<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[51644] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/51644">51644</a></dd>
<dt>Author</dt> <dd>beidson@apple.com</dd>
<dt>Date</dt> <dd>2009-12-03 11:04:40 -0800 (Thu, 03 Dec 2009)</dd>
</dl>

<h3>Log Message</h3>
<pre>&lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API

Reviewed by Sam Weinig.

WebCore: 

Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
       fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
       fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
       fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
       fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
       fast/loader/stateobjects/pushstate-object-types.html
       fast/loader/stateobjects/pushstate-then-replacestate.html
       fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
       fast/loader/stateobjects/replacestate-then-pushstate.html
       http/tests/loading/state-object-security-exception.html

Derived sources and project file changes:
* DerivedSources.cpp:
* DerivedSources.make:
* GNUmakefile.am
* WebCore.pro
* WebCore.vcproj/WebCore.vcproj:
* WebCore.xcodeproj/project.pbxproj:

Add the new PopStateEvent:
* dom/PopStateEvent.cpp: Added.
(WebCore::PopStateEvent::PopStateEvent):
(WebCore::PopStateEvent::initPopStateEvent):
* dom/PopStateEvent.h: Added.
(WebCore::PopStateEvent::create):
(WebCore::PopStateEvent::isPopStateEvent):
(WebCore::PopStateEvent::state):
* dom/PopStateEvent.idl: Added.
* bindings/js/JSPopStateEventCustom.cpp: Added.
(WebCore::JSPopStateEvent::initPopStateEvent):
(WebCore::JSPopStateEvent::state):
* bindings/js/JSEventCustom.cpp:
(WebCore::toJS):
* dom/Event.cpp:
(WebCore::Event::isPopStateEvent):
* dom/Event.h:
* dom/EventNames.h:

Add the &quot;onpopstate&quot; attribute:
* html/HTMLAttributeNames.in:
* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::parseMappedAttribute):
* html/HTMLBodyElement.idl:
* html/HTMLFrameSetElement.cpp:
(WebCore::HTMLFrameSetElement::parseMappedAttribute):
* html/HTMLFrameSetElement.h:
* html/HTMLFrameSetElement.idl:
* page/DOMWindow.h:
* page/DOMWindow.idl:

Add pushState and replaceState management to the loader and history machinery:
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):
* loader/HistoryController.cpp:
(WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from &quot;scrollToAnchor()&quot;, combining
  both the same-document fragment scroll case with the new same-document state object activation case.
(WebCore::HistoryController::pushState):
(WebCore::HistoryController::replaceState):
* loader/HistoryController.h:
* history/BackForwardList.cpp:
(WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
(WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
  list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
  meant to remain.
(WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
  insert the new item.
(WebCore::BackForwardList::removeItem):
* history/BackForwardList.h:
* page/History.cpp:
(WebCore::History::urlForState):
(WebCore::History::stateObjectAdded):
* page/History.h:
* page/History.idl:

Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
* history/HistoryItem.cpp:
(WebCore::HistoryItem::HistoryItem):
(WebCore::HistoryItem::~HistoryItem):
(WebCore::HistoryItem::setStateObject):
(WebCore::HistoryItem::setDocument):
(WebCore::HistoryItem::documentDetached):
* history/HistoryItem.h:
(WebCore::HistoryItem::stateObject):
(WebCore::HistoryItem::document):
* dom/Document.cpp:
(WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
  is going away.
(WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
(WebCore::Document::unregisterHistoryItem): Ditto.
* dom/Document.h:

Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
URL changes as the result of pushState(), replaceState(), or a popstate navigation:
* dom/Document.cpp:
(WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
(WebCore::Document::updateURLForPushOrReplaceState):
(WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
  the pending state object.
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
* loader/DocumentLoader.h:
* loader/FrameLoaderClient.h:
* loader/EmptyClients.h:
(WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):

Change handling of &quot;loading a HistoryItem&quot; to distinguish between new-Document navigations and same-Document
navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadInSameDocument):
(WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
(WebCore::FrameLoader::navigateWithinDocument):
(WebCore::FrameLoader::navigateToDifferentDocument):
(WebCore::FrameLoader::loadItem):
* loader/FrameLoader.h:
* page/Page.cpp:
(WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.

WebKit/chromium: 

* src/FrameLoaderClientImpl.cpp:
(WebKit::FrameLoaderClientImpl::dispatchDidPushStateWithinPage):
(WebKit::FrameLoaderClientImpl::dispatchDidReplaceStateWithinPage):
(WebKit::FrameLoaderClientImpl::dispatchDidPopStateWithinPage):
* src/FrameLoaderClientImpl.h:

WebKit/gtk: 

* WebCoreSupport/FrameLoaderClientGtk.cpp:
(WebKit::FrameLoaderClient::dispatchDidPushStateWithinPage):
(WebKit::FrameLoaderClient::dispatchDidReplaceStateWithinPage):
(WebKit::FrameLoaderClient::dispatchDidPopStateWithinPage):
* WebCoreSupport/FrameLoaderClientGtk.h:

WebKit/mac: 

* WebCoreSupport/WebFrameLoaderClient.h:
* WebCoreSupport/WebFrameLoaderClient.mm:
(WebFrameLoaderClient::dispatchDidPushStateWithinPage):
(WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
(WebFrameLoaderClient::dispatchDidPopStateWithinPage):
* WebView/WebDelegateImplementationCaching.h:
* WebView/WebFrameLoadDelegatePrivate.h:
* WebView/WebView.mm:
(-[WebView _cacheFrameLoadDelegateImplementations]):

WebKit/qt: 

* WebCoreSupport/FrameLoaderClientQt.cpp:
(WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
(WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
(WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
* WebCoreSupport/FrameLoaderClientQt.h:

WebKit/win: 

* Interfaces/IWebFrameLoadDelegatePrivate2.idl:
* WebCoreSupport/WebFrameLoaderClient.cpp:
(WebFrameLoaderClient::dispatchDidPushStateWithinPage):
(WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
(WebFrameLoaderClient::dispatchDidPopStateWithinPage):
* WebCoreSupport/WebFrameLoaderClient.h:

WebKit/wx: 

* WebKitSupport/FrameLoaderClientWx.cpp:
(WebCore::FrameLoaderClientWx::dispatchDidPushStateWithinPage):
(WebCore::FrameLoaderClientWx::dispatchDidReplaceStateWithinPage):
(WebCore::FrameLoaderClientWx::dispatchDidPopStateWithinPage):
* WebKitSupport/FrameLoaderClientWx.h:

WebKitTools: 

Keep DRT-win building...

* DumpRenderTree/win/FrameLoadDelegate.h:
(FrameLoadDelegate::didPushStateWithinPageForFrame):
(FrameLoadDelegate::didReplaceStateWithinPageForFrame):
(FrameLoadDelegate::didPopStateWithinPageForFrame):

LayoutTests: 

Update expected results of old tests:
* fast/dom/Window/window-appendages-cleared-expected.txt:
* fast/dom/Window/window-properties-expected.txt:
* http/tests/security/cross-frame-access-enumeration-expected.txt:

