Merge WebKit at r66079 : Initial merge by git

Change-Id: Ie2e1440fb9d487d24e52c247342c076fecaecac7

32 files changed, 278 insertions, 289 deletions

diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 521d075..cb536e2 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -82,10 +82,6 @@ static CachedResource* createResource(CachedResource::Type type, const KURL& url
     case CachedResource::XSLStyleSheet:
         return new CachedXSLStyleSheet(url.string());
 #endif
-#if ENABLE(XBL)
-    case CachedResource::XBLStyleSheet:
-        return new CachedXBLDocument(url.string());
-#endif
 #if ENABLE(LINK_PREFETCH)
     case CachedResource::LinkPrefetch:
         return new CachedResource(url.string(), CachedResource::LinkPrefetch);
@@ -691,11 +687,6 @@ Cache::Statistics Cache::getStatistics()
         case CachedResource::FontResource:
             stats.fonts.addResource(resource);
             break;
-#if ENABLE(XBL)
-        case CachedResource::XBL:
-            stats.xblDocs.addResource(resource)
-            break;
-#endif
         default:
             break;
         }
diff --git a/WebCore/loader/Cache.h b/WebCore/loader/Cache.h
index 23aad1e..ce8cde4 100644
--- a/WebCore/loader/Cache.h
+++ b/WebCore/loader/Cache.h
@@ -85,9 +85,6 @@ public:
 #if ENABLE(XSLT)
         TypeStatistic xslStyleSheets;
 #endif
-#if ENABLE(XBL)
-        TypeStatistic xblDocs;
-#endif
         TypeStatistic fonts;
     };
 
diff --git a/WebCore/loader/CachedMetadata.h b/WebCore/loader/CachedMetadata.h
index d26539e..120e4c0 100644
--- a/WebCore/loader/CachedMetadata.h
+++ b/WebCore/loader/CachedMetadata.h
@@ -84,7 +84,7 @@ private:
     {
         if (m_serializedData.size() < position + sizeof(unsigned))
             return 0;
-        return *reinterpret_cast<unsigned*>(const_cast<char*>(m_serializedData.data() + position));
+        return *reinterpret_cast_ptr<unsigned*>(const_cast<char*>(m_serializedData.data() + position));
     }
 
     // Appends an unsigned value to the end of the serialized data.
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 4b83a8e..f6eb730 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -61,9 +61,6 @@ public:
 #if ENABLE(XSLT)
         , XSLStyleSheet
 #endif
-#if ENABLE(XBL)
-        , XBL
-#endif
 #if ENABLE(LINK_PREFETCH)
         , LinkPrefetch
 #endif
diff --git a/WebCore/loader/CachedResourceClient.h b/WebCore/loader/CachedResourceClient.h
index 40a6a06..275d331 100644
--- a/WebCore/loader/CachedResourceClient.h
+++ b/WebCore/loader/CachedResourceClient.h
@@ -28,12 +28,6 @@
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 
-#if ENABLE(XBL)
-namespace XBL {
-    class XBLDocument;
-}
-#endif
-
 namespace WebCore {
 
     class CachedCSSStyleSheet;
@@ -68,13 +62,7 @@ namespace WebCore {
 
         virtual void setCSSStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* charset */, const CachedCSSStyleSheet*) { }
         virtual void setXSLStyleSheet(const String& /* href */, const KURL& /* baseURL */, const String& /* sheet */) { }
-
         virtual void fontLoaded(CachedFont*) {};
-
-#if ENABLE(XBL)
-        virtual void setXBLDocument(const String& /*URL*/, XBL::XBLDocument*) { }
-#endif
-
         virtual void notifyFinished(CachedResource*) { }
     };
 
