Merge remote-tracking branch 'origin/5.7' into dev

Change-Id: Ib5bd1f44e83e29501eaa432ddb47320375f5079a

49 files changed, 368 insertions, 164 deletions

diff --git a/Source/WTF/wtf/FeatureDefines.h b/Source/WTF/wtf/FeatureDefines.h
index 7329c95f5..e1007923c 100644
--- a/Source/WTF/wtf/FeatureDefines.h
+++ b/Source/WTF/wtf/FeatureDefines.h
@@ -188,6 +188,15 @@
 
 #endif /* PLATFORM(MAC) && !PLATFORM(IOS) */
 
+#if !PLATFORM(MAC)
+
+#if !defined(JSC_OBJC_API_ENABLED)
+#define JSC_OBJC_API_ENABLED 0
+#endif
+
+#endif /* !PLATFORM(MAC) */
+
+
 /* --------- Apple Windows port --------- */
 #if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(WIN_CAIRO)
 
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index d1aad9f9b..e525aa1fc 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -1122,7 +1122,6 @@ SOURCES += \
     platform/text/TextCodecUTF8.cpp \
     platform/text/TextCodecICU.cpp \
     platform/text/TextEncoding.cpp \
-    platform/text/TextEncodingDetectorICU.cpp \
     platform/text/TextEncodingRegistry.cpp \
     platform/text/TextStream.cpp \
     platform/ThreadGlobalData.cpp \
@@ -2978,11 +2977,12 @@ mac {
         platform/text/cf/StringImplCF.cpp
 }
 
-contains(QT_CONFIG,icu)|mac: SOURCES += platform/text/TextBreakIteratorICU.cpp
 use?(wchar_unicode): {
     SOURCES += platform/text/wchar/TextBreakIteratorWchar.cpp \
                platform/text/TextEncodingDetectorNone.cpp
-    SOURCES -= platform/text/TextEncodingDetectorICU.cpp
+} else {
+    SOURCES += platform/text/TextBreakIteratorICU.cpp \
+               platform/text/TextEncodingDetectorICU.cpp
 }
 
 mac {
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index a9b08d0b8..37cde573a 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -234,7 +234,7 @@ use?(GRAPHICS_SURFACE) {
 }
 
 have?(sqlite3) {
-    mac {
+    osx|contains(QT_CONFIG, no-pkg-config) {
         LIBS += -lsqlite3
     } else {
         PKGCONFIG += sqlite3
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index df4234e23..2cca58703 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -3624,7 +3624,11 @@ sub NativeToJSValue
         return "toJSNewlyCreated(exec, $globalObject, WTF::getPtr($value))";
     }
 
-    if ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
+    # $type has to be used here because SVGViewSpec.transform is of type SVGTransformList.
+    if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and $type =~ /(?<!String)List$/) {
+        # Convert from abstract RefPtr<ListProperty> to real type, so the right toJS() method can be invoked.
+        $value = "static_cast<" . GetNativeType($type) . ">($value" . ".get())";
+    } elsif ($codeGenerator->IsSVGAnimatedType($interfaceName) or $interfaceName eq "SVGViewSpec") {
         # Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
         $value = "static_cast<" . GetNativeType($type) . ">($value)";
     } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $interfaceName =~ /List$/) {
diff --git a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 2917815bd..c93c79b1b 100644
--- a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -31,6 +31,7 @@
 
 #include <QtCore/QBuffer>
 #include <QtCore/QByteArray>
+#include <QtCore/QSet>
 #include <QtGui/QImageReader>
 
 namespace WebCore {
@@ -45,6 +46,25 @@ ImageDecoderQt::~ImageDecoderQt()
 {
 }
 
+static const char* s_formatWhiteList[] = {"png", "jpeg", "gif", "webp", "bmp", "svg", "ico", 0};
+
+static bool isFormatWhiteListed(const QByteArray &format)
+{
+    static QSet<QByteArray> whiteListSet;
+    if (whiteListSet.isEmpty()) {
+        QByteArray whiteListEnv = qgetenv("QTWEBKIT_IMAGEFORMAT_WHITELIST");
+        if (!whiteListEnv.isEmpty())
+            whiteListSet = QSet<QByteArray>::fromList(whiteListEnv.split(','));
+
+        const char **formatIt  = s_formatWhiteList;
+        while (*formatIt) {
+            whiteListSet.insert(QByteArray(*formatIt));
+            ++formatIt;
+        }
+    }
+    return whiteListSet.contains(format);
+}
+
 void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 {
     if (failed())
@@ -73,6 +93,11 @@ void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 
     // QImageReader only allows retrieving the format before reading the image
     m_format = m_reader->format();
+    if (!m_format.isEmpty() && !isFormatWhiteListed(m_format)) {
+        qWarning("Image of format '%s' blocked because it is not considered safe. If you are sure it is safe to do so, you can white-list the format by setting the environment variable QTWEBKIT_IMAGEFORMAT_WHITELIST=%s", m_format.constData(), m_format.constData());
+        setFailed();
+        m_reader.clear();
+    }
 }
 
 bool ImageDecoderQt::isSizeAvailable()
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index 9e4408b61..f30284b90 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -156,6 +156,8 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     if (tr.x() || tr.y() || tr.width() != pixmap.width() || tr.height() != pixmap.height())
         pixmap = pixmap.copy(tr);
 
+    QPoint trTopLeft = tr.topLeft();
+
     CompositeOperator previousOperator = ctxt->compositeOperation();
 
     ctxt->setCompositeOperation(!pixmap.hasAlpha() && op == CompositeSourceOver ? CompositeCopy : op);
@@ -180,13 +182,14 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
                 painter.drawPixmap(QRect(0, 0, scaledPixmap.width(), scaledPixmap.height()), pixmap);
             }
             pixmap = scaledPixmap;
+            trTopLeft = transform.map(trTopLeft);
             transform = QTransform::fromTranslate(transform.dx(), transform.dy());
         }
     }
 
     /* Translate the coordinates as phase is not in world matrix coordinate space but the tile rect origin is. */
     transform *= QTransform().translate(phase.x(), phase.y());
-    transform.translate(tr.x(), tr.y());
+    transform.translate(trTopLeft.x(), trTopLeft.y());
 
     QBrush b(pixmap);
     b.setTransform(transform);
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index 7da75c874..38aa71950 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -334,7 +334,7 @@ public:
         switch (m_state) {
         case JPEG_HEADER:
             // Read file parameters with jpeg_read_header().
-            if (jpeg_read_header(&m_info, true) == JPEG_SUSPENDED)
+            if (jpeg_read_header(&m_info, TRUE) == JPEG_SUSPENDED)
                 return false; // I/O suspension.
 
             switch (m_info.jpeg_color_space) {
@@ -420,9 +420,9 @@ public:
             // of progressive JPEG.
             m_info.dct_method = dctMethod();
             m_info.dither_mode = ditherMode();
-            m_info.do_fancy_upsampling = doFancyUpsampling();
-            m_info.enable_2pass_quant = false;
-            m_info.do_block_smoothing = true;
+            m_info.do_fancy_upsampling = doFancyUpsampling() ? TRUE : FALSE;
+            m_info.enable_2pass_quant = FALSE;
+            m_info.do_block_smoothing = TRUE;
 
             // Start decompressor.
             if (!jpeg_start_decompress(&m_info))
@@ -573,7 +573,7 @@ boolean fill_input_buffer(j_decompress_ptr)
     // Our decode step always sets things up properly, so if this method is ever
     // called, then we have hit the end of the buffer.  A return value of false
     // indicates that we have no data to supply yet.
-    return false;
+    return FALSE;
 }
 
 void term_source(j_decompress_ptr jd)
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index b1f61a14d..3231eedba 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -40,6 +40,9 @@
 #define XMD_H
 #endif
 