New tests:
* fast/loader/stateobjects: Added.
* fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt: Added.
* fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt: Added.
* fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html: Added.
* fast/loader/stateobjects/document-destroyed-navigate-back.html: Added.
* fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt: Added.
* fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html: Added.
* fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt: Added.
* fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html: Added.
* fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt: Added.
* fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html: Added.
* fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt: Added.
* fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html: Added.
* fast/loader/stateobjects/pushstate-object-types-expected.txt: Added.
* fast/loader/stateobjects/pushstate-object-types.html: Added.
* fast/loader/stateobjects/pushstate-then-replacestate-expected.txt: Added.
* fast/loader/stateobjects/pushstate-then-replacestate.html: Added.
* fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt: Added.
* fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html: Added.
* fast/loader/stateobjects/replacestate-then-pushstate-expected.txt: Added.
* fast/loader/stateobjects/replacestate-then-pushstate.html: Added.
* fast/loader/stateobjects/resources: Added.
* fast/loader/stateobjects/resources/navigate-back.html: Added.
* http/tests/loading/state-object-security-exception-expected.txt: Added.
* http/tests/loading/state-object-security-exception.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowwindowappendagesclearedexpectedtxt">trunk/LayoutTests/fast/dom/Window/window-appendages-cleared-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowwindowpropertiesexpectedtxt">trunk/LayoutTests/fast/dom/Window/window-properties-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessenumerationexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt</a></li>
<li><a href="#trunkWebCoreChangeLog">trunk/WebCore/ChangeLog</a></li>
<li><a href="#trunkWebCoreDerivedSourcescpp">trunk/WebCore/DerivedSources.cpp</a></li>
<li><a href="#trunkWebCoreDerivedSourcesmake">trunk/WebCore/DerivedSources.make</a></li>
<li><a href="#trunkWebCoreGNUmakefileam">trunk/WebCore/GNUmakefile.am</a></li>
<li><a href="#trunkWebCoreWebCorepro">trunk/WebCore/WebCore.pro</a></li>
<li><a href="#trunkWebCoreWebCorevcprojWebCorevcproj">trunk/WebCore/WebCore.vcproj/WebCore.vcproj</a></li>
<li><a href="#trunkWebCoreWebCorexcodeprojprojectpbxproj">trunk/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkWebCorebindingsjsJSEventCustomcpp">trunk/WebCore/bindings/js/JSEventCustom.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSHistoryCustomcpp">trunk/WebCore/bindings/js/JSHistoryCustom.cpp</a></li>
<li><a href="#trunkWebCoredomDocumentcpp">trunk/WebCore/dom/Document.cpp</a></li>
<li><a href="#trunkWebCoredomDocumenth">trunk/WebCore/dom/Document.h</a></li>
<li><a href="#trunkWebCoredomEventcpp">trunk/WebCore/dom/Event.cpp</a></li>
<li><a href="#trunkWebCoredomEventh">trunk/WebCore/dom/Event.h</a></li>
<li><a href="#trunkWebCoredomEventNamesh">trunk/WebCore/dom/EventNames.h</a></li>
<li><a href="#trunkWebCorehistoryBackForwardListcpp">trunk/WebCore/history/BackForwardList.cpp</a></li>
<li><a href="#trunkWebCorehistoryBackForwardListh">trunk/WebCore/history/BackForwardList.h</a></li>
<li><a href="#trunkWebCorehistoryHistoryItemcpp">trunk/WebCore/history/HistoryItem.cpp</a></li>
<li><a href="#trunkWebCorehistoryHistoryItemh">trunk/WebCore/history/HistoryItem.h</a></li>
<li><a href="#trunkWebCorehtmlHTMLAttributeNamesin">trunk/WebCore/html/HTMLAttributeNames.in</a></li>
<li><a href="#trunkWebCorehtmlHTMLBodyElementcpp">trunk/WebCore/html/HTMLBodyElement.cpp</a></li>
<li><a href="#trunkWebCorehtmlHTMLBodyElementh">trunk/WebCore/html/HTMLBodyElement.h</a></li>
<li><a href="#trunkWebCorehtmlHTMLBodyElementidl">trunk/WebCore/html/HTMLBodyElement.idl</a></li>
<li><a href="#trunkWebCorehtmlHTMLFrameSetElementcpp">trunk/WebCore/html/HTMLFrameSetElement.cpp</a></li>
<li><a href="#trunkWebCorehtmlHTMLFrameSetElementh">trunk/WebCore/html/HTMLFrameSetElement.h</a></li>
<li><a href="#trunkWebCorehtmlHTMLFrameSetElementidl">trunk/WebCore/html/HTMLFrameSetElement.idl</a></li>
<li><a href="#trunkWebCoreloaderDocumentLoadercpp">trunk/WebCore/loader/DocumentLoader.cpp</a></li>
<li><a href="#trunkWebCoreloaderDocumentLoaderh">trunk/WebCore/loader/DocumentLoader.h</a></li>
<li><a href="#trunkWebCoreloaderEmptyClientsh">trunk/WebCore/loader/EmptyClients.h</a></li>
<li><a href="#trunkWebCoreloaderFrameLoadercpp">trunk/WebCore/loader/FrameLoader.cpp</a></li>
<li><a href="#trunkWebCoreloaderFrameLoaderh">trunk/WebCore/loader/FrameLoader.h</a></li>
<li><a href="#trunkWebCoreloaderFrameLoaderClienth">trunk/WebCore/loader/FrameLoaderClient.h</a></li>
<li><a href="#trunkWebCoreloaderHistoryControllercpp">trunk/WebCore/loader/HistoryController.cpp</a></li>
<li><a href="#trunkWebCoreloaderHistoryControllerh">trunk/WebCore/loader/HistoryController.h</a></li>
<li><a href="#trunkWebCorepageDOMWindowh">trunk/WebCore/page/DOMWindow.h</a></li>
<li><a href="#trunkWebCorepageDOMWindowidl">trunk/WebCore/page/DOMWindow.idl</a></li>
<li><a href="#trunkWebCorepageHistorycpp">trunk/WebCore/page/History.cpp</a></li>
<li><a href="#trunkWebCorepageHistoryh">trunk/WebCore/page/History.h</a></li>
<li><a href="#trunkWebCorepageHistoryidl">trunk/WebCore/page/History.idl</a></li>
<li><a href="#trunkWebCorepagePagecpp">trunk/WebCore/page/Page.cpp</a></li>
<li><a href="#trunkWebKitchromiumChangeLog">trunk/WebKit/chromium/ChangeLog</a></li>
<li><a href="#trunkWebKitchromiumsrcFrameLoaderClientImplcpp">trunk/WebKit/chromium/src/FrameLoaderClientImpl.cpp</a></li>
<li><a href="#trunkWebKitchromiumsrcFrameLoaderClientImplh">trunk/WebKit/chromium/src/FrameLoaderClientImpl.h</a></li>
<li><a href="#trunkWebKitgtkChangeLog">trunk/WebKit/gtk/ChangeLog</a></li>
<li><a href="#trunkWebKitgtkWebCoreSupportFrameLoaderClientGtkcpp">trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp</a></li>
<li><a href="#trunkWebKitgtkWebCoreSupportFrameLoaderClientGtkh">trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h</a></li>
<li><a href="#trunkWebKitmacChangeLog">trunk/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkWebKitmacWebCoreSupportWebFrameLoaderClienth">trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h</a></li>
<li><a href="#trunkWebKitmacWebCoreSupportWebFrameLoaderClientmm">trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm</a></li>
<li><a href="#trunkWebKitmacWebViewWebDelegateImplementationCachingh">trunk/WebKit/mac/WebView/WebDelegateImplementationCaching.h</a></li>
<li><a href="#trunkWebKitmacWebViewWebFrameLoadDelegatePrivateh">trunk/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h</a></li>
<li><a href="#trunkWebKitmacWebViewWebViewmm">trunk/WebKit/mac/WebView/WebView.mm</a></li>
<li><a href="#trunkWebKitqtChangeLog">trunk/WebKit/qt/ChangeLog</a></li>
<li><a href="#trunkWebKitqtWebCoreSupportFrameLoaderClientQtcpp">trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp</a></li>
<li><a href="#trunkWebKitqtWebCoreSupportFrameLoaderClientQth">trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h</a></li>
<li><a href="#trunkWebKitwinChangeLog">trunk/WebKit/win/ChangeLog</a></li>
<li><a href="#trunkWebKitwinInterfacesIWebFrameLoadDelegatePrivate2idl">trunk/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl</a></li>
<li><a href="#trunkWebKitwinWebCoreSupportWebFrameLoaderClientcpp">trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp</a></li>
<li><a href="#trunkWebKitwinWebCoreSupportWebFrameLoaderClienth">trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h</a></li>
<li><a href="#trunkWebKitwxChangeLog">trunk/WebKit/wx/ChangeLog</a></li>
<li><a href="#trunkWebKitwxWebKitSupportFrameLoaderClientWxcpp">trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp</a></li>
<li><a href="#trunkWebKitwxWebKitSupportFrameLoaderClientWxh">trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h</a></li>
<li><a href="#trunkWebKitToolsChangeLog">trunk/WebKitTools/ChangeLog</a></li>
<li><a href="#trunkWebKitToolsDumpRenderTreewinFrameLoadDelegateh">trunk/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li>trunk/LayoutTests/fast/loader/stateobjects/</li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackwithfragmentscrollexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackwithfragmentscrollhtml">trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackhtml">trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompleteaddeventlistenerexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompleteaddeventlistenerhtml">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyattributeexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyattributehtml">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyinlineattributeexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyinlineattributehtml">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletewindowattributeexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletewindowattributehtml">trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstateobjecttypesexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstateobjecttypeshtml">trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstatethenreplacestateexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstatethenreplacestatehtml">trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstatewithfragmenturlsandhashchangeexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectspushstatewithfragmenturlsandhashchangehtml">trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsreplacestatethenpushstateexpectedtxt">trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsreplacestatethenpushstatehtml">trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate.html</a></li>
<li>trunk/LayoutTests/fast/loader/stateobjects/resources/</li>
<li><a href="#trunkLayoutTestsfastloaderstateobjectsresourcesnavigatebackhtml">trunk/LayoutTests/fast/loader/stateobjects/resources/navigate-back.html</a></li>
<li><a href="#trunkLayoutTestshttptestsloadingstateobjectsecurityexceptionexpectedtxt">trunk/LayoutTests/http/tests/loading/state-object-security-exception-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestsloadingstateobjectsecurityexceptionhtml">trunk/LayoutTests/http/tests/loading/state-object-security-exception.html</a></li>
<li><a href="#trunkWebCorebindingsjsJSPopStateEventCustomcpp">trunk/WebCore/bindings/js/JSPopStateEventCustom.cpp</a></li>
<li><a href="#trunkWebCoredomPopStateEventcpp">trunk/WebCore/dom/PopStateEvent.cpp</a></li>
<li><a href="#trunkWebCoredomPopStateEventh">trunk/WebCore/dom/PopStateEvent.h</a></li>
<li><a href="#trunkWebCoredomPopStateEventidl">trunk/WebCore/dom/PopStateEvent.idl</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/LayoutTests/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,41 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Update expected results of old tests:
+        * fast/dom/Window/window-appendages-cleared-expected.txt:
+        * fast/dom/Window/window-properties-expected.txt:
+        * http/tests/security/cross-frame-access-enumeration-expected.txt:
+
+        New tests:
+        * fast/loader/stateobjects: Added.
+        * fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt: Added.
+        * fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt: Added.
+        * fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html: Added.
+        * fast/loader/stateobjects/document-destroyed-navigate-back.html: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt: Added.
+        * fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html: Added.
+        * fast/loader/stateobjects/pushstate-object-types-expected.txt: Added.
+        * fast/loader/stateobjects/pushstate-object-types.html: Added.
+        * fast/loader/stateobjects/pushstate-then-replacestate-expected.txt: Added.
+        * fast/loader/stateobjects/pushstate-then-replacestate.html: Added.
+        * fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt: Added.
+        * fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html: Added.
+        * fast/loader/stateobjects/replacestate-then-pushstate-expected.txt: Added.
+        * fast/loader/stateobjects/replacestate-then-pushstate.html: Added.
+        * fast/loader/stateobjects/resources: Added.
+        * fast/loader/stateobjects/resources/navigate-back.html: Added.
+        * http/tests/loading/state-object-security-exception-expected.txt: Added.
+        * http/tests/loading/state-object-security-exception.html: Added.
+
</ins><span class="cx"> 2009-12-03  Gustavo Noronha Silva  &lt;gustavo.noronha@collabora.co.uk&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Xan Lopez.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowappendagesclearedexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/window-appendages-cleared-expected.txt (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-appendages-cleared-expected.txt        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/LayoutTests/fast/dom/Window/window-appendages-cleared-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -2,6 +2,8 @@
</span><span class="cx"> PASS history.forward == &quot;LEFTOVER&quot; is false
</span><span class="cx"> PASS history.go == &quot;LEFTOVER&quot; is false
</span><span class="cx"> PASS history.length == &quot;LEFTOVER&quot; is false
</span><ins>+PASS history.pushState == &quot;LEFTOVER&quot; is false
+PASS history.replaceState == &quot;LEFTOVER&quot; is false
</ins><span class="cx"> PASS location.assign == &quot;LEFTOVER&quot; is false
</span><span class="cx"> PASS location.hash == &quot;LEFTOVER&quot; is false
</span><span class="cx"> PASS location.host == &quot;LEFTOVER&quot; is false
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowpropertiesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/window-properties-expected.txt (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-properties-expected.txt        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/LayoutTests/fast/dom/Window/window-properties-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1737,6 +1737,8 @@
</span><span class="cx"> window.history.forward [function]
</span><span class="cx"> window.history.go [function]
</span><span class="cx"> window.history.length [number]
</span><ins>+window.history.pushState [function]
+window.history.replaceState [function]
</ins><span class="cx"> window.innerHeight [number]
</span><span class="cx"> window.innerWidth [number]
</span><span class="cx"> window.length [number]
</span><span class="lines">@@ -1813,6 +1815,7 @@
</span><span class="cx"> window.onpause [null]