diff --git a/WebCore/loader/CachedXBLDocument.cpp b/WebCore/loader/CachedXBLDocument.cpp
deleted file mode 100644
index 0ff17f2..0000000
--- a/WebCore/loader/CachedXBLDocument.cpp
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
-    Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
-    Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
-    Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
-    Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-
-    This class provides all functionality needed for loading images, style sheets and html
-    pages from the web. It has a memory cache for these objects.
-*/
-
-#include "config.h"
-
-#if ENABLE(XBL)
-
-#include "CachedXBLDocument.h"
-
-#include "CachedResourceClientWalker.h"
-#include "TextResourceDecoder.h"
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-CachedXBLDocument::CachedXBLDocument(const String &url)
-: CachedResource(url, XBL), m_document(0)
-{
-    // It's XML we want.
-    setAccept("text/xml, application/xml, application/xhtml+xml, text/xsl, application/rss+xml, application/atom+xml");
-
-    m_decoder = new TextResourceDecoder("application/xml");
-}
-
-CachedXBLDocument::~CachedXBLDocument()
-{
-    if (m_document)
-        m_document->deref();
-}
-
-void CachedXBLDocument::ref(CachedResourceClient *c)
-{
-    CachedResource::ref(c);
-    if (!m_loading)
-        c->setXBLDocument(m_url, m_document);
-}
-
-void CachedXBLDocument::setEncoding(const String& chs)
-{
-    m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
-}
-
-String CachedXBLDocument::encoding() const
-{
-    return m_decoder->encoding().name();
-}
-
-void CachedXBLDocument::data(Vector<char>& data, bool )
-{
-    if (!allDataReceived)
-        return;
-    
-    ASSERT(!m_document);
-    
-    m_document = new XBL::XBLDocument();
-    m_document->ref();
-    m_document->open();
-    
-    m_document->write(m_decoder->decode(data.data(), data.size()));
-    setSize(data.size());
-    
-    m_document->finishParsing();
-    m_document->close();
-    m_loading = false;
-    checkNotify();
-}
-
-void CachedXBLDocument::checkNotify()
-{
-    if (m_loading)
-        return;
-    
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient *c = w.next())
-        c->setXBLDocument(m_url, m_document);
-}
-
-void CachedXBLDocument::error()
-{
-    m_loading = false;
-    m_errorOccurred = true;
-    checkNotify();
-}
-
-}
-
-#endif
diff --git a/WebCore/loader/CachedXBLDocument.h b/WebCore/loader/CachedXBLDocument.h
deleted file mode 100644
index 9a8d366..0000000
--- a/WebCore/loader/CachedXBLDocument.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
-    Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
-    Copyright (C) 2001 Dirk Mueller <mueller@kde.org>
-    Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
-    Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-
-    This class provides all functionality needed for loading images, style sheets and html
-    pages from the web. It has a memory cache for these objects.
-*/
-
-#ifndef CachedXBLDocument_h
-#define CachedXBLDocument_h
-
-#include "CachedResource.h"
-#include <wtf/Vector.h>
-
-namespace WebCore {
-    class CachedResource;
-    class Request;
-    class DocLoader;
-    class TextResourceDecoder;
-    class CachedResourceClient;
-    
-#if ENABLE(XBL)
-    class CachedXBLDocument : public CachedResource {
-    public:
-        CachedXBLDocument(const String& url);
-        virtual ~CachedXBLDocument();
-        
-        XBL::XBLDocument* document() const { return m_document; }
-        
-        virtual void addClient(CachedResourceClient*);
-        
-        virtual void setEncoding(const String&);
-        virtual String encoding() const;
-        virtual void data(Vector<char>&, bool allDataReceived);
-        virtual void error();
-        
-        void checkNotify();
-        
-    protected:
-        XBL::XBLDocument* m_document;
-        RefPtr<TextResourceDecoder> m_decoder;
-    };
-
-#endif
-
-}
-
-#endif
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index f6588c7..d63123e 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "DocLoader.h"
 
+#include "loader.h"
 #include "Cache.h"
 #include "CachedCSSStyleSheet.h"
 #include "CachedFont.h"
@@ -40,7 +41,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
-#include "loader.h"
+#include "PingLoader.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include <wtf/text/CString.h>
@@ -128,6 +129,13 @@ CachedImage* DocLoader::requestImage(const String& url)
         Settings* settings = f->settings();
         if (!f->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
             return 0;
+
+        if (f->loader()->pageDismissalEventBeingDispatched()) {
+            KURL completeURL = m_doc->completeURL(url);
+            if (completeURL.isValid() && canRequest(CachedResource::ImageResource, completeURL))
+                PingLoader::loadImage(f, completeURL);
+            return 0;
+        }
     }
     CachedImage* resource = static_cast<CachedImage*>(requestResource(CachedResource::ImageResource, url, String()));
     if (autoLoadImages() && resource && resource->stillNeedsLoad()) {
@@ -169,13 +177,6 @@ CachedXSLStyleSheet* DocLoader::requestXSLStyleSheet(const String& url)
 }
 #endif
 