+// ICU defines TRUE and FALSE macros, breaking libjpeg v9 headers
+#undef TRUE
+#undef FALSE
 extern "C" {
 #include "jpeglib.h"
 }
diff --git a/Source/WebCore/svg/SVGPathElement.cpp b/Source/WebCore/svg/SVGPathElement.cpp
index 3324d0b5d..c34c476f4 100644
--- a/Source/WebCore/svg/SVGPathElement.cpp
+++ b/Source/WebCore/svg/SVGPathElement.cpp
@@ -310,10 +310,15 @@ void SVGPathElement::removedFrom(ContainerNode* rootParent)
 
 SVGPathByteStream* SVGPathElement::pathByteStream() const
 {
-    SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
+    RefPtr<SVGAnimatedProperty> property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(this, dPropertyInfo());
     if (!property || !property->isAnimating())
         return m_pathByteStream.get();
-    return static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property)->animatedPathByteStream();
+
+    SVGPathByteStream* animatedPathByteStream = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(property.get())->animatedPathByteStream();
+     if (!animatedPathByteStream)
+         return m_pathByteStream.get();
+
+     return animatedPathByteStream;
 }
 
 PassRefPtr<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElement* contextElement)
@@ -321,16 +326,25 @@ PassRefPtr<SVGAnimatedProperty> SVGPathElement::lookupOrCreateDWrapper(SVGElemen
     ASSERT(contextElement);
     SVGPathElement* ownerType = toSVGPathElement(contextElement);
 
-    if (SVGAnimatedProperty* property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(ownerType, dPropertyInfo()))
+    if (RefPtr<SVGAnimatedProperty> property = SVGAnimatedProperty::lookupWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff>(ownerType, dPropertyInfo()))
         return property;
 
-    // Build initial SVGPathSegList.
-    buildSVGPathSegListFromByteStream(ownerType->m_pathByteStream.get(), ownerType, ownerType->m_pathSegList.value, UnalteredParsing);
+    if (ownerType->m_pathSegList.value.isEmpty())
+        buildSVGPathSegListFromByteStream(ownerType->m_pathByteStream.get(), ownerType, ownerType->m_pathSegList.value, UnalteredParsing);
 
     return SVGAnimatedProperty::lookupOrCreateWrapper<SVGPathElement, SVGAnimatedPathSegListPropertyTearOff, SVGPathSegList>
            (ownerType, dPropertyInfo(), ownerType->m_pathSegList.value);
 }
 
+void SVGPathElement::animatedPropertyWillBeDeleted()
+{
+    // m_pathSegList.shouldSynchronize is set to true when the 'd' wrapper for m_pathSegList
+    // is created and cached. We need to reset it back to false when this wrapper is deleted
+    // so we can be sure if shouldSynchronize is true, SVGAnimatedProperty::lookupWrapper()
+    // will return a valid cached 'd' wrapper for the m_pathSegList.
+    m_pathSegList.shouldSynchronize = false;
+}
+
 void SVGPathElement::synchronizeD(SVGElement* contextElement)
 {
     ASSERT(contextElement);
@@ -340,26 +354,26 @@ void SVGPathElement::synchronizeD(SVGElement* contextElement)
     ownerType->m_pathSegList.synchronize(ownerType, dPropertyInfo()->attributeName, ownerType->m_pathSegList.value.valueAsString());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::pathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::pathSegList()
 {
     m_pathSegList.shouldSynchronize = true;
-    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal());
+    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->baseVal().get());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::normalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::normalizedPathSegList()
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
     return 0;
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedPathSegList()
 {
     m_pathSegList.shouldSynchronize = true;
     m_isAnimValObserved = true;
-    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal());
+    return static_cast<SVGPathSegListPropertyTearOff*>(static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(lookupOrCreateDWrapper(this))->animVal().get());
 }
 
-SVGPathSegListPropertyTearOff* SVGPathElement::animatedNormalizedPathSegList()
+RefPtr<SVGPathSegListPropertyTearOff> SVGPathElement::animatedNormalizedPathSegList()
 {
     // FIXME: https://bugs.webkit.org/show_bug.cgi?id=15412 - Implement normalized path segment lists!
     return 0;
diff --git a/Source/WebCore/svg/SVGPathElement.h b/Source/WebCore/svg/SVGPathElement.h
index c81ead198..e9db8a56e 100644
--- a/Source/WebCore/svg/SVGPathElement.h
+++ b/Source/WebCore/svg/SVGPathElement.h
@@ -83,10 +83,10 @@ public:
     PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel> createSVGPathSegCurvetoQuadraticSmoothRel(float x, float y, SVGPathSegRole role = PathSegUndefinedRole);
 
     // Used in the bindings only.
-    SVGPathSegListPropertyTearOff* pathSegList();
-    SVGPathSegListPropertyTearOff* animatedPathSegList();
-    SVGPathSegListPropertyTearOff* normalizedPathSegList();
-    SVGPathSegListPropertyTearOff* animatedNormalizedPathSegList();
+    RefPtr<SVGPathSegListPropertyTearOff> pathSegList();
+    RefPtr<SVGPathSegListPropertyTearOff> animatedPathSegList();
+    RefPtr<SVGPathSegListPropertyTearOff> normalizedPathSegList();
+    RefPtr<SVGPathSegListPropertyTearOff> animatedNormalizedPathSegList();
 
     SVGPathByteStream* pathByteStream() const;
 
@@ -98,7 +98,9 @@ public:
 
     bool isAnimValObserved() const { return m_isAnimValObserved; }
 
-private:
+    void animatedPropertyWillBeDeleted();
+
+ private:
     SVGPathElement(const QualifiedName&, Document*);
 
     virtual bool isValid() const { return SVGTests::isValid(); }
diff --git a/Source/WebCore/svg/SVGPathSegWithContext.h b/Source/WebCore/svg/SVGPathSegWithContext.h
index 701067227..4ba1447bf 100644
--- a/Source/WebCore/svg/SVGPathSegWithContext.h
+++ b/Source/WebCore/svg/SVGPathSegWithContext.h
@@ -33,7 +33,7 @@ public:
     {
     }
 
-    SVGAnimatedProperty* animatedProperty() const
+    RefPtr<SVGAnimatedProperty> animatedProperty() const
     {
         switch (m_role) {
         case PathSegUndefinedRole:
diff --git a/Source/WebCore/svg/SVGPolyElement.cpp b/Source/WebCore/svg/SVGPolyElement.cpp
index fd5c652f1..977234d5e 100644
--- a/Source/WebCore/svg/SVGPolyElement.cpp
+++ b/Source/WebCore/svg/SVGPolyElement.cpp
@@ -88,8 +88,8 @@ void SVGPolyElement::parseAttribute(const QualifiedName& name, const AtomicStrin
         if (!pointsListFromSVGData(newList, value))
             document()->accessSVGExtensions()->reportError("Problem parsing points=\"" + value + "\"");
 
-        if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
-            static_cast<SVGAnimatedPointList*>(wrapper)->detachListWrappers(newList.size());
+        if (RefPtr<SVGAnimatedProperty> wrapper = SVGAnimatedProperty::lookupWrapper<SVGPolyElement, SVGAnimatedPointList>(this, pointsPropertyInfo()))
+            static_pointer_cast<SVGAnimatedPointList>(wrapper)->detachListWrappers(newList.size());
 
         m_points.value = newList;
         return;
@@ -147,16 +147,16 @@ PassRefPtr<SVGAnimatedProperty> SVGPolyElement::lookupOrCreatePointsWrapper(SVGE
            (ownerType, pointsPropertyInfo(), ownerType->m_points.value);
 }
 
-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::points()
+RefPtr<SVGListPropertyTearOff<SVGPointList> > SVGPolyElement::points()
 {
     m_points.shouldSynchronize = true;
-    return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_pointer_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal());
+    return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_pointer_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->baseVal().get());
 }
 