</span><span class="cx"> window.onplay [null]
</span><span class="cx"> window.onplaying [null]
</span><ins>+window.onpopstate [null]
</ins><span class="cx"> window.onprogress [null]
</span><span class="cx"> window.onratechange [null]
</span><span class="cx"> window.onreset [null]
</span></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,22 @@
</span><ins>+main frame - has 1 onunload handler(s)
+ALERT: History length is 2
+ALERT: State popped - FirstEntry (type string)
+ALERT: State popped - SecondEntry (type string)
+ALERT: Navigating back...
+main frame - has 1 onunload handler(s)
+ALERT: History length is 2
+ALERT: window.location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html?SecondEntryShouldNeverBeReactivated
+main frame - has 1 onunload handler(s)
+ALERT: History length is 1
+ALERT: window.location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html?FirstEntryShouldNeverBeReactivated
+ALERT: Test completed
+This test:
+-Builds up a list of state object entries.
+-Navigates through them to verify that the popstate event is fired.
+-Navigates away to a new document, with the old document being destroyed.
+-Navigates back to the state object entries and verifies the popstate event is not fired.
+
+History length is 1
+window.location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html?FirstEntryShouldNeverBeReactivated
+Test completed
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackwithfragmentscrollexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+main frame - has 1 onunload handler(s)
+ALERT: History length is 2
+ALERT: State popped - FirstEntry (type string)
+ALERT: hashChanged - location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#FirstEntry
+ALERT: State popped - SecondEntry (type string)
+ALERT: hashChanged - location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#SecondEntry
+ALERT: Navigating back...
+main frame - has 1 onunload handler(s)
+ALERT: History length is 2
+ALERT: window.location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#SecondEntryShouldNeverBeReactivated
+ALERT: hashChanged - location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#FirstEntryShouldNeverBeReactivated
+ALERT: Test completed
+This test:
+-Builds up a list of state object entries with fragment URL.
+-Navigates through them to verify that the popstate and hashchanged events are fired.
+-Navigates away to a new document, with the old document being destroyed.
+-Navigates back to the state object entries and verifies the popstate event is not fired.
+
+History length is 2
+window.location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#SecondEntryShouldNeverBeReactivated
+hashChanged - location is file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html#FirstEntryShouldNeverBeReactivated
+Test completed
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackwithfragmentscrollhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,95 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    if (!sessionStorage.stage)
+        layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+    // alert the messages also so DumpRenderTree can capture and log messages across multiple documents.
+    alert(txt);
+}
+
+function endTest(msg)
+{
+    log(msg);
+    sessionStorage.clear();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function runSecondStageOfTest()
+{
+    log(&quot;History length is &quot; + history.length);
+    log(&quot;window.location is &quot; + window.location);
+    sessionStorage.stage = 3;
+    history.back();
+}
+
+function runThirdStageOfTest()
+{
+    log(&quot;History length is &quot; + history.length);
+    log(&quot;window.location is &quot; + window.location);
+    endTest(&quot;Test completed&quot;);
+}
+
+function loaded()
+{
+    if (sessionStorage.stage) {
+        if (sessionStorage.stage == 2)
+            runSecondStageOfTest();
+        else if (sessionStorage.stage == 3)
+            endTest(&quot;Shouldn't reach this case when doing fragment scrolls&quot;);
+        else
+            endTest(&quot;Unexpected stage value&quot;);
+    } else
+        runFirstStageOfTest();
+}
+
+function runFirstStageOfTest()
+{   
+    history.replaceState(&quot;FirstEntry&quot;, null, &quot;#FirstEntry&quot;);
+    history.pushState(&quot;SecondEntry&quot;, null, &quot;#SecondEntry&quot;);
+    
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == &quot;FirstEntry&quot;) {
+        history.replaceState(&quot;FirstEntryShouldNeverBeReactivated&quot;, null, &quot;#FirstEntryShouldNeverBeReactivated&quot;);
+        history.forward();
+    } else if (event.state == &quot;SecondEntry&quot;) {
+        history.replaceState(&quot;SecondEntryShouldNeverBeReactivated&quot;, null, &quot;#SecondEntryShouldNeverBeReactivated&quot;);
+        window.location = &quot;resources/navigate-back.html&quot;;
+    } else
+        endTest(&quot;Unexpected state popped - &quot; + event.state);
+}
+
+function hashChanged()
+{
+    log(&quot;hashChanged - location is &quot; + window.location);
+    if (window.location.hash == &quot;#FirstEntryShouldNeverBeReactivated&quot;)
+        endTest(&quot;Test completed&quot;);
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;loaded();&quot; onpopstate=&quot;statePopped();&quot; onhashchange=&quot;hashChanged();&quot; onunload=&quot;/* disable page cache */&quot;&gt;
+&lt;pre&gt;
+This test:
+-Builds up a list of state object entries with fragment URL.
+-Navigates through them to verify that the popstate and hashchanged events are fired.
+-Navigates away to a new document, with the old document being destroyed.
+-Navigates back to the state object entries and verifies the popstate event is not fired.
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsdocumentdestroyednavigatebackhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/document-destroyed-navigate-back.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,88 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    if (!sessionStorage.stage)
+        layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+    // alert the messages also so DumpRenderTree can capture and log messages across multiple documents.
+    alert(txt);
+}
+
+function endTest(msg)
+{
+    log(msg);
+    sessionStorage.clear();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function runSecondStageOfTest()
+{
+    log(&quot;History length is &quot; + history.length);
+    log(&quot;window.location is &quot; + window.location);
+    sessionStorage.stage = 3;
+    history.back();
+}
+
+function runThirdStageOfTest()
+{
+    log(&quot;History length is &quot; + history.length);
+    log(&quot;window.location is &quot; + window.location);
+    endTest(&quot;Test completed&quot;);
+}
+
+function loaded()
+{
+    if (sessionStorage.stage) {
+        if (sessionStorage.stage == 2)
+            runSecondStageOfTest();
+        else if (sessionStorage.stage == 3)
+            runThirdStageOfTest();
+        else
+            endTest(&quot;Unexpected stage value&quot;);
+    } else
+        runFirstStageOfTest();
+}
+
+function runFirstStageOfTest()
+{   
+    history.replaceState(&quot;FirstEntry&quot;, null, &quot;?FirstEntry&quot;);
+    history.pushState(&quot;SecondEntry&quot;, null, &quot;?SecondEntry&quot;);
+    
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == &quot;FirstEntry&quot;) {
+        history.replaceState(&quot;FirstEntryShouldNeverBeReactivated&quot;, null, &quot;?FirstEntryShouldNeverBeReactivated&quot;);
+        history.forward();
+    } else if (event.state == &quot;SecondEntry&quot;) {
+        history.replaceState(&quot;SecondEntryShouldNeverBeReactivated&quot;, null, &quot;?SecondEntryShouldNeverBeReactivated&quot;);
+        window.location = &quot;resources/navigate-back.html&quot;;
+    } else
+        endTest(&quot;Unexpected state popped - &quot; + event.state);
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;loaded();&quot; onpopstate=&quot;statePopped();&quot; onunload=&quot;/* disable page cache */&quot;&gt;
+&lt;pre&gt;
+This test:
+-Builds up a list of state object entries.
+-Navigates through them to verify that the popstate event is fired.
+-Navigates away to a new document, with the old document being destroyed.
+-Navigates back to the state object entries and verifies the popstate event is not fired.
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompleteaddeventlistenerexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+This test does the following:
+-Listens for the popstate event using addEventListener
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+
+History length is 2
+State popped - null (type object)
+State popped - StateStringData (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompleteaddeventlistenerhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,46 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.pushState(&quot;StateStringData&quot;, &quot;New title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == null)
+        history.forward();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+window.addEventListener(&quot;popstate&quot;, statePopped);
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Listens for the popstate event using addEventListener
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyattributeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+This test does the following:
+-Uses body.onpopstate to add a popstate handler (both by using the inline attribute and a script-assigned attribute)
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+
+History length is 2
+State popped - null (type object)
+State popped - StateStringData (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyattributehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,48 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.pushState(&quot;StateStringData&quot;, &quot;New title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == null) {
+        document.body.onpopstate = statePopped;
+        history.forward();
+    } else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Uses body.onpopstate to add a popstate handler (both by using the inline attribute and a script-assigned attribute)
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;script&gt;
+document.body.onpopstate = statePopped;
+&lt;/script&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyinlineattributeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+This test does the following:
+-Uses body.onpopstate to add a popstate handler (both by using the inline attribute and a script-assigned attribute)
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+
+History length is 2
+State popped - null (type object)
+State popped - StateStringData (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletebodyinlineattributehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-body-inline-attribute.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.pushState(&quot;StateStringData&quot;, &quot;New title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == null) {
+        document.body.onpopstate = statePopped;
+        history.forward();
+    } else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot; onpopstate=&quot;statePopped();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Uses body.onpopstate to add a popstate handler (both by using the inline attribute and a script-assigned attribute)
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletewindowattributeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+This test does the following:
+-Uses window.onpopstate to add a popstate handler
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+
+History length is 2
+State popped - null (type object)
+State popped - StateStringData (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspopstateafterloadcompletewindowattributehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,46 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.pushState(&quot;StateStringData&quot;, &quot;New title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == null)
+        history.forward();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+window.onpopstate = statePopped;
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Uses window.onpopstate to add a popstate handler
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstateobjecttypesexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+This test calls pushState with state objects of all the different object types supported by the HTML5 &quot;internal structured cloning algorithm&quot; and makes sure the events contain the expected objects when the states are popped.
+
+State popped - [object Object] (type object)
+State popped - [object Object] (type object)
+State popped -  (type object)
+State popped - null (type object)
+State popped - Wed Dec 31 1969 16:00:00 GMT-0800 (PST) (type object)
+State popped - String (type string)
+State popped - 42 (type number)
+State popped - true (type boolean)
+State popped - false (type boolean)
+State popped - null (type object)
+State popped - undefined (type undefined)
+State popped - FirstEntry (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstateobjecttypeshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-object-types.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+    
+function runTest()
+{
+    history.replaceState(&quot;FirstEntry&quot;, &quot;Initial entry&quot;);
+    history.pushState(undefined, &quot;undefined entry&quot;);
+    history.pushState(null, &quot;null entry&quot;);
+    history.pushState(false, &quot;false entry&quot;);
+    history.pushState(true, &quot;true entry&quot;);
+    history.pushState(42, &quot;Number entry&quot;);
+    history.pushState(&quot;String&quot;, &quot;String entry&quot;);
+    history.pushState(new Date(0), &quot;Date entry&quot;);
+    history.pushState(new RegExp, &quot;RegExp entry&quot;);
+    history.pushState(new Array, &quot;Array entry&quot;);
+    history.pushState(new Object, &quot;Object entry&quot;);
+    history.pushState(new Error, &quot;Error entry&quot;);
+
+/* The following are not yet well enough supported in WebKit to meaningfully test here:
+history.pushState([ImageData], &quot;ImageData entry&quot;);
+history.pushState([Blob], &quot;Blob entry&quot;);
+history.pushState([File], &quot;File entry&quot;);
+history.pushState([FileList], &quot;FileList entry&quot;);
+*/
+
+    history.pushState(&quot;BufferEntry&quot;, &quot;Last entry&quot;);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state != &quot;FirstEntry&quot;)
+        history.back();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot; onpopstate=&quot;statePopped();&quot;&gt;
+&lt;pre id=&quot;someelement&quot;&gt;