-#if ENABLE(XBL)
-CachedXBLDocument* DocLoader::requestXBLDocument(const String& url)
-{
-    return static_cast<CachedXSLStyleSheet*>(requestResource(CachedResource::XBL, url, String()));
-}
-#endif
-
 #if ENABLE(LINK_PREFETCH)
 CachedResource* DocLoader::requestLinkPrefetch(const String& url)
 {
@@ -201,11 +202,6 @@ bool DocLoader::canRequest(CachedResource::Type type, const KURL& url)
         break;
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
-#endif
-#if ENABLE(XBL)
-    case CachedResource::XBL:
-#endif
-#if ENABLE(XSLT) || ENABLE(XBL)
         if (!m_doc->securityOrigin()->canRequest(url)) {
             printAccessDeniedMessage(url);
             return false;
@@ -229,9 +225,6 @@ bool DocLoader::canRequest(CachedResource::Type type, const KURL& url)
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
 #endif
-#if ENABLE(XBL)
-    case CachedResource::XBL:
-#endif
         // These resource can inject script into the current document.
         if (Frame* f = frame())
             f->loader()->checkIfRunInsecureContent(m_doc->securityOrigin(), url);
diff --git a/WebCore/loader/DocLoader.h b/WebCore/loader/DocLoader.h
index 06b02c9..d77bce5 100644
--- a/WebCore/loader/DocLoader.h
+++ b/WebCore/loader/DocLoader.h
@@ -64,9 +64,6 @@ public:
 #if ENABLE(XSLT)
     CachedXSLStyleSheet* requestXSLStyleSheet(const String& url);
 #endif
-#if ENABLE(XBL)
-    CachedXBLDocument* requestXBLDocument(const String &url);
-#endif
 #if ENABLE(LINK_PREFETCH)
     CachedResource* requestLinkPrefetch(const String &url);
 #endif
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index 5c7102c..6475ea9 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -50,7 +50,10 @@ using namespace HTMLNames;
     
 class FTPDirectoryDocumentParser : public HTMLDocumentParser {
 public:
-    FTPDirectoryDocumentParser(HTMLDocument*);
+    static PassRefPtr<FTPDirectoryDocumentParser> create(HTMLDocument* document)
+    {
+        return adoptRef(new FTPDirectoryDocumentParser(document));
+    }
 
     virtual void append(const SegmentedString&);
     virtual void finish();
@@ -70,6 +73,8 @@ public:
     }
         
 private:
+    FTPDirectoryDocumentParser(HTMLDocument*);
+
     // The parser will attempt to load the document template specified via the preference
     // Failing that, it will fall back and create the basic document which will have a minimal
     // table for presenting the FTP directory in a useful manner
@@ -436,9 +441,9 @@ FTPDirectoryDocument::FTPDirectoryDocument(Frame* frame, const KURL& url)
 #endif
 }
 
-DocumentParser* FTPDirectoryDocument::createParser()
+PassRefPtr<DocumentParser> FTPDirectoryDocument::createParser()
 {
-    return new FTPDirectoryDocumentParser(this);
+    return FTPDirectoryDocumentParser::create(this);
 }
 
 }
diff --git a/WebCore/loader/FTPDirectoryDocument.h b/WebCore/loader/FTPDirectoryDocument.h
index 920f870..e7e52f7 100644
--- a/WebCore/loader/FTPDirectoryDocument.h
+++ b/WebCore/loader/FTPDirectoryDocument.h
@@ -40,7 +40,7 @@ public:
 
 private:
     FTPDirectoryDocument(Frame*, const KURL&);
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
 };
     
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 639b6cc..754c151 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -333,6 +333,8 @@ public:
     
     void started();
 
+    bool pageDismissalEventBeingDispatched() const { return m_pageDismissalEventBeingDispatched; }
+
 private:
     bool canCachePageContainingThisFrame();
 #ifndef NDEBUG
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index b1e33f4..a1a9f80 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -73,17 +73,22 @@ private:
     
 class ImageDocumentParser : public RawDataDocumentParser {
 public:
-    ImageDocumentParser(ImageDocument* document)
-        : RawDataDocumentParser(document)
+    static PassRefPtr<ImageDocumentParser> create(ImageDocument* document)
     {
+        return adoptRef(new ImageDocumentParser(document));
     }
 
     ImageDocument* document() const
     {
-        return static_cast<ImageDocument*>(m_document);
+        return static_cast<ImageDocument*>(RawDataDocumentParser::document());
     }
-
+    
 private:
+    ImageDocumentParser(ImageDocument* document)
+        : RawDataDocumentParser(document)
+    {
+    }
+
     virtual void appendBytes(DocumentWriter*, const char*, int, bool);
     virtual void finish();
 };
@@ -175,9 +180,9 @@ ImageDocument::ImageDocument(Frame* frame, const KURL& url)
     setParseMode(Compat);
 }
     
-DocumentParser* ImageDocument::createParser()
+PassRefPtr<DocumentParser> ImageDocument::createParser()
 {
-    return new ImageDocumentParser(this);
+    return ImageDocumentParser::create(this);
 }
 
 void ImageDocument::createDocumentStructure()
diff --git a/WebCore/loader/ImageDocument.h b/WebCore/loader/ImageDocument.h
index e85b3ab..5d00bd6 100644
--- a/WebCore/loader/ImageDocument.h
+++ b/WebCore/loader/ImageDocument.h
@@ -49,7 +49,7 @@ public:
 private:
     ImageDocument(Frame*, const KURL&);
 
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
     virtual bool isImageDocument() const { return true; }
     
     void createDocumentStructure();
diff --git a/WebCore/loader/MediaDocument.cpp b/WebCore/loader/MediaDocument.cpp
index 97e1775..7e28d02 100644
--- a/WebCore/loader/MediaDocument.cpp
+++ b/WebCore/loader/MediaDocument.cpp
@@ -47,13 +47,18 @@ using namespace HTMLNames;
 // FIXME: Share more code with PluginDocumentParser.
 class MediaDocumentParser : public RawDataDocumentParser {
 public:
+    static PassRefPtr<MediaDocumentParser> create(MediaDocument* document)
+    {
+        return adoptRef(new MediaDocumentParser(document));
+    }
+    
+private:
     MediaDocumentParser(Document* document)
         : RawDataDocumentParser(document)
         , m_mediaElement(0)
     {
     }
 
-private:
     virtual void appendBytes(DocumentWriter*, const char*, int, bool);
 
     void createDocumentStructure();
@@ -113,9 +118,9 @@ MediaDocument::~MediaDocument()
     ASSERT(!m_replaceMediaElementTimer.isActive());
 }
 
-DocumentParser* MediaDocument::createParser()
+PassRefPtr<DocumentParser> MediaDocument::createParser()
 {
-    return new MediaDocumentParser(this);
+    return MediaDocumentParser::create(this);
 }
 
 void MediaDocument::defaultEventHandler(Event* event)
diff --git a/WebCore/loader/MediaDocument.h b/WebCore/loader/MediaDocument.h
index 5a8ec52..2d81296 100644
--- a/WebCore/loader/MediaDocument.h
+++ b/WebCore/loader/MediaDocument.h
@@ -46,7 +46,7 @@ private:
     MediaDocument(Frame*, const KURL&);
 
     virtual bool isMediaDocument() const { return true; }        
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
 
     virtual void defaultEventHandler(Event*);
 
diff --git a/WebCore/loader/PingLoader.cpp b/WebCore/loader/PingLoader.cpp
new file mode 100644
index 0000000..d2c6410
--- /dev/null
+++ b/WebCore/loader/PingLoader.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "PingLoader.h"
+
+#include "Frame.h"
+#include "ResourceHandle.h"
+#include "SecurityOrigin.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/UnusedParam.h>
+
+namespace WebCore {
+
+void PingLoader::loadImage(Frame* frame, const KURL& url)
+{
+    if (SecurityOrigin::restrictAccessToLocal() && !SecurityOrigin::canLoad(url, String(), frame->document())) {
+        FrameLoader::reportLocalLoadFailed(frame, url);
+        return;
+    }
+
+    ResourceRequest request(url);
+    request.setTargetType(ResourceRequest::TargetIsImage);
+    request.setHTTPHeaderField("Cache-Control", "max-age=0");
+    if (!SecurityOrigin::shouldHideReferrer(request.url(), frame->loader()->outgoingReferrer()))
+        request.setHTTPReferrer(frame->loader()->outgoingReferrer());
+    frame->loader()->addExtraFieldsToSubresourceRequest(request);
+    OwnPtr<PingLoader> pingLoader(new PingLoader(frame, request));
+    
+    // Leak the ping loader, since it will kill itself as soon as it receives a response.
+    PingLoader* leakedPingLoader = pingLoader.leakPtr();
+    UNUSED_PARAM(leakedPingLoader);
+}
+
+PingLoader::PingLoader(Frame* frame, const ResourceRequest& request)
+{
+    m_handle = ResourceHandle::create(request, this, frame, false, false);
+}
+
+PingLoader::~PingLoader()
+{
+    m_handle->cancel();
+}
+
+}
diff --git a/WebCore/loader/PingLoader.h b/WebCore/loader/PingLoader.h
new file mode 100644
index 0000000..1d8a2d8
--- /dev/null
+++ b/WebCore/loader/PingLoader.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef PingLoader_h
+#define PingLoader_h
+
+#include "ResourceHandleClient.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class KURL;
+class ResourceError;
+class ResourceHandle;
+class ResourceResponse;
+
+// This class triggers asynchronous loads independent of Frame staying alive (i.e., auditing pingbacks).
+// Since nothing depends on resources loaded through this class, we just want
+// to allow the load to live long enough to ensure the message was actually sent.
+// Therefore, as soon as a callback is received from the ResourceHandle, this class 
+// will cancel the load and delete itself.
+class PingLoader : private ResourceHandleClient, public Noncopyable {
+public:
+    static void loadImage(Frame*, const KURL& url);
+
+    ~PingLoader();
+
+private:
+    PingLoader(Frame*, const ResourceRequest&);
+
+    void didReceiveResponse(ResourceHandle*, const ResourceResponse&) { delete this; }
+    void didReceiveData(ResourceHandle*, const char*, int) { delete this; }
+    void didFinishLoading(ResourceHandle*) { delete this; }
+    void didFail(ResourceHandle*, const ResourceError&) { delete this; }
+
+    RefPtr<ResourceHandle> m_handle;
+};
+
+}
+
+#endif
diff --git a/WebCore/loader/PluginDocument.cpp b/WebCore/loader/PluginDocument.cpp
index cca6894..54e686c 100644
--- a/WebCore/loader/PluginDocument.cpp
+++ b/WebCore/loader/PluginDocument.cpp
@@ -43,15 +43,20 @@ using namespace HTMLNames;
 // FIXME: Share more code with MediaDocumentParser.
 class PluginDocumentParser : public RawDataDocumentParser {
 public:
+    static PassRefPtr<PluginDocumentParser> create(PluginDocument* document)
+    {
+        return adoptRef(new PluginDocumentParser(document));
+    }
+
+    static Widget* pluginWidgetFromDocument(Document*);
+    
+private:
     PluginDocumentParser(Document* document)
         : RawDataDocumentParser(document)
         , m_embedElement(0)
     {
     }
 
-    static Widget* pluginWidgetFromDocument(Document*);
-
-private:
     virtual void appendBytes(DocumentWriter*, const char*, int, bool);
 
     void createDocumentStructure();
@@ -130,9 +135,9 @@ PluginDocument::PluginDocument(Frame* frame, const KURL& url)
     setParseMode(Compat);
 }
     
-DocumentParser* PluginDocument::createParser()
+PassRefPtr<DocumentParser> PluginDocument::createParser()
 {
-    return new PluginDocumentParser(this);
+    return PluginDocumentParser::create(this);
 }
 
 Widget* PluginDocument::pluginWidget()
diff --git a/WebCore/loader/PluginDocument.h b/WebCore/loader/PluginDocument.h
index 53dde65..3bb5d99 100644
--- a/WebCore/loader/PluginDocument.h
+++ b/WebCore/loader/PluginDocument.h
@@ -46,7 +46,7 @@ public:
 private:
     PluginDocument(Frame*, const KURL&);
 
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
 };
     
 }
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
index d969f30..26d7787 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -342,10 +342,10 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
     }
     
 #if !ENABLE(HISTORY_ALWAYS_ASYNC)
-    // If the specified entry and the current entry have the same document, this is either a state object traversal or a fragment 
-    // traversal (or both) and should be performed synchronously.
+    // If the specified entry and the current entry have the same document (or documents, in there are frames), this is either a 
+    // state object traversal or a fragment traversal (or both) and should be performed synchronously.
     HistoryItem* currentEntry = m_frame->loader()->history()->currentItem();
-    if (currentEntry != specifiedEntry && currentEntry->documentSequenceNumber() == specifiedEntry->documentSequenceNumber()) {
+    if (currentEntry != specifiedEntry && currentEntry->hasSameDocuments(specifiedEntry)) {
         m_frame->loader()->history()->goToItem(specifiedEntry, FrameLoadTypeIndexedBackForward);
         return;
     }
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index b700fcf..b679795 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -32,6 +32,7 @@
 
 #include "ApplicationCacheHost.h"
 #include "DocumentLoader.h"
+#include "FileStreamProxy.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "InspectorTimelineAgent.h"
@@ -522,4 +523,12 @@ void ResourceLoader::willCacheResponse(ResourceHandle*, CacheStoragePolicy& poli
         policy = StorageAllowedInMemoryOnly;    
 }
 
+#if ENABLE(BLOB)
+AsyncFileStream* ResourceLoader::createAsyncFileStream(FileStreamClient* client)
+{
+    // It is OK to simply return a pointer since FileStreamProxy::create adds an extra ref.
+    return FileStreamProxy::create(m_frame->document()->scriptExecutionContext(), client).get();
+}
+#endif
+
 }
diff --git a/WebCore/loader/ResourceLoader.h b/WebCore/loader/ResourceLoader.h
index e7643bf..f2a3161 100644
--- a/WebCore/loader/ResourceLoader.h
+++ b/WebCore/loader/ResourceLoader.h
@@ -122,6 +122,9 @@ namespace WebCore {
 #if USE(CFNETWORK)
         virtual bool shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef);
 #endif
+#if ENABLE(BLOB)
+        virtual AsyncFileStream* createAsyncFileStream(FileStreamClient*);
+#endif
 
         ResourceHandle* handle() const { return m_handle.get(); }
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
diff --git a/WebCore/loader/SinkDocument.cpp b/WebCore/loader/SinkDocument.cpp
index fb0ab94..262d318 100644
--- a/WebCore/loader/SinkDocument.cpp
+++ b/WebCore/loader/SinkDocument.cpp
@@ -32,12 +32,17 @@ namespace WebCore {
 
 class SinkDocumentParser : public RawDataDocumentParser {
 public:
+    static PassRefPtr<SinkDocumentParser> create(SinkDocument* document)
+    {
+        return adoptRef(new SinkDocumentParser(document));
+    }
+    
+private:
     SinkDocumentParser(SinkDocument* document)
         : RawDataDocumentParser(document)
     {
     }
 
-private:
     // Ignore all data.
     virtual void appendBytes(DocumentWriter*, const char*, int, bool) { }
 };
@@ -48,9 +53,9 @@ SinkDocument::SinkDocument(Frame* frame, const KURL& url)
     setParseMode(Compat);
 }
 
-DocumentParser* SinkDocument::createParser()
+PassRefPtr<DocumentParser> SinkDocument::createParser()
 {
-    return new SinkDocumentParser(this);
+    return SinkDocumentParser::create(this);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/SinkDocument.h b/WebCore/loader/SinkDocument.h
index 61930d4..50152ff 100644
--- a/WebCore/loader/SinkDocument.h
+++ b/WebCore/loader/SinkDocument.h
@@ -40,7 +40,7 @@ public:
 private:
     SinkDocument(Frame*, const KURL&);
     
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
 };
 
 
diff --git a/WebCore/loader/SubframeLoader.cpp b/WebCore/loader/SubframeLoader.cpp
index e7dafa1..f56ebf1 100644
--- a/WebCore/loader/SubframeLoader.cpp
+++ b/WebCore/loader/SubframeLoader.cpp
@@ -37,9 +37,6 @@
 #include "FrameLoaderClient.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFrameElementBase.h"
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "HTMLMediaElement.h"
-#endif
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "MIMETypeRegistry.h"
@@ -47,13 +44,15 @@
 #include "Page.h"
 #include "PluginData.h"
 #include "RenderEmbeddedObject.h"
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#include "RenderVideo.h"
-#endif
 #include "RenderView.h"
 #include "Settings.h"
 #include "XSSAuditor.h"
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "HTMLMediaElement.h"
+#include "RenderVideo.h"
+#endif
+
 namespace WebCore {
     
 using namespace HTMLNames;
@@ -90,12 +89,7 @@ bool SubframeLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const Str
     } else
         url = completeURL(urlString);
 
-    Frame* frame = ownerElement->contentFrame();
-    if (frame)
-        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_frame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, m_frame->loader()->isProcessingUserGesture());
-    else
-        frame = loadSubframe(ownerElement, url, frameName, m_frame->loader()->outgoingReferrer());
-    
+    Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList);
     if (!frame)
         return false;
 
@@ -138,10 +132,10 @@ bool SubframeLoader::requestObject(RenderEmbeddedObject* renderer, const String&
     ASSERT(renderer->node()->hasTagName(objectTag) || renderer->node()->hasTagName(embedTag));
     HTMLPlugInElement* element = static_cast<HTMLPlugInElement*>(renderer->node());
 
-    // If the plug-in element already contains a subframe, requestFrame will re-use it. Otherwise,
+    // If the plug-in element already contains a subframe, loadOrRedirectSubframe will re-use it. Otherwise,
     // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
     // in the widget to be torn down.
-    return requestFrame(element, completedURL, frameName);
+    return loadOrRedirectSubframe(element, completedURL, frameName, true, true);
 }
 
 
@@ -236,6 +230,16 @@ PassRefPtr<Widget> SubframeLoader::createJavaAppletWidget(const IntSize& size, H
     return widget;
 }
 
+Frame* SubframeLoader::loadOrRedirectSubframe(HTMLFrameOwnerElement* ownerElement, const KURL& url, const AtomicString& frameName, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* frame = ownerElement->contentFrame();
+    if (frame)
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_frame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, m_frame->loader()->isProcessingUserGesture());
+    else
+        frame = loadSubframe(ownerElement, url, frameName, m_frame->loader()->outgoingReferrer());
+    return frame;
+}
+
 Frame* SubframeLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL& url, const String& name, const String& referrer)
 {
     bool allowsScrolling = true;
diff --git a/WebCore/loader/SubframeLoader.h b/WebCore/loader/SubframeLoader.h
index df08870..d42ef2c 100644
--- a/WebCore/loader/SubframeLoader.h
+++ b/WebCore/loader/SubframeLoader.h
@@ -74,6 +74,7 @@ public:
     bool containsPlugins() const { return m_containsPlugins; }
 
 private:
+    Frame* loadOrRedirectSubframe(HTMLFrameOwnerElement*, const KURL&, const AtomicString& frameName, bool lockHistory, bool lockBackForwardList);
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
     bool loadPlugin(RenderEmbeddedObject*, const KURL&, const String& mimeType,
         const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
diff --git a/WebCore/loader/TextDocument.cpp b/WebCore/loader/TextDocument.cpp
index 6b53084..5e2b774 100644
--- a/WebCore/loader/TextDocument.cpp
+++ b/WebCore/loader/TextDocument.cpp
@@ -42,11 +42,22 @@ using namespace HTMLNames;
 // which started the Tokenizer in the PlainText state.
 class TextDocumentParser : public DecodedDataDocumentParser {
 public:
-    TextDocumentParser(Document*);
+    static PassRefPtr<TextDocumentParser> create(Document* document)
+    {
+        return adoptRef(new TextDocumentParser(document));
+    }
+
+    static PassRefPtr<TextDocumentParser> create(HTMLViewSourceDocument* document)
+    {
+        return adoptRef(new TextDocumentParser(document));
+    }
+
     virtual ~TextDocumentParser();
+    
+private:
+    TextDocumentParser(Document*);
     TextDocumentParser(HTMLViewSourceDocument*);
 
-private:
     virtual void insert(const SegmentedString&);
     virtual void append(const SegmentedString&);
     virtual void finish();
@@ -193,14 +204,14 @@ TextDocument::TextDocument(Frame* frame, const KURL& url)
 {
 }
 
-DocumentParser* TextDocument::createParser()
+PassRefPtr<DocumentParser> TextDocument::createParser()
 {
-    return new TextDocumentParser(this);
+    return TextDocumentParser::create(this);
 }
 
-DocumentParser* createTextDocumentParser(HTMLViewSourceDocument* document)
+PassRefPtr<DocumentParser> createTextDocumentParser(HTMLViewSourceDocument* document)
 {
-    return new TextDocumentParser(document);
+    return TextDocumentParser::create(document);
 }
 
 }
diff --git a/WebCore/loader/TextDocument.h b/WebCore/loader/TextDocument.h
index 8f58b69..d5bf153 100644
--- a/WebCore/loader/TextDocument.h
+++ b/WebCore/loader/TextDocument.h
@@ -41,10 +41,10 @@ public:
 private:
     TextDocument(Frame*, const KURL&);
     
-    virtual DocumentParser* createParser();
+    virtual PassRefPtr<DocumentParser> createParser();
 };
 
-DocumentParser* createTextDocumentParser(HTMLViewSourceDocument*);
+PassRefPtr<DocumentParser> createTextDocumentParser(HTMLViewSourceDocument*);
 
 }
 
diff --git a/WebCore/loader/icon/IconDatabase.cpp b/WebCore/loader/icon/IconDatabase.cpp
index 63b9c64..f708622 100644
--- a/WebCore/loader/icon/IconDatabase.cpp
+++ b/WebCore/loader/icon/IconDatabase.cpp
@@ -768,6 +768,7 @@ IconDatabase::IconDatabase()
     , m_threadTerminationRequested(false)
     , m_removeIconsRequested(false)
     , m_iconURLImportComplete(false)
+    , m_disabledSuddenTerminationForSyncThread(false)
     , m_initialPruningComplete(false)
     , m_client(defaultClient())
     , m_imported(false)
@@ -806,13 +807,17 @@ void IconDatabase::notifyPendingLoadDecisions()
 
 void IconDatabase::wakeSyncThread()
 {
-    // The following is balanced by the call to enableSuddenTermination in the
-    // syncThreadMainLoop function.
-    // FIXME: It would be better to only disable sudden termination if we have
-    // something to write, not just if we have something to read.
-    disableSuddenTermination();
-
     MutexLocker locker(m_syncLock);
+
+    if (!m_disabledSuddenTerminationForSyncThread) {
+        m_disabledSuddenTerminationForSyncThread = true;
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncThreadMainLoop function.
+        // FIXME: It would be better to only disable sudden termination if we have
+        // something to write, not just if we have something to read.
+        disableSuddenTermination();
+    }
+
     m_syncCondition.signal();
 }
 
@@ -1411,7 +1416,9 @@ void* IconDatabase::syncThreadMainLoop()
             // The following is balanced by the call to disableSuddenTermination in the
             // wakeSyncThread function. Any time we wait on the condition, we also have
             // to enableSuddenTermation, after doing the next batch of work.
+            ASSERT(m_disabledSuddenTerminationForSyncThread);
             enableSuddenTermination();
+            m_disabledSuddenTerminationForSyncThread = false;
         }
 
         m_syncCondition.wait(m_syncLock);
@@ -1428,7 +1435,9 @@ void* IconDatabase::syncThreadMainLoop()
         // The following is balanced by the call to disableSuddenTermination in the
         // wakeSyncThread function. Any time we wait on the condition, we also have
         // to enableSuddenTermation, after doing the next batch of work.
+        ASSERT(m_disabledSuddenTerminationForSyncThread);
         enableSuddenTermination();
+        m_disabledSuddenTerminationForSyncThread = false;
     }
 
     return 0;
diff --git a/WebCore/loader/icon/IconDatabase.h b/WebCore/loader/icon/IconDatabase.h
index 9793d21..6146aa6 100644
--- a/WebCore/loader/icon/IconDatabase.h
+++ b/WebCore/loader/icon/IconDatabase.h
@@ -144,11 +144,12 @@ private:
     String m_databaseDirectory;
     // Holding m_syncLock is required when accessing m_completeDatabasePath
     String m_completeDatabasePath;
-    
+
     bool m_threadTerminationRequested;
     bool m_removeIconsRequested;
     bool m_iconURLImportComplete;
-    
+    bool m_disabledSuddenTerminationForSyncThread;
+
     Mutex m_urlAndIconLock;
     // Holding m_urlAndIconLock is required when accessing any of the following data structures or the objects they contain
     HashMap<String, IconRecord*> m_iconURLToRecordMap;
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index 230d6ea..345d881 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -79,9 +79,6 @@ static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource
 #if ENABLE(XSLT)
     case CachedResource::XSLStyleSheet:
 #endif
-#if ENABLE(XBL)
-    case CachedResource::XBL:
-#endif
         return ResourceRequest::TargetIsStyleSheet;
     case CachedResource::Script: 
         return ResourceRequest::TargetIsScript;
@@ -106,9 +103,6 @@ Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 #if ENABLE(XSLT)
         case CachedResource::XSLStyleSheet:
 #endif
-#if ENABLE(XBL)
-        case CachedResource::XBL:
-#endif
             return High;
         case CachedResource::Script: 
         case CachedResource::FontResource:
@@ -551,9 +545,7 @@ void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, i
     if (resource->errorOccurred())
         return;
         
-    if (resource->response().httpStatusCode() / 100 == 4) {
-        // Treat a 4xx response like a network error for all resources but images (which will ignore the error and continue to load for 
-        // legacy compatibility).
+    if (resource->response().httpStatusCode() >= 400) {
         resource->httpStatusCodeError();
         return;
     }