-SVGListPropertyTearOff<SVGPointList>* SVGPolyElement::animatedPoints()
+RefPtr<SVGListPropertyTearOff<SVGPointList> > SVGPolyElement::animatedPoints()
 {
     m_points.shouldSynchronize = true;
-    return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_pointer_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal());
+    return static_cast<SVGListPropertyTearOff<SVGPointList>*>(static_pointer_cast<SVGAnimatedPointList>(lookupOrCreatePointsWrapper(this))->animVal().get());
 }
 
 }
diff --git a/Source/WebCore/svg/SVGPolyElement.h b/Source/WebCore/svg/SVGPolyElement.h
index bd0dd49aa..f399a427e 100644
--- a/Source/WebCore/svg/SVGPolyElement.h
+++ b/Source/WebCore/svg/SVGPolyElement.h
@@ -33,8 +33,8 @@ namespace WebCore {
 class SVGPolyElement : public SVGGraphicsElement
                      , public SVGExternalResourcesRequired {
 public:
-    SVGListPropertyTearOff<SVGPointList>* points();
-    SVGListPropertyTearOff<SVGPointList>* animatedPoints();
+    RefPtr<SVGListPropertyTearOff<SVGPointList> > points();
+    RefPtr<SVGListPropertyTearOff<SVGPointList> > animatedPoints();
 
     SVGPointList& pointList() const { return m_points.value; }
 
diff --git a/Source/WebCore/svg/SVGViewSpec.cpp b/Source/WebCore/svg/SVGViewSpec.cpp
index 253c082fb..5ac02dbdd 100644
--- a/Source/WebCore/svg/SVGViewSpec.cpp
+++ b/Source/WebCore/svg/SVGViewSpec.cpp
@@ -117,8 +117,8 @@ void SVGViewSpec::setTransformString(const String& transform)
     SVGTransformList newList;
     newList.parse(transform);
 
-    if (SVGAnimatedProperty* wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
-        static_cast<SVGAnimatedTransformList*>(wrapper)->detachListWrappers(newList.size());
+    if (RefPtr<SVGAnimatedProperty> wrapper = SVGAnimatedProperty::lookupWrapper<SVGElement, SVGAnimatedTransformList>(m_contextElement, transformPropertyInfo()))
+        static_pointer_cast<SVGAnimatedTransformList>(wrapper)->detachListWrappers(newList.size());
 
     m_transform = newList;
 }
@@ -148,12 +148,12 @@ SVGElement* SVGViewSpec::viewTarget() const
     return toSVGElement(element);
 }
 
-SVGTransformListPropertyTearOff* SVGViewSpec::transform()
+RefPtr<SVGTransformListPropertyTearOff> SVGViewSpec::transform()
 {
     if (!m_contextElement)
         return 0;
     // Return the animVal here, as its readonly by default - which is exactly what we want here.
-    return static_cast<SVGTransformListPropertyTearOff*>(static_pointer_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal());
+    return static_cast<SVGTransformListPropertyTearOff*>(static_pointer_cast<SVGAnimatedTransformList>(lookupOrCreateTransformWrapper(this))->animVal().get());
 }
 
 PassRefPtr<SVGAnimatedRect> SVGViewSpec::viewBoxAnimated()
diff --git a/Source/WebCore/svg/SVGViewSpec.h b/Source/WebCore/svg/SVGViewSpec.h
index f8634afd6..3887db7f5 100644
--- a/Source/WebCore/svg/SVGViewSpec.h
+++ b/Source/WebCore/svg/SVGViewSpec.h
@@ -69,7 +69,7 @@ public:
     void resetContextElement() { m_contextElement = 0; }
 
     // Custom non-animated 'transform' property.
-    SVGTransformListPropertyTearOff* transform();
+    RefPtr<SVGTransformListPropertyTearOff> transform();
     SVGTransformList transformBaseValue() const { return m_transform; }
 
     // Custom animated 'viewBox' property.
diff --git a/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
index 65ee9e58d..136ba8253 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedListPropertyTearOff.h
@@ -40,35 +40,49 @@ public:
     typedef SVGListPropertyTearOff<PropertyType> ListPropertyTearOff;
     typedef PropertyType ContentType;
 
-    virtual ListProperty* baseVal()
+    virtual PassRefPtr<ListProperty> baseVal()
     {
-        if (!m_baseVal)
-            m_baseVal = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
-        return static_cast<ListProperty*>(m_baseVal.get());
+        if (m_baseVal)
+            return m_baseVal;
+
+        RefPtr<ListProperty> property = ListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers).get();
+        m_baseVal = property.get();
+        return property.release();
+    }
+
+    virtual PassRefPtr<ListProperty> animVal()
+    {
+        if (m_animVal)
+            return m_animVal;
+
+        RefPtr<ListProperty> property = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers).get();
+        m_animVal = property.get();
+        return property.release();
     }
 
-    virtual ListProperty* animVal()
+    void propertyWillBeDeleted(const ListProperty& property)
     {
-        if (!m_animVal)
-            m_animVal = ListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
-        return static_cast<ListProperty*>(m_animVal.get());
+        if (&property == m_baseVal)
+            m_baseVal = 0;
+        else if (&property == m_animVal)
+            m_animVal = 0;
     }
 
     virtual bool isAnimatedListTearOff() const { return true; }
 
-    int findItem(SVGProperty* property) const
+    int findItem(SVGProperty* property)
     {
         // This should ever be called for our baseVal, as animVal can't modify the list.
         // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
         typedef SVGPropertyTearOff<typename SVGPropertyTraits<PropertyType>::ListItemType> ListItemTearOff;
-        return static_cast<ListPropertyTearOff*>(m_baseVal.get())->findItem(static_cast<ListItemTearOff*>(property));
+        return static_pointer_cast<ListPropertyTearOff>(baseVal())->findItem(static_cast<ListItemTearOff*>(property));
     }
 
     void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
     {
         // This should ever be called for our baseVal, as animVal can't modify the list.
         // It's safe to cast to ListPropertyTearOff here as all classes inheriting from us supply their own removeItemFromList() method.
-        static_cast<ListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
+        static_pointer_cast<ListPropertyTearOff>(baseVal())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
     }
 
     void detachListWrappers(unsigned newListSize)
@@ -79,8 +93,8 @@ public:
     PropertyType& currentAnimatedValue()
     {
         ASSERT(m_isAnimating);
-        ASSERT(m_animVal);
-        return static_cast<ListProperty*>(m_animVal.get())->values();
+        ASSERT(m_animatingAnimVal);
+        return static_pointer_cast<ListProperty>(m_animatingAnimVal)->values();
     }
 
     const PropertyType& currentBaseValue() const
@@ -91,6 +105,7 @@ public:
     void animationStarted(PropertyType* newAnimVal, bool shouldOwnValues = false)
     {
         ASSERT(!m_isAnimating);
+        ASSERT(!m_animatingAnimVal);
         ASSERT(newAnimVal);
         ASSERT(m_values.size() == m_wrappers.size());
         ASSERT(m_animatedWrappers.isEmpty());
@@ -99,49 +114,49 @@ public:
         if (!newAnimVal->isEmpty())
             m_animatedWrappers.fill(0, newAnimVal->size());
 
-        ListProperty* animVal = static_cast<ListProperty*>(this->animVal());
-        animVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
-        ASSERT(animVal->values().size() == animVal->wrappers().size());
-        ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+        m_animatingAnimVal = animVal();
+        m_animatingAnimVal->setValuesAndWrappers(newAnimVal, &m_animatedWrappers, shouldOwnValues);
+        ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+        ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
         m_isAnimating = true;
     }
 
     void animationEnded()
     {
         ASSERT(m_isAnimating);
-        ASSERT(m_animVal);
+        ASSERT(m_animatingAnimVal);
         ASSERT(m_values.size() == m_wrappers.size());
 
-        ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
-        ASSERT(animVal->values().size() == animVal->wrappers().size());
-        ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+        ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+        ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
 