+This test calls pushState with state objects of all the different object types supported by the HTML5 &quot;internal structured cloning algorithm&quot; and makes sure the events contain the expected objects when the states are popped.
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstatethenreplacestateexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+This test does the following:
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Makes a call to replaceState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event represents the replaced state object
+
+History length is 2
+History length is 2
+State popped - null (type object)
+State popped - 1 (type number)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstatethenreplacestatehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-then-replacestate.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.pushState(&quot;StateStringData&quot;, &quot;New title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.replaceState(1, &quot;Replaced title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == null)
+        history.forward();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot; onpopstate=&quot;statePopped();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Makes a call to replaceState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event represents the replaced state object
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstatewithfragmenturlsandhashchangeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,34 @@
</span><ins>+This test pushes a series of state objects with different URLs and fragment identifiers meant to test the hashChange event as states are popped.
+
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withsomeotherquery
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withsomeotherquery#
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withsomeotherquery
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withsomeotherquery#somehash
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withsomeotherquery#someotherhash
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery#someotherhash
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery#
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery#somehash
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery#
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html?withquery
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/some-other.html
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#otherhash
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#hash
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#
+Hash change fired
+State popped with event null (type object) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html#
+State popped with event OriginalEntry (type string) and location file:///Volumes/Data/svn/OpenSource/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectspushstatewithfragmenturlsandhashchangehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,63 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function runTest()
+{
+    history.replaceState(&quot;OriginalEntry&quot;, &quot;original&quot;);
+    history.pushState(null, null, &quot;#&quot;);
+    history.pushState(null, null, &quot;&quot;);
+    history.pushState(null, null, &quot;#hash&quot;);
+    history.pushState(null, null, &quot;#otherhash&quot;);
+    history.pushState(null, null, &quot;#&quot;);
+    history.pushState(null, null, null);
+    history.pushState(null, null, &quot;some-other.html&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery#&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery#somehash&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery#&quot;);
+    history.pushState(null, null, &quot;some-other.html?withquery#someotherhash&quot;);
+    history.pushState(null, null, &quot;some-other.html?withsomeotherquery#someotherhash&quot;);
+    history.pushState(null, null, &quot;some-other.html?withsomeotherquery#somehash&quot;);
+    history.pushState(null, null, &quot;some-other.html?withsomeotherquery&quot;);
+    history.pushState(null, null, &quot;some-other.html?withsomeotherquery#&quot;);
+    history.pushState(null, null, &quot;some-other.html?withsomeotherquery&quot;);
+
+    history.pushState(&quot;BufferEntry&quot;, &quot;Last entry&quot;);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped with event &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;) and location &quot; + window.location);
+    if (event.state != &quot;OriginalEntry&quot;)
+        history.back();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function hashChanged()
+{
+    log(&quot;Hash change fired&quot;);
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot; onpopstate=&quot;statePopped();&quot; onhashchange=&quot;hashChanged();&quot;&gt;
+&lt;pre&gt;
+This test pushes a series of state objects with different URLs and fragment identifiers meant to test the hashChange event as states are popped.
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsreplacestatethenpushstateexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+This test does the following:
+-Makes a call to replaceState()
+-Makes sure the history length is correct
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+
+History length is 1
+History length is 2
+State popped - OriginalHistoryItem (type string)
+State popped - NewHistoryItem (type string)
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsreplacestatethenpushstatehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/replacestate-then-pushstate.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+    
+function runTest()
+{
+    history.replaceState(&quot;OriginalHistoryItem&quot;, &quot;Replaced title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.pushState(&quot;NewHistoryItem&quot;, &quot;Pushed title&quot;);
+    log(&quot;History length is &quot; + history.length);
+    history.back();
+}
+
+function statePopped()
+{
+    log(&quot;State popped - &quot; + event.state + &quot; (type &quot; + typeof event.state + &quot;)&quot;);
+    if (event.state == &quot;OriginalHistoryItem&quot;)
+        history.forward();
+    else if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot; onpopstate=&quot;statePopped();&quot;&gt;
+&lt;pre&gt;
+This test does the following:
+-Makes a call to replaceState()
+-Makes sure the history length is correct
+-Makes a call to pushState()
+-Makes sure the history length is correct
+-Goes back, and makes sure the popstate event is correct
+-Goes forward, and makes sure the popstate event is correct
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderstateobjectsresourcesnavigatebackhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/loader/stateobjects/resources/navigate-back.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/stateobjects/resources/navigate-back.html                                (rev 0)
+++ trunk/LayoutTests/fast/loader/stateobjects/resources/navigate-back.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+&lt;html&gt;
+&lt;body onload=&quot;alert('Navigating back...'); sessionStorage.stage = 2; history.back();&quot;&gt;&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestsloadingstateobjectsecurityexceptionexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/loading/state-object-security-exception-expected.txt (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/loading/state-object-security-exception-expected.txt                                (rev 0)
+++ trunk/LayoutTests/http/tests/loading/state-object-security-exception-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+main frame - didStartProvisionalLoadForFrame
+main frame - didCommitLoadForFrame
+main frame - didFinishDocumentLoadForFrame
+main frame - didHandleOnloadEventsForFrame
+main frame - didFinishLoadForFrame
+This test makes sure that calls to pushState() and replaceState() with URLs that violate the security origin check fail as expected.
+
+Trying to pushState() with url http://localhost/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url http://localhost/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to pushState() with url http://localhost:8001/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url http://localhost:8001/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to pushState() with url http://www.webkit.org/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url http://www.webkit.org/test.html failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to pushState() with url http://www.webkit.org/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url http://www.webkit.org/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to pushState() with url ftp://www.webkit.org/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url ftp://www.webkit.org/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to pushState() with url file://anyfile.html/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+Trying to replaceState() with url file://anyfile.html/ failed with exception Error: SECURITY_ERR: DOM Exception 18
+History length is 1
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestsloadingstateobjectsecurityexceptionhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/loading/state-object-security-exception.html (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/loading/state-object-security-exception.html                                (rev 0)
+++ trunk/LayoutTests/http/tests/loading/state-object-security-exception.html        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,56 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;script&gt;
+
+if (window.layoutTestController) {
+    layoutTestController.clearBackForwardList();
+    layoutTestController.dumpAsText();
+}
+
+function log(txt)
+{
+    document.getElementById(&quot;logger&quot;).innerText += txt + &quot;\n&quot;;
+}
+
+function tryURL(url)
+{
+    try {
+        history.pushState(null, null, url);
+        log(&quot;Trying to pushState() with url &quot; + url + &quot; succeeded, but should've failed.&quot;);
+    } catch(e) {
+        log(&quot;Trying to pushState() with url &quot; + url + &quot; failed with exception &quot; + e);
+    }
+    log(&quot;History length is &quot; + history.length);
+
+    try {
+        history.replaceState(null, null, url);
+        log(&quot;Trying to replaceState() with url &quot; + url + &quot; succeeded, but should've failed.&quot;);
+    } catch(e) {
+        log(&quot;Trying to replaceState() with url &quot; + url + &quot; failed with exception &quot; + e);
+    }
+    log(&quot;History length is &quot; + history.length);
+}
+
+var URLsToTry = new Array(
+&quot;http://localhost/test.html&quot;,
+&quot;http://localhost:8001/test.html&quot;,
+&quot;http://www.webkit.org/test.html&quot;,
+&quot;http://www.webkit.org/&quot;,
+&quot;ftp://www.webkit.org/&quot;,
+&quot;file://anyfile.html/&quot;
+);
+
+function runTest()
+{
+    for (n in URLsToTry)
+        tryURL(URLsToTry[n]);
+}
+
+&lt;/script&gt;
+&lt;body onload=&quot;runTest();&quot;&gt;
+&lt;pre&gt;
+This test makes sure that calls to pushState() and replaceState() with URLs that violate the security origin check fail as expected.
+&lt;/pre&gt;&lt;br&gt;
+&lt;pre id=&quot;logger&quot;&gt;&lt;/pre&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossframeaccessenumerationexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -10,6 +10,10 @@
</span><span class="cx"> 
</span><span class="cx"> CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-enumeration-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-enumeration.html. Domains, protocols and ports must match.
</span><span class="cx"> 
</span><ins>+CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-enumeration-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-enumeration.html. Domains, protocols and ports must match.
+
+CONSOLE MESSAGE: line 1: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/cross-frame-iframe-for-enumeration-test.html from frame with URL http://127.0.0.1:8000/security/cross-frame-access-enumeration.html. Domains, protocols and ports must match.
+
</ins><span class="cx"> This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)
</span><span class="cx"> 
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,127 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Tests: fast/loader/stateobjects/document-destroyed-navigate-back.html
+               fast/loader/stateobjects/document-destroyed-navigate-back-with-fragment-scroll.html
+               fast/loader/stateobjects/popstate-after-load-complete-addeventlistener.html
+               fast/loader/stateobjects/popstate-after-load-complete-body-attribute.html
+               fast/loader/stateobjects/popstate-after-load-complete-window-attribute.html
+               fast/loader/stateobjects/pushstate-object-types.html
+               fast/loader/stateobjects/pushstate-then-replacestate.html
+               fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange.html
+               fast/loader/stateobjects/replacestate-then-pushstate.html
+               http/tests/loading/state-object-security-exception.html
+
+        Derived sources and project file changes:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am
+        * WebCore.pro
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Add the new PopStateEvent:
+        * dom/PopStateEvent.cpp: Added.
+        (WebCore::PopStateEvent::PopStateEvent):
+        (WebCore::PopStateEvent::initPopStateEvent):
+        * dom/PopStateEvent.h: Added.
+        (WebCore::PopStateEvent::create):
+        (WebCore::PopStateEvent::isPopStateEvent):
+        (WebCore::PopStateEvent::state):
+        * dom/PopStateEvent.idl: Added.
+        * bindings/js/JSPopStateEventCustom.cpp: Added.
+        (WebCore::JSPopStateEvent::initPopStateEvent):
+        (WebCore::JSPopStateEvent::state):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * dom/Event.cpp:
+        (WebCore::Event::isPopStateEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+
+        Add the &quot;onpopstate&quot; attribute:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+        Add pushState and replaceState management to the loader and history machinery:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::updateForSameDocumentNavigation): Augmented from &quot;scrollToAnchor()&quot;, combining
+          both the same-document fragment scroll case with the new same-document state object activation case.
+        (WebCore::HistoryController::pushState):
+        (WebCore::HistoryController::replaceState):
+        * loader/HistoryController.h:
+        * history/BackForwardList.cpp:
+        (WebCore::BackForwardList::addItem): Use insertItemAfterCurrent.
+        (WebCore::BackForwardList::insertItemAfterCurrent): Optionally insert the item without clearing the forward
+          list, as pushStateItem might've selectively cleared only certain items, with the bulk of the forward list
+          meant to remain.
+        (WebCore::BackForwardList::pushStateItem): Clear the forward list *only* for the state item's document, then 
+          insert the new item.
+        (WebCore::BackForwardList::removeItem):
+        * history/BackForwardList.h:
+        * page/History.cpp:
+        (WebCore::History::urlForState):
+        (WebCore::History::stateObjectAdded):
+        * page/History.h:
+        * page/History.idl:
+
+        Let HistoryItems and Documents associate with each other, as well as letting HistoryItems contain state objects:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        (WebCore::HistoryItem::setStateObject):
+        (WebCore::HistoryItem::setDocument):
+        (WebCore::HistoryItem::documentDetached):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::stateObject):
+        (WebCore::HistoryItem::document):
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Notify all back/forward history items owned by this Document that it
+          is going away.
+        (WebCore::Document::registerHistoryItem): Manage the list of back/forward history items this document owns.
+        (WebCore::Document::unregisterHistoryItem): Ditto.
+        * dom/Document.h:
+
+        Add the ability for Documents, DocumentLoaders, and FrameLoaderClients to be notified when a Documents
+        URL changes as the result of pushState(), replaceState(), or a popstate navigation:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): If there's a pending state object, dispatch the popstate event.
+        (WebCore::Document::updateURLForPushOrReplaceState):
+        (WebCore::Document::statePopped): If loading is complete, dispatch the popstate event. Otherwise, set 
+          the pending state object.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::replaceRequestURLForSameDocumentNavigation):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidChangeStateObjectForPageForFrame):
+
+        Change handling of &quot;loading a HistoryItem&quot; to distinguish between new-Document navigations and same-Document
+        navigations, combining the old concept of anchor scrolls with the new concept of state object navigations:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadInSameDocument):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::navigateWithinDocument):
+        (WebCore::FrameLoader::navigateToDifferentDocument):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/Page.cpp:
+        (WebCore::Page::goToItem): Changed to allow state object activations to pass through without the load stopping.
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@chromium.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Not reviewed: chromium build fix.
</span></span></pre></div>
<a id="trunkWebCoreDerivedSourcescpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/DerivedSources.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/DerivedSources.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/DerivedSources.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -181,6 +181,7 @@
</span><span class="cx"> #include &quot;JSPageTransitionEvent.cpp&quot;
</span><span class="cx"> #include &quot;JSPlugin.cpp&quot;
</span><span class="cx"> #include &quot;JSPluginArray.cpp&quot;
</span><ins>+#include &quot;JSPopStateEvent.cpp&quot;
</ins><span class="cx"> #include &quot;JSProcessingInstruction.cpp&quot;
</span><span class="cx"> #include &quot;JSProgressEvent.cpp&quot;
</span><span class="cx"> #include &quot;JSRange.cpp&quot;
</span></span></pre></div>
<a id="trunkWebCoreDerivedSourcesmake"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/DerivedSources.make (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/DerivedSources.make        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/DerivedSources.make        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -228,6 +228,7 @@
</span><span class="cx">     PageTransitionEvent \
</span><span class="cx">     Plugin \
</span><span class="cx">     PluginArray \
</span><ins>+    PopStateEvent \
</ins><span class="cx">     PositionError \
</span><span class="cx">     ProcessingInstruction \
</span><span class="cx">     ProgressEvent \
</span></span></pre></div>
<a id="trunkWebCoreGNUmakefileam"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/GNUmakefile.am (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/GNUmakefile.am        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/GNUmakefile.am        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -141,6 +141,7 @@
</span><span class="cx">         WebCore/dom/Notation.idl \
</span><span class="cx">         WebCore/dom/OverflowEvent.idl \
</span><span class="cx">         WebCore/dom/PageTransitionEvent.idl \
</span><ins>+        WebCore/dom/PopStateEvent.idl \
</ins><span class="cx">         WebCore/dom/ProcessingInstruction.idl \
</span><span class="cx">         WebCore/dom/ProgressEvent.idl \
</span><span class="cx">         WebCore/dom/Range.idl \
</span><span class="lines">@@ -432,6 +433,8 @@
</span><span class="cx">         WebCore/bindings/js/JSPluginCustom.cpp \
</span><span class="cx">         WebCore/bindings/js/JSPluginElementFunctions.cpp \
</span><span class="cx">         WebCore/bindings/js/JSPluginElementFunctions.h \
</span><ins>+        WebCore/bindings/js/JSPopStateEventCustom.cpp \
+        WebCore/bindings/js/JSPopStateEventCustom.h \
</ins><span class="cx">         WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp \
</span><span class="cx">         WebCore/bindings/js/JSQuarantinedObjectWrapper.h \
</span><span class="cx">         WebCore/bindings/js/JSStorageCustom.h \
</span><span class="lines">@@ -772,6 +775,8 @@
</span><span class="cx">         WebCore/dom/PageTransitionEvent.h \
</span><span class="cx">         WebCore/dom/Position.cpp \
</span><span class="cx">         WebCore/dom/Position.h \
</span><ins>+        WebCore/dom/PopStateEvent.cpp \
+        WebCore/dom/PopStateEvent.h \
</ins><span class="cx">         WebCore/dom/PositionIterator.cpp \
</span><span class="cx">         WebCore/dom/PositionIterator.h \
</span><span class="cx">         WebCore/dom/ProcessingInstruction.cpp \
</span></span></pre></div>
<a id="trunkWebCoreWebCorepro"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/WebCore.pro (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/WebCore.pro        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/WebCore.pro        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -361,6 +361,7 @@
</span><span class="cx">     dom/Notation.idl \
</span><span class="cx">     dom/OverflowEvent.idl \
</span><span class="cx">     dom/PageTransitionEvent.idl \
</span><ins>+    dom/PopStateEvent.idl \
</ins><span class="cx">     dom/ProcessingInstruction.idl \
</span><span class="cx">     dom/ProgressEvent.idl \
</span><span class="cx">     dom/RangeException.idl \
</span><span class="lines">@@ -756,6 +757,7 @@
</span><span class="cx">     bindings/js/JSEventListener.cpp \
</span><span class="cx">     bindings/js/JSLazyEventListener.cpp \
</span><span class="cx">     bindings/js/JSPluginElementFunctions.cpp \
</span><ins>+    bindings/js/JSPopStateEventCustom.cpp \
</ins><span class="cx">     bindings/js/ScriptArray.cpp \
</span><span class="cx">     bindings/js/ScriptCachedFrameData.cpp \
</span><span class="cx">     bindings/js/ScriptCallFrame.cpp \
</span><span class="lines">@@ -897,6 +899,7 @@
</span><span class="cx">     dom/OptionElement.cpp \
</span><span class="cx">     dom/OverflowEvent.cpp \
</span><span class="cx">     dom/PageTransitionEvent.cpp \
</span><ins>+    dom/PopStateEvent.cpp \
</ins><span class="cx">     dom/Position.cpp \
</span><span class="cx">     dom/PositionIterator.cpp \
</span><span class="cx">     dom/ProcessingInstruction.cpp \
</span></span></pre></div>
<a id="trunkWebCoreWebCorevcprojWebCorevcproj"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/WebCore.vcproj/WebCore.vcproj (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/WebCore.vcproj/WebCore.vcproj        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/WebCore.vcproj/WebCore.vcproj        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -9211,6 +9211,62 @@
</span><span class="cx">                                 &gt;
</span><span class="cx">                         &lt;/File&gt;
</span><span class="cx">                         &lt;File
</span><ins>+                                RelativePath=&quot;$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.cpp&quot;
+                                &gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Debug|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Release|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Debug_Internal|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Debug_Cairo|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Release_Cairo|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                                &lt;FileConfiguration
+                                        Name=&quot;Debug_All|Win32&quot;
+                                        ExcludedFromBuild=&quot;true&quot;
+                                        &gt;
+                                        &lt;Tool
+                                                Name=&quot;VCCLCompilerTool&quot;
+                                        /&gt;
+                                &lt;/FileConfiguration&gt;
+                        &lt;/File&gt;
+                        &lt;File
+                                RelativePath=&quot;$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPopStateEvent.h&quot;
+                                &gt;
+                        &lt;/File&gt;
+                        &lt;File
</ins><span class="cx">                                 RelativePath=&quot;$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp&quot;
</span><span class="cx">                                 &gt;
</span><span class="cx">                                 &lt;FileConfiguration
</span><span class="lines">@@ -28795,6 +28851,14 @@
</span><span class="cx">                                 &gt;
</span><span class="cx">                         &lt;/File&gt;
</span><span class="cx">                         &lt;File
</span><ins>+                                RelativePath=&quot;..\dom\PopStateEvent.cpp&quot;
+                                &gt;
+                        &lt;/File&gt;
+                        &lt;File
+                                RelativePath=&quot;..\dom\PopStateEvent.h&quot;
+                                &gt;
+                        &lt;/File&gt;
+                        &lt;File
</ins><span class="cx">                                 RelativePath=&quot;..\dom\Position.cpp&quot;
</span><span class="cx">                                 &gt;
</span><span class="cx">                         &lt;/File&gt;
</span><span class="lines">@@ -38334,6 +38398,10 @@
</span><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><span class="cx">                                 &lt;File
</span><ins>+                                        RelativePath=&quot;..\bindings\js\JSPopStateEventCustom.cpp&quot;
+                                        &gt;
+                                &lt;/File&gt;
+                                &lt;File
</ins><span class="cx">                                         RelativePath=&quot;..\bindings\js\JSQuarantinedObjectWrapper.cpp&quot;
</span><span class="cx">                                         &gt;
</span><span class="cx">                                         &lt;FileConfiguration
</span><span class="lines">@@ -42389,11 +42457,11 @@
</span><span class="cx">                                         RelativePath=&quot;..\inspector\front-end\Color.js&quot;
</span><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><del>-                &lt;File
-                    RelativePath=&quot;..\inspector\front-end\ConsolePanel.js&quot;
-                    &gt;
-                &lt;/File&gt;
</del><span class="cx">                                 &lt;File
</span><ins>+                                        RelativePath=&quot;..\inspector\front-end\ConsolePanel.js&quot;
+                                        &gt;
+                                &lt;/File&gt;
+                                &lt;File
</ins><span class="cx">                                         RelativePath=&quot;..\inspector\front-end\ConsoleView.js&quot;
</span><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><span class="lines">@@ -42606,11 +42674,11 @@
</span><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><span class="cx">                                 &lt;File
</span><del>-                                        RelativePath=&quot;..\inspector\front-end\TimelineOverviewPane.js&quot;
</del><ins>+                                        RelativePath=&quot;..\inspector\front-end\TimelineGrid.js&quot;
</ins><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><span class="cx">                                 &lt;File
</span><del>-                                        RelativePath=&quot;..\inspector\front-end\TimelineGrid.js&quot;
</del><ins>+                                        RelativePath=&quot;..\inspector\front-end\TimelineOverviewPane.js&quot;
</ins><span class="cx">                                         &gt;
</span><span class="cx">                                 &lt;/File&gt;
</span><span class="cx">                                 &lt;File
</span></span></pre></div>
<a id="trunkWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/WebCore.xcodeproj/project.pbxproj (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/WebCore.xcodeproj/project.pbxproj        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/WebCore.xcodeproj/project.pbxproj        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1027,6 +1027,12 @@
</span><span class="cx">                 51741D100B07259A00ED442C /* BackForwardList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0C0B07259A00ED442C /* BackForwardList.cpp */; };
</span><span class="cx">                 51741D110B07259A00ED442C /* HistoryItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 51741D0D0B07259A00ED442C /* HistoryItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 51741D120B07259A00ED442C /* HistoryItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0E0B07259A00ED442C /* HistoryItem.cpp */; };
</span><ins>+                5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5174E20810A1F44F00F95E6F /* PopStateEvent.h */; };
+                5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = 5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */; };
+                5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */; };
+                5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */; };
+                5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */; };
+                5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */; };
</ins><span class="cx">                 518A34C11026C831001B6896 /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34BE1026C831001B6896 /* WebSocket.cpp */; };
</span><span class="cx">                 518A34C21026C831001B6896 /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 518A34BF1026C831001B6896 /* WebSocket.h */; };
</span><span class="cx">                 518A34C71026C8C9001B6896 /* JSWebSocketConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */; };
</span><span class="lines">@@ -6333,6 +6339,12 @@
</span><span class="cx">                 51741D0C0B07259A00ED442C /* BackForwardList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardList.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 51741D0D0B07259A00ED442C /* HistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HistoryItem.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 51741D0E0B07259A00ED442C /* HistoryItem.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryItem.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                5174E20810A1F44F00F95E6F /* PopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PopStateEvent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PopStateEvent.idl; sourceTree = &quot;&lt;group&gt;&quot;; };
+                5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEventCustom.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPopStateEvent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PopStateEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 518A34BE1026C831001B6896 /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocket.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 518A34BF1026C831001B6896 /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocket.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 518A34C01026C831001B6896 /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebSocket.idl; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -13503,6 +13515,8 @@
</span><span class="cx">                                 1A0D573F0A5C7867007EDD4C /* JSOverflowEvent.h */,
</span><span class="cx">                                 E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */,
</span><span class="cx">                                 E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,
</span><ins>+                                5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */,
+                                5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */,
</ins><span class="cx">                                 933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
</span><span class="cx">                                 933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
</span><span class="cx">                                 A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */,
</span><span class="lines">@@ -14577,6 +14591,7 @@
</span><span class="cx">                                 BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */,
</span><span class="cx">                                 A9C6E64A0D7465E7006442E9 /* JSPluginArrayCustom.cpp */,
</span><span class="cx">                                 A9C6E64B0D7465E7006442E9 /* JSPluginCustom.cpp */,
</span><ins>+                                5189F01710B3781300F3C739 /* JSPopStateEventCustom.cpp */,
</ins><span class="cx">                                 51DCE8010CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp */,
</span><span class="cx">                                 1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */,
</span><span class="cx">                                 51D0C5150DAA90B7003B3831 /* JSStorageCustom.cpp */,
</span><span class="lines">@@ -15710,6 +15725,9 @@
</span><span class="cx">                                 E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */,
</span><span class="cx">                                 41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */,
</span><span class="cx">                                 41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */,
</span><ins>+                                5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */,
+                                5174E20810A1F44F00F95E6F /* PopStateEvent.h */,
+                                5174E20B10A1F49A00F95E6F /* PopStateEvent.idl */,
</ins><span class="cx">                                 BE91FC8C06133666005E3790 /* Position.cpp */,
</span><span class="cx">                                 BE91FC8B06133666005E3790 /* Position.h */,
</span><span class="cx">                                 37919C210B7D188600A56998 /* PositionIterator.cpp */,
</span><span class="lines">@@ -18211,12 +18229,14 @@
</span><span class="cx">                                 1479FAF0109AE37500DED655 /* RenderRubyBase.h in Headers */,
</span><span class="cx">                                 1479FAF2109AE37500DED655 /* RenderRubyRun.h in Headers */,
</span><span class="cx">                                 1479FAF4109AE37500DED655 /* RenderRubyText.h in Headers */,
</span><ins>+                                5174E20A10A1F44F00F95E6F /* PopStateEvent.h in Headers */,
</ins><span class="cx">                                 18C5FCA610A3991F0048438D /* WebKitSharedScript.h in Headers */,
</span><span class="cx">                                 18C5FCA910A3991F0048438D /* WebKitSharedScriptRepository.h in Headers */,
</span><span class="cx">                                 18C5FCB810A3C6F20048438D /* SharedScriptContext.h in Headers */,
</span><span class="cx">                                 E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */,
</span><span class="cx">                                 9382DF5810A8D5C900925652 /* ColorSpace.h in Headers */,
</span><span class="cx">                                 AB31C91E10AE1B8E000C7B92 /* LineClampValue.h in Headers */,
</span><ins>+                                5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */,
</ins><span class="cx">                                 6E47E66110B7944B00B186C8 /* WebGLGetInfo.h in Headers */,
</span><span class="cx">                                 7A0E76DB10BF059800A0276E /* JSInjectedScriptHost.h in Headers */,
</span><span class="cx">                                 7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
</span><span class="lines">@@ -18323,6 +18343,7 @@
</span><span class="cx">                                 85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
</span><span class="cx">                                 1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
</span><span class="cx">                                 1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
</span><ins>+                                5174E20C10A1F49A00F95E6F /* PopStateEvent.idl in Resources */,
</ins><span class="cx">                         );
</span><span class="cx">                         runOnlyForDeploymentPostprocessing = 0;
</span><span class="cx">                 };
</span><span class="lines">@@ -20364,6 +20385,9 @@
</span><span class="cx">                                 1479FAEF109AE37500DED655 /* RenderRubyBase.cpp in Sources */,
</span><span class="cx">                                 1479FAF1109AE37500DED655 /* RenderRubyRun.cpp in Sources */,
</span><span class="cx">                                 1479FAF3109AE37500DED655 /* RenderRubyText.cpp in Sources */,
</span><ins>+                                5189F01810B3781300F3C739 /* JSPopStateEventCustom.cpp in Sources */,
+                                5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */,
+                                5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */,
</ins><span class="cx">                                 18C5FCA510A3991F0048438D /* WebKitSharedScript.cpp in Sources */,
</span><span class="cx">                                 18C5FCA810A3991F0048438D /* WebKitSharedScriptRepository.cpp in Sources */,
</span><span class="cx">                                 18C5FCB710A3C6F20048438D /* SharedScriptContext.cpp in Sources */,
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSEventCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSEventCustom.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSEventCustom.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/bindings/js/JSEventCustom.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include &quot;JSMutationEvent.h&quot;
</span><span class="cx"> #include &quot;JSOverflowEvent.h&quot;
</span><span class="cx"> #include &quot;JSPageTransitionEvent.h&quot;
</span><ins>+#include &quot;JSPopStateEvent.h&quot;
</ins><span class="cx"> #include &quot;JSProgressEvent.h&quot;
</span><span class="cx"> #include &quot;JSTextEvent.h&quot;
</span><span class="cx"> #include &quot;JSUIEvent.h&quot;
</span><span class="lines">@@ -57,6 +58,7 @@
</span><span class="cx"> #include &quot;MutationEvent.h&quot;
</span><span class="cx"> #include &quot;OverflowEvent.h&quot;
</span><span class="cx"> #include &quot;PageTransitionEvent.h&quot;
</span><ins>+#include &quot;PopStateEvent.h&quot;
</ins><span class="cx"> #include &quot;ProgressEvent.h&quot;
</span><span class="cx"> #include &quot;TextEvent.h&quot;
</span><span class="cx"> #include &quot;UIEvent.h&quot;
</span><span class="lines">@@ -140,6 +142,8 @@
</span><span class="cx">     else if (event-&gt;isErrorEvent())
</span><span class="cx">         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ErrorEvent, event);
</span><span class="cx"> #endif
</span><ins>+    else if (event-&gt;isPopStateEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PopStateEvent, event);
</ins><span class="cx">     else
</span><span class="cx">         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, Event, event);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSHistoryCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSHistoryCustom.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSHistoryCustom.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/bindings/js/JSHistoryCustom.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -163,4 +163,52 @@
</span><span class="cx">     Base::getOwnPropertyNames(exec, propertyNames);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+JSValue JSHistory::pushState(ExecState* exec, const ArgList&amp; args)
+{
+    RefPtr&lt;SerializedScriptValue&gt; historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec-&gt;hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec-&gt;hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() &gt; 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec-&gt;hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()-&gt;stateObjectAdded(historyState.release(), title, url, History::StateObjectPush, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+JSValue JSHistory::replaceState(ExecState* exec, const ArgList&amp; args)
+{
+    RefPtr&lt;SerializedScriptValue&gt; historyState = SerializedScriptValue::create(exec, args.at(0));
+    if (exec-&gt;hadException())
+        return jsUndefined();
+
+    String title = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    if (exec-&gt;hadException())
+        return jsUndefined();
+        
+    String url;
+    if (args.size() &gt; 2) {
+        url = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+        if (exec-&gt;hadException())
+            return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    impl()-&gt;stateObjectAdded(historyState.release(), title, url, History::StateObjectReplace, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
</ins><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSPopStateEventCustomcpp"></a>
<div class="addfile"><h4>Added: trunk/WebCore/bindings/js/JSPopStateEventCustom.cpp (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSPopStateEventCustom.cpp                                (rev 0)
+++ trunk/WebCore/bindings/js/JSPopStateEventCustom.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include &quot;config.h&quot;
+#include &quot;JSPopStateEvent.h&quot;
+
+#include &quot;PopStateEvent.h&quot;
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSPopStateEvent::initPopStateEvent(ExecState* exec, const ArgList&amp; args)
+{
+    const UString&amp; typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    RefPtr&lt;SerializedScriptValue&gt; stateObjectArg = SerializedScriptValue::create(exec, args.at(3));
+    
+    PopStateEvent* event = static_cast&lt;PopStateEvent*&gt;(impl());
+    event-&gt;initPopStateEvent(typeArg, canBubbleArg, cancelableArg, stateObjectArg.release());
+    return jsUndefined();
+}
+
+JSC::JSValue JSPopStateEvent::state(JSC::ExecState* exec) const
+{
+    SerializedScriptValue* object = static_cast&lt;PopStateEvent*&gt;(impl())-&gt;state();
+    if (!object)
+        return JSC::jsNull();
+    
+    return object-&gt;deserialize(exec);
+}
+
+} // namespace WebCore
</ins></span></pre></div>
<a id="trunkWebCoredomDocumentcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/dom/Document.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/Document.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/dom/Document.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -98,6 +98,7 @@
</span><span class="cx"> #include &quot;PageGroup.h&quot;
</span><span class="cx"> #include &quot;PageTransitionEvent.h&quot;
</span><span class="cx"> #include &quot;PlatformKeyboardEvent.h&quot;
</span><ins>+#include &quot;PopStateEvent.h&quot;
</ins><span class="cx"> #include &quot;ProcessingInstruction.h&quot;
</span><span class="cx"> #include &quot;ProgressEvent.h&quot;
</span><span class="cx"> #include &quot;RegisteredEventListener.h&quot;
</span><span class="lines">@@ -1470,6 +1471,12 @@
</span><span class="cx">     if (render)
</span><span class="cx">         render-&gt;destroy();
</span><span class="cx">     
</span><ins>+    HashSet&lt;RefPtr&lt;HistoryItem&gt; &gt; associatedHistoryItems;
+    associatedHistoryItems.swap(m_associatedHistoryItems);
+    HashSet&lt;RefPtr&lt;HistoryItem&gt; &gt;::iterator end = associatedHistoryItems.end();
+    for (HashSet&lt;RefPtr&lt;HistoryItem&gt; &gt;::iterator i = associatedHistoryItems.begin(); i != end; ++i)
+        (*i)-&gt;documentDetached(this);
+    
</ins><span class="cx">     // This is required, as our Frame might delete itself as soon as it detaches
</span><span class="cx">     // us. However, this violates Node::detach() symantics, as it's never
</span><span class="cx">     // possible to re-attach. Eventually Document::detach() should be renamed,
</span><span class="lines">@@ -1741,6 +1748,9 @@
</span><span class="cx">     ImageLoader::dispatchPendingEvents();
</span><span class="cx">     dispatchWindowLoadEvent();
</span><span class="cx">     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
</span><ins>+    if (m_pendingStateObject)
+        dispatchWindowEvent(PopStateEvent::create(m_pendingStateObject.release()));
+    
</ins><span class="cx">     if (f)
</span><span class="cx">         f-&gt;loader()-&gt;handledOnloadEvents();
</span><span class="cx"> #ifdef INSTRUMENT_LAYOUT_SCHEDULING
</span><span class="lines">@@ -4337,6 +4347,40 @@
</span><span class="cx">     initDNSPrefetch();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void Document::updateURLForPushOrReplaceState(const KURL&amp; url)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+
+    setURL(url);
+    f-&gt;loader()-&gt;documentLoader()-&gt;replaceRequestURLForSameDocumentNavigation(url);
+}
+
+void Document::statePopped(SerializedScriptValue* stateObject)
+{
+    Frame* f = frame();
+    if (!f)
+        return;
+    
+    if (f-&gt;loader()-&gt;isComplete())
+        dispatchWindowEvent(PopStateEvent::create(stateObject));
+    else
+        m_pendingStateObject = stateObject;
+}
+
+void Document::registerHistoryItem(HistoryItem* item)
+{
+    ASSERT(!m_associatedHistoryItems.contains(item));
+    m_associatedHistoryItems.add(item);
+}
+
+void Document::unregisterHistoryItem(HistoryItem* item)
+{
+    ASSERT(m_associatedHistoryItems.contains(item) || m_associatedHistoryItems.isEmpty());
+    m_associatedHistoryItems.remove(item);
+}
+
</ins><span class="cx"> void Document::updateSandboxFlags()
</span><span class="cx"> {
</span><span class="cx">     if (m_frame &amp;&amp; securityOrigin())
</span></span></pre></div>
<a id="trunkWebCoredomDocumenth"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/dom/Document.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/Document.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/dom/Document.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -67,7 +67,6 @@
</span><span class="cx">     class EventListener;
</span><span class="cx">     class Frame;
</span><span class="cx">     class FrameView;
</span><del>-    class HitTestRequest;
</del><span class="cx">     class HTMLCanvasElement;
</span><span class="cx">     class HTMLCollection;
</span><span class="cx">     class HTMLAllCollection;
</span><span class="lines">@@ -77,6 +76,8 @@
</span><span class="cx">     class HTMLHeadElement;
</span><span class="cx">     class HTMLInputElement;
</span><span class="cx">     class HTMLMapElement;
</span><ins>+    class HistoryItem;
+    class HitTestRequest;
</ins><span class="cx">     class InspectorTimelineAgent;
</span><span class="cx">     class IntPoint;
</span><span class="cx">     class DOMWrapperWorld;
</span><span class="lines">@@ -93,6 +94,7 @@
</span><span class="cx">     class RenderView;
</span><span class="cx">     class ScriptElementData;
</span><span class="cx">     class SecurityOrigin;
</span><ins>+    class SerializedScriptValue;
</ins><span class="cx">     class SegmentedString;
</span><span class="cx">     class Settings;
</span><span class="cx">     class StyleSheet;
</span><span class="lines">@@ -887,6 +889,11 @@
</span><span class="cx">     //       that already contains content.
</span><span class="cx">     void setSecurityOrigin(SecurityOrigin*);
</span><span class="cx"> 
</span><ins>+    void updateURLForPushOrReplaceState(const KURL&amp;);
+    void statePopped(SerializedScriptValue*);
+    void registerHistoryItem(HistoryItem* item);
+    void unregisterHistoryItem(HistoryItem* item);
+
</ins><span class="cx">     void updateSandboxFlags(); // Set sandbox flags as determined by the frame.
</span><span class="cx"> 
</span><span class="cx">     bool processingLoadEvent() const { return m_processingLoadEvent; }
</span><span class="lines">@@ -1067,6 +1074,8 @@
</span><span class="cx">     Element* m_cssTarget;
</span><span class="cx">     
</span><span class="cx">     bool m_processingLoadEvent;
</span><ins>+    RefPtr&lt;SerializedScriptValue&gt; m_pendingStateObject;
+    HashSet&lt;RefPtr&lt;HistoryItem&gt; &gt; m_associatedHistoryItems;
</ins><span class="cx">     double m_startTime;
</span><span class="cx">     bool m_overMinimumLayoutThreshold;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCoredomEventcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/dom/Event.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/Event.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/dom/Event.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -136,6 +136,11 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool Event::isPopStateEvent() const
+{
+    return false;
+}
+
</ins><span class="cx"> bool Event::isProgressEvent() const
</span><span class="cx"> {
</span><span class="cx">     return false;
</span></span></pre></div>
<a id="trunkWebCoredomEventh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/dom/Event.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/Event.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/dom/Event.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -111,6 +111,7 @@
</span><span class="cx">         virtual bool isBeforeTextInsertedEvent() const;
</span><span class="cx">         virtual bool isOverflowEvent() const;
</span><span class="cx">         virtual bool isPageTransitionEvent() const;
</span><ins>+        virtual bool isPopStateEvent() const;
</ins><span class="cx">         virtual bool isProgressEvent() const;
</span><span class="cx">         virtual bool isXMLHttpRequestProgressEvent() const;
</span><span class="cx">         virtual bool isWebKitAnimationEvent() const;
</span></span></pre></div>
<a id="trunkWebCoredomEventNamesh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/dom/EventNames.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/EventNames.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/dom/EventNames.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -84,6 +84,7 @@
</span><span class="cx">     macro(pagehide) \
</span><span class="cx">     macro(pageshow) \
</span><span class="cx">     macro(paste) \
</span><ins>+    macro(popstate) \
</ins><span class="cx">     macro(readystatechange) \
</span><span class="cx">     macro(reset) \
</span><span class="cx">     macro(resize) \
</span></span></pre></div>
<a id="trunkWebCoredomPopStateEventcpp"></a>
<div class="addfile"><h4>Added: trunk/WebCore/dom/PopStateEvent.cpp (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/PopStateEvent.cpp                                (rev 0)
+++ trunk/WebCore/dom/PopStateEvent.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include &quot;config.h&quot;
+#include &quot;PopStateEvent.h&quot;
+
+#include &quot;EventNames.h&quot;
+
+namespace WebCore {
+
+PopStateEvent::PopStateEvent(PassRefPtr&lt;SerializedScriptValue&gt; stateObject)
+    : Event(eventNames().popstateEvent, false, true)
+    , m_stateObject(stateObject)
+{
+}
+    
+void PopStateEvent::initPopStateEvent(const AtomicString&amp; type, bool canBubble, bool cancelable, PassRefPtr&lt;SerializedScriptValue&gt; stateObject)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubble, cancelable);
+
+    m_stateObject = stateObject;
+}
+
+} // namespace WebCore
</ins></span></pre></div>
<a id="trunkWebCoredomPopStateEventh"></a>
<div class="addfile"><h4>Added: trunk/WebCore/dom/PopStateEvent.h (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/PopStateEvent.h                                (rev 0)
+++ trunk/WebCore/dom/PopStateEvent.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef PopStateEvent_h
+#define PopStateEvent_h
+
+#include &quot;Event.h&quot;
+#include &quot;SerializedScriptValue.h&quot;
+
+namespace WebCore {
+
+class SerializedScriptValue;
+
+class PopStateEvent : public Event {
+public:
+    static PassRefPtr&lt;PopStateEvent&gt; create(PassRefPtr&lt;SerializedScriptValue&gt; stateObject)
+    {
+        return adoptRef(new PopStateEvent(stateObject));
+    }
+
+    void initPopStateEvent(const AtomicString&amp; type, bool canBubble, bool cancelable, PassRefPtr&lt;SerializedScriptValue&gt;);
+    bool isPopStateEvent() const { return true; }
+
+    SerializedScriptValue* state() const { return m_stateObject.get(); }    
+
+private:
+    PopStateEvent(PassRefPtr&lt;SerializedScriptValue&gt;);
+
+    RefPtr&lt;SerializedScriptValue&gt; m_stateObject;
+};
+
+} // namespace WebCore
+
+#endif // PopStateEvent_h
</ins></span></pre></div>
<a id="trunkWebCoredomPopStateEventidl"></a>
<div class="addfile"><h4>Added: trunk/WebCore/dom/PopStateEvent.idl (0 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/dom/PopStateEvent.idl                                (rev 0)
+++ trunk/WebCore/dom/PopStateEvent.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -0,0 +1,40 @@
</span><ins>+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] PopStateEvent : Event {
+        [Custom] void initPopStateEvent(in DOMString typeArg, 
+                               in boolean canBubbleArg, 
+                               in boolean cancelableArg, 
+                               in any stateArg);
+                               
+        readonly attribute [CustomGetter] any state;
+    };
+
+}
</ins></span></pre></div>
<a id="trunkWebCorehistoryBackForwardListcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/history/BackForwardList.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/history/BackForwardList.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/history/BackForwardList.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -34,6 +34,7 @@
</span><span class="cx"> #include &quot;Logging.h&quot;
</span><span class="cx"> #include &quot;Page.h&quot;
</span><span class="cx"> #include &quot;PageCache.h&quot;
</span><ins>+#include &quot;SerializedScriptValue.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> using namespace std;
</span><span class="cx"> 
</span><span class="lines">@@ -58,12 +59,17 @@
</span><span class="cx"> 
</span><span class="cx"> void BackForwardList::addItem(PassRefPtr&lt;HistoryItem&gt; prpItem)
</span><span class="cx"> {
</span><ins>+    insertItemAfterCurrent(prpItem, true);
+}
+
+void BackForwardList::insertItemAfterCurrent(PassRefPtr&lt;HistoryItem&gt; prpItem, bool removeForwardList)
+{
</ins><span class="cx">     ASSERT(prpItem);
</span><span class="cx">     if (m_capacity == 0 || !m_enabled)
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="cx">     // Toss anything in the forward list    
</span><del>-    if (m_current != NoCurrentItemIndex) {
</del><ins>+    if (removeForwardList &amp;&amp; m_current != NoCurrentItemIndex) {
</ins><span class="cx">         unsigned targetSize = m_current + 1;
</span><span class="cx">         while (m_entries.size() &gt; targetSize) {
</span><span class="cx">             RefPtr&lt;HistoryItem&gt; item = m_entries.last();
</span><span class="lines">@@ -84,8 +90,8 @@
</span><span class="cx">         m_page-&gt;mainFrame()-&gt;loader()-&gt;client()-&gt;dispatchDidRemoveBackForwardItem(item.get());
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    m_entries.append(prpItem);
-    m_entryHash.add(m_entries.last());
</del><ins>+    m_entryHash.add(prpItem.get());
+    m_entries.insert(m_current + 1, prpItem);
</ins><span class="cx">     m_current++;
</span><span class="cx">     m_page-&gt;mainFrame()-&gt;loader()-&gt;client()-&gt;dispatchDidAddBackForwardItem(currentItem());
</span><span class="cx"> }
</span><span class="lines">@@ -235,6 +241,30 @@
</span><span class="cx">     return m_entries;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void BackForwardList::pushStateItem(PassRefPtr&lt;HistoryItem&gt; newItem)
+{
+    ASSERT(newItem);
+    ASSERT(newItem-&gt;document());
+    ASSERT(newItem-&gt;stateObject());
+    
+    RefPtr&lt;HistoryItem&gt; current = currentItem();
+    ASSERT(current);
+
+    Document* newItemDocument = newItem-&gt;document();
+    while (HistoryItem* item = forwardItem()) {
+        if (item-&gt;document() != newItemDocument)
+            break;
+        removeItem(item);
+    }
+
+    insertItemAfterCurrent(newItem, false);
+    
+    if (!current-&gt;document()) {
+        current-&gt;setDocument(newItemDocument);
+        current-&gt;setStateObject(SerializedScriptValue::create());
+    }
+}
+
</ins><span class="cx"> void BackForwardList::close()
</span><span class="cx"> {
</span><span class="cx">     int size = m_entries.size();
</span><span class="lines">@@ -267,7 +297,7 @@
</span><span class="cx">             else {
</span><span class="cx">                 size_t count = m_entries.size();
</span><span class="cx">                 if (m_current &gt;= count)
</span><del>-                    m_current = count ? count-1 : NoCurrentItemIndex;
</del><ins>+                    m_current = count ? count - 1 : NoCurrentItemIndex;
</ins><span class="cx">             }
</span><span class="cx">             break;
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkWebCorehistoryBackForwardListh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/history/BackForwardList.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/history/BackForwardList.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/history/BackForwardList.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -35,8 +35,11 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><ins>+class Document;
</ins><span class="cx"> class HistoryItem;
</span><span class="cx"> class Page;
</span><ins>+class SerializedScriptValue;
+class String;
</ins><span class="cx"> 
</span><span class="cx"> typedef Vector&lt;RefPtr&lt;HistoryItem&gt; &gt; HistoryItemVector;
</span><span class="cx"> typedef HashSet&lt;RefPtr&lt;HistoryItem&gt; &gt; HistoryItemHashSet;
</span><span class="lines">@@ -96,12 +99,16 @@
</span><span class="cx">     void removeItem(HistoryItem*);
</span><span class="cx">     HistoryItemVector&amp; entries();
</span><span class="cx">     
</span><ins>+    void pushStateItem(PassRefPtr&lt;HistoryItem&gt;);
+
</ins><span class="cx"> #if ENABLE(WML)
</span><span class="cx">     void clearWMLPageHistory();
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     BackForwardList(Page*);
</span><ins>+    
+    void insertItemAfterCurrent(PassRefPtr&lt;HistoryItem&gt;, bool removeForwardList);
</ins><span class="cx"> 
</span><span class="cx">     Page* m_page;
</span><span class="cx"> #if PLATFORM(CHROMIUM) 
</span></span></pre></div>
<a id="trunkWebCorehistoryHistoryItemcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/history/HistoryItem.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/history/HistoryItem.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/history/HistoryItem.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -48,6 +48,7 @@
</span><span class="cx">     , m_lastVisitWasFailure(false)
</span><span class="cx">     , m_isTargetItem(false)
</span><span class="cx">     , m_visitCount(0)
</span><ins>+    , m_document(0)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -60,6 +61,7 @@
</span><span class="cx">     , m_lastVisitWasFailure(false)
</span><span class="cx">     , m_isTargetItem(false)
</span><span class="cx">     , m_visitCount(0)
</span><ins>+    , m_document(0)
</ins><span class="cx"> {    
</span><span class="cx">     iconDatabase()-&gt;retainIconForPageURL(m_urlString);
</span><span class="cx"> }
</span><span class="lines">@@ -74,6 +76,7 @@
</span><span class="cx">     , m_lastVisitWasFailure(false)
</span><span class="cx">     , m_isTargetItem(false)
</span><span class="cx">     , m_visitCount(0)
</span><ins>+    , m_document(0)
</ins><span class="cx"> {
</span><span class="cx">     iconDatabase()-&gt;retainIconForPageURL(m_urlString);
</span><span class="cx"> }
</span><span class="lines">@@ -89,6 +92,7 @@
</span><span class="cx">     , m_lastVisitWasFailure(false)
</span><span class="cx">     , m_isTargetItem(false)
</span><span class="cx">     , m_visitCount(0)
</span><ins>+    , m_document(0)
</ins><span class="cx"> {    
</span><span class="cx">     iconDatabase()-&gt;retainIconForPageURL(m_urlString);
</span><span class="cx"> }
</span><span class="lines">@@ -97,6 +101,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_cachedPage);
</span><span class="cx">     iconDatabase()-&gt;releaseIconForPageURL(m_urlString);
</span><ins>+    setDocument(0);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline HistoryItem::HistoryItem(const HistoryItem&amp; item)
</span><span class="lines">@@ -387,6 +392,32 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void HistoryItem::setStateObject(PassRefPtr&lt;SerializedScriptValue&gt; object)
+{
+    ASSERT(m_document);
+    m_stateObject = object;
+}
+
+void HistoryItem::setDocument(Document* document)
+{
+    if (m_document == document)
+        return;
+    
+    if (m_document)
+        m_document-&gt;unregisterHistoryItem(this);
+    if (document)
+        document-&gt;registerHistoryItem(this);
+        
+    m_document = document;
+}
+
+void HistoryItem::documentDetached(Document* document)
+{
+    ASSERT(m_document == document);
+    m_document = 0;
+    m_stateObject = 0;
+}
+
</ins><span class="cx"> void HistoryItem::addChildItem(PassRefPtr&lt;HistoryItem&gt; child)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!childItemWithTarget(child-&gt;target()));
</span></span></pre></div>
<a id="trunkWebCorehistoryHistoryItemh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/history/HistoryItem.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/history/HistoryItem.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/history/HistoryItem.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;IntPoint.h&quot;
</span><span class="cx"> #include &quot;PlatformString.h&quot;
</span><ins>+#include &quot;SerializedScriptValue.h&quot;
</ins><span class="cx"> #include &lt;wtf/OwnPtr.h&gt;
</span><span class="cx"> #include &lt;wtf/PassOwnPtr.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -132,6 +133,12 @@
</span><span class="cx">     void setTitle(const String&amp;);
</span><span class="cx">     void setIsTargetItem(bool);
</span><span class="cx">     
</span><ins>+    void setStateObject(PassRefPtr&lt;SerializedScriptValue&gt; object);
+    SerializedScriptValue* stateObject() const { return m_stateObject.get(); }
+    void setDocument(Document* document);
+    Document* document() const { return m_document; }
+    void documentDetached(Document*);
+    
</ins><span class="cx">     void setFormInfoFromRequest(const ResourceRequest&amp;);
</span><span class="cx">     void setFormData(PassRefPtr&lt;FormData&gt;);
</span><span class="cx">     void setFormContentType(const String&amp;);
</span><span class="lines">@@ -235,6 +242,10 @@
</span><span class="cx"> 
</span><span class="cx">     OwnPtr&lt;Vector&lt;String&gt; &gt; m_redirectURLs;
</span><span class="cx"> 
</span><ins>+    // Support for HTML5 History
+    RefPtr&lt;SerializedScriptValue&gt; m_stateObject;
+    Document* m_document;
+    
</ins><span class="cx">     // info used to repost form data
</span><span class="cx">     RefPtr&lt;FormData&gt; m_formData;
</span><span class="cx">     String m_formContentType;
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLAttributeNamesin"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLAttributeNames.in (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLAttributeNames.in        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLAttributeNames.in        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -182,6 +182,7 @@
</span><span class="cx"> onpause
</span><span class="cx"> onplay
</span><span class="cx"> onplaying
</span><ins>+onpopstate
</ins><span class="cx"> onprogress
</span><span class="cx"> onratechange
</span><span class="cx"> onreset
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLBodyElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLBodyElement.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLBodyElement.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLBodyElement.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -139,6 +139,8 @@
</span><span class="cx">         document()-&gt;setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</span><span class="cx">     else if (attr-&gt;name() == onpageshowAttr)
</span><span class="cx">         document()-&gt;setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</span><ins>+    else if (attr-&gt;name() == onpopstateAttr)
+        document()-&gt;setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</ins><span class="cx">     else if (attr-&gt;name() == onblurAttr)
</span><span class="cx">         document()-&gt;setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</span><span class="cx">     else if (attr-&gt;name() == onfocusAttr)
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLBodyElementh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLBodyElement.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLBodyElement.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLBodyElement.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -52,13 +52,15 @@
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
</span><span class="cx"> 
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
</span><ins>+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
</ins><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
</span><del>-    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
</del><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
</span><ins>+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
</ins><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
</span><ins>+
</ins><span class="cx"> #if ENABLE(ORIENTATION_EVENTS)
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLBodyElementidl"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLBodyElement.idl (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLBodyElement.idl        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLBodyElement.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -40,6 +40,7 @@
</span><span class="cx">         attribute [DontEnum] EventListener onmessage;
</span><span class="cx">         attribute [DontEnum] EventListener onoffline;
</span><span class="cx">         attribute [DontEnum] EventListener ononline;
</span><ins>+        attribute [DontEnum] EventListener onpopstate;
</ins><span class="cx">         attribute [DontEnum] EventListener onresize;
</span><span class="cx">         attribute [DontEnum] EventListener onstorage;
</span><span class="cx">         attribute [DontEnum] EventListener onunload;
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLFrameSetElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLFrameSetElement.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLFrameSetElement.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLFrameSetElement.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -151,6 +151,8 @@
</span><span class="cx">         document()-&gt;setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</span><span class="cx">     else if (attr-&gt;name() == onofflineAttr)
</span><span class="cx">         document()-&gt;setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</span><ins>+    else if (attr-&gt;name() == onpopstateAttr)
+        document()-&gt;setWindowAttributeEventListener(eventNames().popstateEvent, createAttributeEventListener(document()-&gt;frame(), attr));
</ins><span class="cx">     else
</span><span class="cx">         HTMLElement::parseMappedAttribute(attr);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLFrameSetElementh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLFrameSetElement.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLFrameSetElement.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLFrameSetElement.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -79,6 +79,7 @@
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
</span><ins>+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(popstate);
</ins><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
</span><span class="cx">     DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
</span></span></pre></div>
<a id="trunkWebCorehtmlHTMLFrameSetElementidl"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/html/HTMLFrameSetElement.idl (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/html/HTMLFrameSetElement.idl        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/html/HTMLFrameSetElement.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -37,6 +37,7 @@
</span><span class="cx">         attribute [DontEnum] EventListener onmessage;
</span><span class="cx">         attribute [DontEnum] EventListener onoffline;
</span><span class="cx">         attribute [DontEnum] EventListener ononline;
</span><ins>+        attribute [DontEnum] EventListener onpopstate;
</ins><span class="cx">         attribute [DontEnum] EventListener onresize;
</span><span class="cx">         attribute [DontEnum] EventListener onstorage;
</span><span class="cx">         attribute [DontEnum] EventListener onunload;
</span></span></pre></div>
<a id="trunkWebCoreloaderDocumentLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/DocumentLoader.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/DocumentLoader.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/DocumentLoader.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -199,7 +199,7 @@
</span><span class="cx">     return request().url();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void DocumentLoader::replaceRequestURLForAnchorScroll(const KURL&amp; url)
</del><ins>+void DocumentLoader::replaceRequestURLForSameDocumentNavigation(const KURL&amp; url)
</ins><span class="cx"> {
</span><span class="cx">     m_originalRequestCopy.setURL(url);
</span><span class="cx">     m_request.setURL(url);
</span></span></pre></div>
<a id="trunkWebCoreloaderDocumentLoaderh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/DocumentLoader.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/DocumentLoader.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/DocumentLoader.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -88,7 +88,7 @@
</span><span class="cx">         const KURL&amp; responseURL() const;
</span><span class="cx">         const String&amp; responseMIMEType() const;
</span><span class="cx">         
</span><del>-        void replaceRequestURLForAnchorScroll(const KURL&amp;);
</del><ins>+        void replaceRequestURLForSameDocumentNavigation(const KURL&amp;);
</ins><span class="cx">         bool isStopping() const { return m_isStopping; }
</span><span class="cx">         void stopLoading(DatabasePolicy = DatabasePolicyStop);
</span><span class="cx">         void setCommitted(bool committed) { m_committed = committed; }
</span></span></pre></div>
<a id="trunkWebCoreloaderEmptyClientsh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/EmptyClients.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/EmptyClients.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/EmptyClients.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -202,6 +202,9 @@
</span><span class="cx">     virtual void dispatchDidCancelClientRedirect() { }
</span><span class="cx">     virtual void dispatchWillPerformClientRedirect(const KURL&amp;, double, double) { }
</span><span class="cx">     virtual void dispatchDidChangeLocationWithinPage() { }
</span><ins>+    virtual void dispatchDidPushStateWithinPage() { }
+    virtual void dispatchDidReplaceStateWithinPage() { }
+    virtual void dispatchDidPopStateWithinPage() { }
</ins><span class="cx">     virtual void dispatchWillClose() { }
</span><span class="cx">     virtual void dispatchDidReceiveIcon() { }
</span><span class="cx">     virtual void dispatchDidStartProvisionalLoad() { }
</span></span></pre></div>
<a id="trunkWebCoreloaderFrameLoadercpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/FrameLoader.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/FrameLoader.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/FrameLoader.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1703,52 +1703,70 @@
</span><span class="cx">         child-&gt;loader()-&gt;setFirstPartyForCookies(url);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-class HashChangeEventTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr&lt;HashChangeEventTask&gt; create(PassRefPtr&lt;Document&gt; document)
-    {
-        return new HashChangeEventTask(document);
-    }
-    
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        ASSERT_UNUSED(context, context-&gt;isDocument());
-        m_document-&gt;dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
-    }
-    
-private:
-    HashChangeEventTask(PassRefPtr&lt;Document&gt; document)
-        : m_document(document)
-    {
-        ASSERT(m_document);
-    }
-    
-    RefPtr&lt;Document&gt; m_document;
-};
-
</del><span class="cx"> // This does the same kind of work that didOpenURL does, except it relies on the fact
</span><span class="cx"> // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
</span><del>-void FrameLoader::scrollToAnchor(const KURL&amp; url)
</del><ins>+void FrameLoader::loadInSameDocument(const KURL&amp; url, SerializedScriptValue* stateObject, bool isNewNavigation)
</ins><span class="cx"> {
</span><del>-    ASSERT(equalIgnoringFragmentIdentifier(url, m_URL));
-    if (equalIgnoringFragmentIdentifier(url, m_URL) &amp;&amp; !equalIgnoringNullity(url.fragmentIdentifier(), m_URL.fragmentIdentifier())) {
-        Document* currentDocument = frame()-&gt;document();
-        currentDocument-&gt;postTask(HashChangeEventTask::create(currentDocument));
</del><ins>+    // If we have a state object, we cannot also be a new navigation.
+    ASSERT(!stateObject || (stateObject &amp;&amp; !isNewNavigation));
+
+    // