 @@ void Loader::nonCacheRequestInFlight(const KURL& url)
         return;
     
     AtomicString hostName = url.host();
+    m_hosts.checkConsistency();
     RefPtr<Host> host = m_hosts.get(hostName.impl());
     if (!host) {
         host = Host::create(hostName, maxRequestsInFlightPerHost);
@@ -220,6 +223,7 @@ void Loader::nonCacheRequestComplete(const KURL& url)
         return;
     
     AtomicString hostName = url.host();
+    m_hosts.checkConsistency();
     RefPtr<Host> host = m_hosts.get(hostName.impl());
     ASSERT(host);
     if (!host)
@@ -236,6 +240,7 @@ void Loader::cancelRequests(DocLoader* docLoader)
         m_nonHTTPProtocolHost->cancelRequests(docLoader);
     
     Vector<Host*> hostsToCancel;
+    m_hosts.checkConsistency();
     HostMap::iterator i = m_hosts.begin();
     HostMap::iterator end = m_hosts.end();
     for (;i != end; ++i)
@@ -347,7 +352,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         }
 
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(docLoader->doc()->frame(),
-            this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
+            this, resourceRequest, request->shouldDoSecurityCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
diff --git a/WebCore/loader/loader.h b/WebCore/loader/loader.h
index d0a526f..a9de032 100644
--- a/WebCore/loader/loader.h
+++ b/WebCore/loader/loader.h
@@ -24,6 +24,7 @@
 
 #include "AtomicString.h"
 #include "AtomicStringImpl.h"
+#include "FrameLoaderTypes.h"
 #include "PlatformString.h"
 #include "SubresourceLoaderClient.h"
 #include "Timer.h"
@@ -43,7 +44,7 @@ namespace WebCore {
         Loader();
         ~Loader();
 
-        void load(DocLoader*, CachedResource*, bool incremental = true, bool skipCanLoadCheck = false, bool sendResourceLoadCallbacks = true);
+        void load(DocLoader*, CachedResource*, bool incremental = true, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true);
 
         void cancelRequests(DocLoader*);