-        animVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
-        ASSERT(animVal->values().size() == animVal->wrappers().size());
-        ASSERT(animVal->wrappers().size() == m_wrappers.size());
+        m_animatingAnimVal->setValuesAndWrappers(&m_values, &m_wrappers, false);
+        ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+        ASSERT(m_animatingAnimVal->wrappers().size() == m_wrappers.size());
 
         m_animatedWrappers.clear();
+        m_animatingAnimVal = 0;
         m_isAnimating = false;
     }
 
     void synchronizeWrappersIfNeeded()
     {
+        ASSERT(m_isAnimating);
+        ASSERT(m_animatingAnimVal);
+
         // Eventually the wrapper list needs synchronization because any SVGAnimateLengthList::calculateAnimatedValue() call may
         // mutate the length of our values() list, and thus the wrapper() cache needs synchronization, to have the same size.
         // Also existing wrappers which point directly at elements in the existing SVGLengthList have to be detached (so a copy
         // of them is created, so existing animVal variables in JS are kept-alive). If we'd detach them later the underlying
         // SVGLengthList was already mutated, and our list item wrapper tear offs would point nowhere. Assertions would fire.
-        ListProperty* animVal = static_cast<ListProperty*>(m_animVal.get());
-        animVal->detachListWrappers(animVal->values().size());
+        m_animatingAnimVal->detachListWrappers(m_animatingAnimVal->values().size());
 
-        ASSERT(animVal->values().size() == animVal->wrappers().size());
-        ASSERT(animVal->wrappers().size() == m_animatedWrappers.size());
+        ASSERT(m_animatingAnimVal->values().size() == m_animatingAnimVal->wrappers().size());
+        ASSERT(m_animatingAnimVal->wrappers().size() == m_animatedWrappers.size());
     }
 
     void animValWillChange()
     {
-        ASSERT(m_isAnimating);
-        ASSERT(m_animVal);
         ASSERT(m_values.size() == m_wrappers.size());
         synchronizeWrappersIfNeeded();
     }
@@ -164,6 +179,8 @@ protected:
     SVGAnimatedListPropertyTearOff(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, PropertyType& values)
         : SVGAnimatedProperty(contextElement, attributeName, animatedPropertyType)
         , m_values(values)
+        , m_baseVal(0)
+        , m_animVal(0)
     {
         if (!values.isEmpty())
             m_wrappers.fill(0, values.size());
@@ -174,8 +191,13 @@ protected:
     ListWrapperCache m_wrappers;
     ListWrapperCache m_animatedWrappers;
 
-    RefPtr<SVGProperty> m_baseVal;
-    RefPtr<SVGProperty> m_animVal;
+    // Cache the raw pointer but return a RefPtr<>. This will break the cyclic reference
+    // between SVGListPropertyTearOff and SVGAnimatedListPropertyTearOff once the property
+    // pointer is not needed.
+    ListProperty* m_baseVal;
+    ListProperty* m_animVal;
+
+    RefPtr<ListProperty> m_animatingAnimVal;
 };
 
 }
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h
index eb6dd19e3..dd5396aff 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPathSegListPropertyTearOff.h
@@ -32,32 +32,36 @@ namespace WebCore {
 
 class SVGAnimatedPathSegListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGPathSegList> {
 public:
-    virtual SVGListProperty<SVGPathSegList>* baseVal()
+    virtual PassRefPtr<ListProperty> baseVal() OVERRIDE
     {
-        if (!m_baseVal)
-            m_baseVal = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
-        return static_cast<SVGListProperty<SVGPathSegList>*>(m_baseVal.get());
+        if (m_baseVal)
+            return m_baseVal;
+
+        RefPtr<ListProperty> property = SVGPathSegListPropertyTearOff::create(this, BaseValRole, PathSegUnalteredRole, m_values, m_wrappers);
+        m_baseVal = property.get();
+        return property.release();
     }
 
-    virtual SVGListProperty<SVGPathSegList>* animVal()
+    virtual PassRefPtr<ListProperty> animVal() OVERRIDE
     {
-        if (!m_animVal)
-            m_animVal = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
-        return static_cast<SVGListProperty<SVGPathSegList>*>(m_animVal.get());
+        if (m_animVal)
+            return m_animVal;
+
+        RefPtr<ListProperty> property = SVGPathSegListPropertyTearOff::create(this, AnimValRole, PathSegUnalteredRole, m_values, m_wrappers);
+        m_animVal = property.get();
+        return property.release();
     }
 
-    int findItem(const RefPtr<SVGPathSeg>& segment) const
+    int findItem(const RefPtr<SVGPathSeg>& segment)
     {
         // This should ever be called for our baseVal, as animVal can't modify the list.
-        ASSERT(m_baseVal);
-        return static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->findItem(segment);
+        return static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->findItem(segment);
     }
 
     void removeItemFromList(size_t itemIndex, bool shouldSynchronizeWrappers)
     {
         // This should ever be called for our baseVal, as animVal can't modify the list.
-        ASSERT(m_baseVal);
-        static_cast<SVGPathSegListPropertyTearOff*>(m_baseVal.get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
+        static_cast<SVGPathSegListPropertyTearOff*>(baseVal().get())->removeItemFromList(itemIndex, shouldSynchronizeWrappers);
     }
 
     static PassRefPtr<SVGAnimatedPathSegListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGPathSegList& values)
@@ -109,6 +113,13 @@ private:
         : SVGAnimatedListPropertyTearOff<SVGPathSegList>(contextElement, attributeName, animatedPropertyType, values)
         , m_animatedPathByteStream(0)
     {
+        ASSERT(contextElement);
+        ASSERT(toSVGPathElement(contextElement));
+    }
+
+    virtual ~SVGAnimatedPathSegListPropertyTearOff()
+    {
+        static_cast<SVGPathElement*>(contextElement())->animatedPropertyWillBeDeleted();
     }
 
     SVGPathByteStream* m_animatedPathByteStream;
diff --git a/Source/WebCore/svg/properties/SVGAnimatedProperty.h b/Source/WebCore/svg/properties/SVGAnimatedProperty.h
index 93f076b2b..d40a50434 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedProperty.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedProperty.h
@@ -53,18 +53,22 @@ public:
     {
         ASSERT(info);
         SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
-        RefPtr<SVGAnimatedProperty> wrapper = animatedPropertyCache()->get(key);
-        if (!wrapper) {
-            wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
-            if (info->animatedPropertyState == PropertyIsReadOnly)
-                wrapper->setIsReadOnly();
-            animatedPropertyCache()->set(key, wrapper.get());
-        }
+        Cache::AddResult result = animatedPropertyCache()->add(key, 0);
+        if (!result.isNewEntry)
+            return static_cast<TearOffType*>(result.iterator->value);
+
+        RefPtr<SVGAnimatedProperty> wrapper = TearOffType::create(element, info->attributeName, info->animatedPropertyType, property);
+        if (info->animatedPropertyState == PropertyIsReadOnly)
+            wrapper->setIsReadOnly();
+
+        // Cache the raw pointer but return a RefPtr<>. This will break the cyclic reference
+        // between SVGAnimatedProperty and SVGElement once the property pointer is not needed.
+        result.iterator->value = wrapper.get();
         return static_pointer_cast<TearOffType>(wrapper);
     }
 
     template<typename OwnerType, typename TearOffType>
-    static TearOffType* lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
+    static PassRefPtr<TearOffType> lookupWrapper(OwnerType* element, const SVGPropertyInfo* info)
     {
         ASSERT(info);
         SVGAnimatedPropertyDescription key(element, info->propertyIdentifier);
@@ -72,7 +76,7 @@ public:
     }
 
     template<typename OwnerType, typename TearOffType>
-    static TearOffType* lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
+    static PassRefPtr<TearOffType> lookupWrapper(const OwnerType* element, const SVGPropertyInfo* info)
     {
         return lookupWrapper<OwnerType, TearOffType>(const_cast<OwnerType*>(element), info);
     }
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h b/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
index 1ddbc5c6c..e31015e52 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertyMacros.h
@@ -118,7 +118,7 @@ public: \
     static const SVGPropertyInfo* LowerProperty##PropertyInfo(); \
     PropertyType& LowerProperty() const \
     { \
-        if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
+        if (RefPtr<TearOffType> wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) { \
             if (wrapper->isAnimating()) \
                 return wrapper->currentAnimatedValue(); \
         } \
@@ -179,7 +179,7 @@ private: \
 DECLARE_ANIMATED_PROPERTY(TearOffType, PropertyType, UpperProperty, LowerProperty) \
 void detachAnimated##UpperProperty##ListWrappers(unsigned newListSize) \
 { \
-    if (TearOffType* wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
+    if (RefPtr<TearOffType> wrapper = SVGAnimatedProperty::lookupWrapper<UseOwnerType, TearOffType>(this, LowerProperty##PropertyInfo())) \
         wrapper->detachListWrappers(newListSize); \
 }
 
diff --git a/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h
index 6f643e87c..2953f2ff6 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedTransformListPropertyTearOff.h
@@ -29,18 +29,24 @@ namespace WebCore {
 
 class SVGAnimatedTransformListPropertyTearOff : public SVGAnimatedListPropertyTearOff<SVGTransformList> {
 public:
-    virtual SVGListPropertyTearOff<SVGTransformList>* baseVal()
+    virtual PassRefPtr<ListProperty> baseVal() OVERRIDE
     {
-        if (!m_baseVal)
-            m_baseVal = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
-        return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_baseVal.get());
+        if (m_baseVal)
+            return m_baseVal;
+
+        RefPtr<ListProperty> property = SVGTransformListPropertyTearOff::create(this, BaseValRole, m_values, m_wrappers);
+        m_baseVal = property.get();
+        return property.release();
     }
 
-    virtual SVGListPropertyTearOff<SVGTransformList>* animVal()
+    virtual PassRefPtr<ListProperty> animVal() OVERRIDE
     {
-        if (!m_animVal)
-            m_animVal = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
-        return static_cast<SVGListPropertyTearOff<SVGTransformList>*>(m_animVal.get());
+        if (m_animVal)
+            return m_animVal;
+
+        RefPtr<ListProperty> property = SVGTransformListPropertyTearOff::create(this, AnimValRole, m_values, m_wrappers);
+        m_animVal = property.get();
+        return property.release();
     }
 
     static PassRefPtr<SVGAnimatedTransformListPropertyTearOff> create(SVGElement* contextElement, const QualifiedName& attributeName, AnimatedPropertyType animatedPropertyType, SVGTransformList& values)
diff --git a/Source/WebCore/svg/properties/SVGListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGListPropertyTearOff.h
index 3c6552467..326a89a74 100644
--- a/Source/WebCore/svg/properties/SVGListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGListPropertyTearOff.h
@@ -121,6 +121,12 @@ protected:
     {
     }
 
+    virtual ~SVGListPropertyTearOff()
+    {
+        if (m_animatedProperty)
+            m_animatedProperty->propertyWillBeDeleted(*this);
+    }
+
     virtual bool isReadOnly() const
     {
         if (m_role == AnimValRole)
diff --git a/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp b/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp
index 573d453a4..51c48b4c3 100644
--- a/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp
+++ b/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.cpp
@@ -95,7 +95,7 @@ SVGPathElement* SVGPathSegListPropertyTearOff::contextElement() const
 bool SVGPathSegListPropertyTearOff::processIncomingListItemValue(const ListItemType& newItem, unsigned* indexToModify)
 {
     SVGPathSegWithContext* newItemWithContext = static_cast<SVGPathSegWithContext*>(newItem.get());
-    SVGAnimatedProperty* animatedPropertyOfItem = newItemWithContext->animatedProperty();
+    RefPtr<SVGAnimatedProperty> animatedPropertyOfItem = newItemWithContext->animatedProperty();
 
     // Alter the role, after calling animatedProperty(), as that may influence the returned animated property.
     newItemWithContext->setContextAndRole(contextElement(), m_pathSegRole);
@@ -111,7 +111,7 @@ bool SVGPathSegListPropertyTearOff::processIncomingListItemValue(const ListItemT
     // Spec: If newItem is already in a list, it is removed from its previous list before it is inserted into this list.
     // 'newItem' is already living in another list. If it's not our list, synchronize the other lists wrappers after the removal.
     bool livesInOtherList = animatedPropertyOfItem != m_animatedProperty;
-    SVGAnimatedPathSegListPropertyTearOff* propertyTearOff = static_cast<SVGAnimatedPathSegListPropertyTearOff*>(animatedPropertyOfItem);
+    RefPtr<SVGAnimatedPathSegListPropertyTearOff> propertyTearOff = static_pointer_cast<SVGAnimatedPathSegListPropertyTearOff>(animatedPropertyOfItem);
     int indexToRemove = propertyTearOff->findItem(newItem.get());
     ASSERT(indexToRemove != -1);
 
diff --git a/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h b/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h
index ee704d681..4c1a30c4b 100644
--- a/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h
+++ b/Source/WebCore/svg/properties/SVGPathSegListPropertyTearOff.h
@@ -111,6 +111,12 @@ public:
         return Base::appendItemValues(newItem, ec);
     }
 
+    virtual ~SVGPathSegListPropertyTearOff()
+    {
+        if (m_animatedProperty)
+            m_animatedProperty->propertyWillBeDeleted(*this);
+    }
+
 private:
     SVGPathSegListPropertyTearOff(AnimatedListPropertyTearOff* animatedProperty, SVGPropertyRole role, SVGPathSegRole pathSegRole, SVGPathSegList& values, ListWrapperCache& wrappers)
         : SVGListProperty<SVGPathSegList>(role, values, &wrappers)
diff --git a/Source/WebKit/qt/Api/qwebhistoryinterface.h b/Source/WebKit/qt/Api/qwebhistoryinterface.h
index a49c58684..3038d22bd 100644
--- a/Source/WebKit/qt/Api/qwebhistoryinterface.h
+++ b/Source/WebKit/qt/Api/qwebhistoryinterface.h
@@ -29,7 +29,7 @@
 class QWEBKIT_EXPORT QWebHistoryInterface : public QObject {
     Q_OBJECT
 public:
-    QWebHistoryInterface(QObject *parent = 0);
+    explicit QWebHistoryInterface(QObject *parent = Q_NULLPTR);
     ~QWebHistoryInterface();
 
     static void setDefaultInterface(QWebHistoryInterface *defaultInterface);
diff --git a/Source/WebKit/qt/Api/qwebpluginfactory.h b/Source/WebKit/qt/Api/qwebpluginfactory.h
index 24084fe18..26f855066 100644
--- a/Source/WebKit/qt/Api/qwebpluginfactory.h
+++ b/Source/WebKit/qt/Api/qwebpluginfactory.h
@@ -48,7 +48,7 @@ public:
         QList<MimeType> mimeTypes;
     };
 
-    explicit QWebPluginFactory(QObject* parent = 0);
+    explicit QWebPluginFactory(QObject* parent = Q_NULLPTR);
     virtual ~QWebPluginFactory();
 
     virtual QList<Plugin> plugins() const = 0;
@@ -62,7 +62,7 @@ public:
     {};
     class ExtensionReturn
     {};
-    virtual bool extension(Extension extension, const ExtensionOption* option = 0, ExtensionReturn* output = 0);
+    virtual bool extension(Extension extension, const ExtensionOption* option = Q_NULLPTR, ExtensionReturn* output = Q_NULLPTR);
     virtual bool supportsExtension(Extension extension) const;
 
 private:
diff --git a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
index a8487f2c4..7fcf3de45 100644
--- a/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PlatformStrategiesQt.cpp
@@ -200,14 +200,14 @@ bool PlatformStrategiesQt::isLinkVisited(Page* page, LinkHash hash, const KURL&
 {
     ASSERT(hash);
 
-    Vector<UChar, 512> url;
-    visitedURL(baseURL, attributeURL, url);
-
     // If the Qt4.4 interface for the history is used, we will have to fallback
     // to the old global history.
     QWebHistoryInterface* iface = QWebHistoryInterface::defaultInterface();
-    if (iface)
+    if (iface) {
+        Vector<UChar, 512> url;
+        visitedURL(baseURL, attributeURL, url);
         return iface->historyContains(QString(reinterpret_cast<QChar*>(url.data()), url.size()));
+    }
 
     return page->group().isLinkVisited(hash);
 }
diff --git a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
index d1a7f6cab..554ab8927 100644
--- a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
@@ -1179,6 +1179,7 @@ void QWebPageAdapter::triggerAction(QWebPageAdapter::MenuAction action, QWebHitT
     case ToggleMediaPlayPause:
         if (HTMLMediaElement* mediaElt = mediaElement(hitTestResult->innerNonSharedNode))
             mediaElt->togglePlayState();
+        break;
     case ToggleMediaMute:
         if (HTMLMediaElement* mediaElt = mediaElement(hitTestResult->innerNonSharedNode))
             mediaElt->setMuted(!mediaElt->muted());
diff --git a/Source/WebKit/qt/WidgetApi/qgraphicswebview.h b/Source/WebKit/qt/WidgetApi/qgraphicswebview.h
index c9e61f75a..0d990086f 100644
--- a/Source/WebKit/qt/WidgetApi/qgraphicswebview.h
+++ b/Source/WebKit/qt/WidgetApi/qgraphicswebview.h
@@ -54,7 +54,7 @@ class QWEBKITWIDGETS_EXPORT QGraphicsWebView : public QGraphicsWidget {
     Q_FLAGS(QPainter::RenderHints)
 
 public:
-    explicit QGraphicsWebView(QGraphicsItem* parent = 0);
+    explicit QGraphicsWebView(QGraphicsItem* parent = Q_NULLPTR);
     ~QGraphicsWebView();
 
     QWebPage* page() const;
@@ -84,7 +84,7 @@ public:
     QAction* pageAction(QWebPage::WebAction action) const;
     void triggerPageAction(QWebPage::WebAction action, bool checked = false);
 
-    bool findText(const QString& subString, QWebPage::FindFlags options = 0);
+    bool findText(const QString& subString, QWebPage::FindFlags options = QWebPage::FindFlags());
 
     bool resizesToContents() const;
     void setResizesToContents(bool enabled);
@@ -94,7 +94,7 @@ public:
 
     virtual void setGeometry(const QRectF& rect);
     virtual void updateGeometry();
-    virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
+    virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = Q_NULLPTR);
     virtual QVariant itemChange(GraphicsItemChange change, const QVariant& value);
     virtual bool event(QEvent*);
 
diff --git a/Source/WebKit/qt/WidgetApi/qwebinspector.h b/Source/WebKit/qt/WidgetApi/qwebinspector.h
index c333fa25a..d6a4aad3c 100644
--- a/Source/WebKit/qt/WidgetApi/qwebinspector.h
+++ b/Source/WebKit/qt/WidgetApi/qwebinspector.h
@@ -30,7 +30,7 @@ class QWebInspectorPrivate;
 class QWEBKITWIDGETS_EXPORT QWebInspector : public QWidget {
     Q_OBJECT
 public:
-    QWebInspector(QWidget* parent = 0);
+    explicit QWebInspector(QWidget* parent = Q_NULLPTR);
     ~QWebInspector();
 
     void setPage(QWebPage* page);
diff --git a/Source/WebKit/qt/WidgetApi/qwebpage.h b/Source/WebKit/qt/WidgetApi/qwebpage.h
index 24fe1383e..a9c71fd42 100644
--- a/Source/WebKit/qt/WidgetApi/qwebpage.h
+++ b/Source/WebKit/qt/WidgetApi/qwebpage.h
@@ -265,7 +265,7 @@ public:
     };
 
 
-    explicit QWebPage(QObject *parent = 0);
+    explicit QWebPage(QObject *parent = Q_NULLPTR);
     ~QWebPage();
 
     QWebFrame *mainFrame() const;
@@ -317,7 +317,7 @@ public:
 
     QVariant inputMethodQuery(Qt::InputMethodQuery property) const;
 
-    bool findText(const QString &subString, FindFlags options = 0);
+    bool findText(const QString &subString, FindFlags options = FindFlags());
 
     void setForwardUnsupportedContent(bool forward);
     bool forwardUnsupportedContent() const;
@@ -383,7 +383,7 @@ public:
     };
 
 
-    virtual bool extension(Extension extension, const ExtensionOption *option = 0, ExtensionReturn *output = 0);
+    virtual bool extension(Extension extension, const ExtensionOption *option = Q_NULLPTR, ExtensionReturn *output = Q_NULLPTR);
     virtual bool supportsExtension(Extension extension) const;
 
     QWebPageAdapter* handle() const;
diff --git a/Source/WebKit/qt/WidgetApi/qwebview.h b/Source/WebKit/qt/WidgetApi/qwebview.h
index 43439dfa5..ac0946773 100644
--- a/Source/WebKit/qt/WidgetApi/qwebview.h
+++ b/Source/WebKit/qt/WidgetApi/qwebview.h
@@ -54,7 +54,7 @@ class QWEBKITWIDGETS_EXPORT QWebView : public QWidget {
     Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
     Q_FLAGS(QPainter::RenderHints)
 public:
-    explicit QWebView(QWidget* parent = 0);
+    explicit QWebView(QWidget* parent = Q_NULLPTR);
     virtual ~QWebView();
 
     QWebPage* page() const;
@@ -104,7 +104,7 @@ public:
     void setRenderHints(QPainter::RenderHints hints);
     void setRenderHint(QPainter::RenderHint hint, bool enabled = true);
 
-    bool findText(const QString& subString, QWebPage::FindFlags options = 0);
+    bool findText(const QString& subString, QWebPage::FindFlags options = QWebPage::FindFlags());
 
     virtual bool event(QEvent*);
 
diff --git a/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp b/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
index 5c22d96b7..6881d9d74 100644
--- a/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
+++ b/Source/WebKit/qt/WidgetSupport/QStyleFacadeImp.cpp
@@ -209,7 +209,7 @@ int QStyleFacadeImp::sliderThickness(Qt::Orientation orientation) const
 
 int QStyleFacadeImp::progressBarChunkWidth(const QSize& size) const
 {
-    QStyleOptionProgressBarV2 option;
+    QStyleOptionProgressBar option;
     option.rect.setSize(size);
     // FIXME: Until http://bugreports.qt.nokia.com/browse/QTBUG-9171 is fixed,
     // we simulate one square animating across the progress bar.
@@ -263,10 +263,10 @@ void QStyleFacadeImp::paintTextField(QPainter *painter, const QStyleFacadeOption
 {
     QWidget* widget = qobject_cast<QWidget*>(widgetForPainter(painter));
 
-    MappedStyleOption<QStyleOptionFrameV2> panel(widget, proxyOption);
+    MappedStyleOption<QStyleOptionFrame> panel(widget, proxyOption);
 
     panel.lineWidth = findFrameLineWidth();
-    panel.features = QStyleOptionFrameV2::None;
+    panel.features = QStyleOptionFrame::None;
 
     style()->drawPrimitive(QStyle::PE_PanelLineEdit, &panel, painter, widget);
 }
@@ -389,7 +389,7 @@ void QStyleFacadeImp::paintProgressBar(QPainter* painter, const QStyleFacadeOpti
 {
     QWidget* widget = qobject_cast<QWidget*>(widgetForPainter(painter));
 
-    MappedStyleOption<QStyleOptionProgressBarV2> option(widget, proxyOption);
+    MappedStyleOption<QStyleOptionProgressBar> option(widget, proxyOption);
 
     option.maximum = std::numeric_limits<int>::max();
     option.minimum = 0;
diff --git a/Source/WebKit/qt/declarative/experimental/experimental.pri b/Source/WebKit/qt/declarative/experimental/experimental.pri
index 547e66bcc..c59f4569e 100644
--- a/Source/WebKit/qt/declarative/experimental/experimental.pri
+++ b/Source/WebKit/qt/declarative/experimental/experimental.pri
@@ -11,14 +11,9 @@ TARGET.module_name = QtWebKit/experimental
 
 CONFIG += plugin
 
-QMLDIRFILE = $${_PRO_FILE_PWD_}/qmldir
-copy2build.input = QMLDIRFILE
-copy2build.output = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}/qmldir
-!contains(TEMPLATE_PREFIX, vc):copy2build.variable_out = PRE_TARGETDEPS
-copy2build.commands = $$QMAKE_COPY ${QMAKE_FILE_IN} ${QMAKE_FILE_OUT}
-copy2build.name = COPY ${QMAKE_FILE_IN}
-copy2build.CONFIG += no_link
-QMAKE_EXTRA_COMPILERS += copy2build
+cpqmldir.files = $${_PRO_FILE_PWD_}/qmldir
+cpqmldir.path = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}
+COPIES += cpqmldir
 
 contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
diff --git a/Source/WebKit/qt/declarative/public.pri b/Source/WebKit/qt/declarative/public.pri
index d669162e4..bdef38045 100644
--- a/Source/WebKit/qt/declarative/public.pri
+++ b/Source/WebKit/qt/declarative/public.pri
@@ -11,14 +11,9 @@ TARGET.module_name = QtWebKit
 
 CONFIG += plugin
 
-QMLDIRFILE = $${_PRO_FILE_PWD_}/qmldir
-copy2build.input = QMLDIRFILE
-copy2build.output = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}/qmldir
-!contains(TEMPLATE_PREFIX, vc):copy2build.variable_out = PRE_TARGETDEPS
-copy2build.commands = $$QMAKE_COPY ${QMAKE_FILE_IN} ${QMAKE_FILE_OUT}
-copy2build.name = COPY ${QMAKE_FILE_IN}
-copy2build.CONFIG += no_link
-QMAKE_EXTRA_COMPILERS += copy2build
+cpqmldir.files = $${_PRO_FILE_PWD_}/qmldir
+cpqmldir.path = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}
+COPIES += cpqmldir
 
 contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
diff --git a/Source/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro b/Source/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro
index 0e49a7056..99197e1bb 100644
--- a/Source/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro
+++ b/Source/WebKit/qt/tests/hybridPixmap/hybridPixmap.pro
@@ -1,6 +1,3 @@
-# -------------------------------------------------
-# Project created by QtCreator 2009-12-10T11:25:02
-# -------------------------------------------------
 include(../tests.pri)
 TARGET = hybridPixmap
 SOURCES += widget.cpp
diff --git a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
index 94551eb8e..52e6422b1 100644
--- a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
+++ b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
@@ -1572,26 +1572,26 @@ void tst_QObjectBridge::connectAndDisconnect()
         QString type;
         QString ret = evalJS("(function() { }).connect()", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: 'undefined' is not a function (evaluating '(function() { }).connect()')"));
+        QCOMPARE(ret, QLatin1String("TypeError: undefined is not a function (evaluating '(function() { }).connect()')"));
     }
     {
         QString type;
         QString ret = evalJS("var o = { }; o.connect = Function.prototype.connect;  o.connect()", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: 'undefined' is not a function (evaluating 'o.connect()')"));
+        QCOMPARE(ret, QLatin1String("TypeError: undefined is not a function (evaluating 'o.connect()')"));
     }
 
     {
         QString type;
         QString ret = evalJS("(function() { }).connect(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: 'undefined' is not a function (evaluating '(function() { }).connect(123)')"));
+        QCOMPARE(ret, QLatin1String("TypeError: undefined is not a function (evaluating '(function() { }).connect(123)')"));
     }
     {
         QString type;
         QString ret = evalJS("var o = { }; o.connect = Function.prototype.connect;  o.connect(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: 'undefined' is not a function (evaluating 'o.connect(123)')"));
+        QCOMPARE(ret, QLatin1String("TypeError: undefined is not a function (evaluating 'o.connect(123)')"));
     }
 
     {
diff --git a/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp b/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
index cdadc9c45..f780fbc7e 100644
--- a/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/mac/ConnectionMac.cpp
@@ -141,7 +141,7 @@ bool Connection::open()
         // Create the receive port.
         mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &m_receivePort);
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
         mach_port_set_attributes(mach_task_self(), m_receivePort, MACH_PORT_IMPORTANCE_RECEIVER, (mach_port_info_t)0, 0);
 #endif
 
@@ -423,7 +423,7 @@ void Connection::receiveSourceEventHandler()
     OwnPtr<MessageDecoder> decoder = createMessageDecoder(header);
     ASSERT(decoder);
 
-#if __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
+#if PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1090
     decoder->setImportanceAssertion(ImportanceAssertion::create(header));
 #endif
 
diff --git a/Source/WebKit2/WebProcess.pro b/Source/WebKit2/WebProcess.pro
index 3463b9431..d401dc23a 100644
--- a/Source/WebKit2/WebProcess.pro
+++ b/Source/WebKit2/WebProcess.pro
@@ -5,7 +5,7 @@
 # -------------------------------------------------------------------
 
 TEMPLATE = app
-!build_pass:contains(QT_CONFIG, debug_and_release):contains(QT_CONFIG, build_all): CONFIG += release
+!build_pass:contains(QT_CONFIG, debug_and_release): CONFIG += release
 TARGET = QtWebProcess
 DESTDIR = $${ROOT_BUILD_DIR}/bin
 
diff --git a/Tools/QtTestBrowser/locationedit.cpp b/Tools/QtTestBrowser/locationedit.cpp
index 6489b2b2e..fd86650b5 100644
--- a/Tools/QtTestBrowser/locationedit.cpp
+++ b/Tools/QtTestBrowser/locationedit.cpp
@@ -80,7 +80,7 @@ void LocationEdit::resizeEvent(QResizeEvent*)
 
 void LocationEdit::updateInternalGeometry()
 {
-    QStyleOptionFrameV3 styleOption;
+    QStyleOptionFrame styleOption;
     initStyleOption(&styleOption);
 
     QRect textRect = style()->subElementRect(QStyle::SE_LineEditContents, &styleOption, this);
diff --git a/Tools/QtTestBrowser/locationedit.h b/Tools/QtTestBrowser/locationedit.h
index dae069d7b..85a7eb763 100644
--- a/Tools/QtTestBrowser/locationedit.h
+++ b/Tools/QtTestBrowser/locationedit.h
@@ -33,7 +33,7 @@
 #include <QIcon>
 #include <QLabel>
 #include <QLineEdit>
-#include <QStyleOptionFrameV3>
+#include <QStyleOptionFrame>
 #include <QTimer>
 
 class LocationEdit : public QLineEdit {
diff --git a/Tools/qmake/config.tests/libsqlite3/libsqlite3.cpp b/Tools/qmake/config.tests/libsqlite3/libsqlite3.cpp
new file mode 100644
index 000000000..34434d195
--- /dev/null
+++ b/Tools/qmake/config.tests/libsqlite3/libsqlite3.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2016 Konstantin Tokavev <annulen@yandex.ru>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sqlite3.h>
+
+int main(int, char**)
+{
+    sqlite3 *db;
+    sqlite3_open("data.db", &db);
+    sqlite3_close(db);
+    return 0;
+}
diff --git a/Tools/qmake/config.tests/libsqlite3/libsqlite3.pro b/Tools/qmake/config.tests/libsqlite3/libsqlite3.pro
new file mode 100644
index 000000000..2c39c5266
--- /dev/null
+++ b/Tools/qmake/config.tests/libsqlite3/libsqlite3.pro
@@ -0,0 +1,5 @@
+SOURCES = libsqlite3.cpp
+OBJECTS_DIR = obj
+LIBS += -lsqlite3
+
+load(qt_build_config)
diff --git a/Tools/qmake/mkspecs/features/configure.prf b/Tools/qmake/mkspecs/features/configure.prf
index a01788df8..b5fb2aed8 100644
--- a/Tools/qmake/mkspecs/features/configure.prf
+++ b/Tools/qmake/mkspecs/features/configure.prf
@@ -120,7 +120,7 @@ defineTest(finalizeConfigure) {
     }
 
     # Sanity checks that would prevent us from building the whole project altogether.
-    !android:!mac:!config_icu {
+    !config_icu:!osx:!use?(wchar_unicode) {
        addReasonForSkippingBuild("ICU is required.")
     }
     production_build:blackberry {
diff --git a/Tools/qmake/mkspecs/features/default_post.prf b/Tools/qmake/mkspecs/features/default_post.prf
index 39bb3f7ae..19313d087 100644
--- a/Tools/qmake/mkspecs/features/default_post.prf
+++ b/Tools/qmake/mkspecs/features/default_post.prf
@@ -263,7 +263,8 @@ QMAKE_EXTRA_TARGETS += incremental
 
 contains(TEMPLATE, lib) {
     # Triggers the right export macros for WebKit internals
-    DEFINES += BUILDING_$${TARGET}
+    # (don't set for Qt modules; qt_module.prf does it)
+    !creating_module: DEFINES += BUILDING_$${TARGET}
 
     # Triggers the right export macro for the QtWebKit API (see qwebkitglobal.h)
     !contains(QT, webkit)|equals(MODULE, webkitwidgets): DEFINES += BUILDING_WEBKIT
diff --git a/Tools/qmake/mkspecs/features/default_pre.prf b/Tools/qmake/mkspecs/features/default_pre.prf
index dbad90d5f..3e6677c92 100644
--- a/Tools/qmake/mkspecs/features/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/default_pre.prf
@@ -102,6 +102,7 @@ gcc:isEqual(QT_ARCH, "arm"): CONFIG -= use_gold_linker
 
 # Pick up Qt's defaults for debug/release/debug_and_release
 if(win32|mac):!macx-xcode {
+    contains(QT_CONFIG, simulator_and_device): CONFIG += iphonesimulator_and_iphoneos
     contains(QT_CONFIG, debug_and_release): CONFIG += debug_and_release
     contains(QT_CONFIG, build_all): CONFIG += build_all
 }
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index 7b0b49d90..21286be2e 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -117,7 +117,7 @@ defineTest(detectFeatures) {
     }
 
     # Try to use an system wide SQlite installation
-    if(!contains(QT_CONFIG, no-pkg-config):packagesExist("sqlite3"))|mac {
+    if(!contains(QT_CONFIG, no-pkg-config):packagesExist("sqlite3"))|config_libsqlite3 {
         WEBKIT_CONFIG += have_sqlite3
     } else {
         SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
@@ -136,14 +136,9 @@ defineTest(detectFeatures) {
         have?(glx):have?(xcomposite):have?(xrender): WEBKIT_CONFIG += use_graphics_surface use_glx
     }
 
-    # Slider Touch is sensible to use when compiling WebKit2
-    enable?(touch_events): WEBKIT_CONFIG += touch_slider
-
     # IndexedDB requires leveldb
     enable?(indexed_database): WEBKIT_CONFIG += use_leveldb
 
-    !config_icu:!mac: WEBKIT_CONFIG += use_wchar_unicode
-
     export(WEBKIT_CONFIG)
     export(CONFIGURE_WARNINGS)
 }
@@ -175,6 +170,9 @@ defineTest(sanitizeFeatures) {
     # GStreamer uses Glib
     use?(gstreamer): WEBKIT_CONFIG += use_glib
 
+    # LevelDB is not needed without indexed_database
+    !enable?(indexed_database): WEBKIT_CONFIG -= use_leveldb
+
     # VideoTrack requires video
     !enable?(video): WEBKIT_CONFIG -= video_track
 
@@ -184,5 +182,8 @@ defineTest(sanitizeFeatures) {
     # Accelerated 2D canvas uses 3D graphics support.
     !use?(3d_graphics): WEBKIT_CONFIG -= accelerated_2d_canvas
 
+    # Touch slider requires touch events
+    !enable?(touch_events): WEBKIT_CONFIG -= touch_slider
+
     export(WEBKIT_CONFIG)
 }
diff --git a/Tools/qmake/mkspecs/features/features.pri b/Tools/qmake/mkspecs/features/features.pri
index 1978aa081..ba18b354d 100644
--- a/Tools/qmake/mkspecs/features/features.pri
+++ b/Tools/qmake/mkspecs/features/features.pri
@@ -114,6 +114,7 @@ FEATURE_DEFAULTS = \
     ENABLE_TOUCH_ADJUSTMENT=1 \
     ENABLE_TOUCH_EVENTS=1 \
     ENABLE_TOUCH_ICON_LOADING=0 \
+    ENABLE_TOUCH_SLIDER=1 \
     ENABLE_USER_TIMING=0 \
     ENABLE_VIBRATION=0 \
     ENABLE_VIDEO=0 \
diff --git a/dist/changes-5.6.0 b/dist/changes-5.6.0
index 0964b19b2..b042f2925 100644
--- a/dist/changes-5.6.0
+++ b/dist/changes-5.6.0
@@ -19,12 +19,21 @@ information about a particular change.
 
 
 ****************************************************************************
-*                          Library                                         *
+*                      Important Behavior Changes                          *
+****************************************************************************
+
+ - The quality parameter in canvas.toDataURL only applies to JPEG images
+   now, in accordance with section 4.12.4.4 of the HTML5 spec.
+
+****************************************************************************
+*                              Library                                     *
 ****************************************************************************
 
 QtWebkit
 --------
  - [QTBUG-44563] Render anchors as clickable links in PDF documents
+ - % unit heights didn't work if parent block height was set in vh
+ - Fixed regression: some errors were not reported to ErrorPageExtension
 
 QtWebkitQML
 -----------
diff --git a/dist/changes-5.6.1 b/dist/changes-5.6.1
new file mode 100644
index 000000000..dd1f3fa0f
--- /dev/null
+++ b/dist/changes-5.6.1
@@ -0,0 +1,49 @@
+Qt 5.6.1 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 5.6.0.
+
+For more details, refer to the online documentation included in this
+distribution. The documentation is also available online:
+
+  http://doc.qt.io/qt-5.6
+
+The Qt version 5.6 series is binary compatible with the 5.5.x series.
+Applications compiled for 5.5 will continue to run with 5.6.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker:
+
+  http://bugreports.qt.io/
+
+Each of these identifiers can be entered in the bug tracker to obtain more
+information about a particular change.
+
+
+****************************************************************************
+*                      Important Behavior Changes                          *
+****************************************************************************
+
+ - QtWebKit will no longer support any QImageIO plugin with the Size option,
+   but instead only decode formats that have been whitelisted. If you are
+   using QtWebKit for controlled content and wish to override the white list
+   it can now be done with the environment variable
+   QTWEBKIT_IMAGEFORMAT_WHITELIST which takes a comma-separated list of
+   QImageIO formats.
+
+****************************************************************************
+*                              Library                                     *
+****************************************************************************
+
+QtWebkit
+--------
+ - Fixed memory leaks and crashes related to SVG animated properties.
+ - Fixed compilation with libjpeg v9.
+
+
+****************************************************************************
+*                      Platform Specific Changes                           *
+****************************************************************************
+
+Windows
+-------
+- QtWebKit does not require Qt configured with ICU support anymore to be
+  built.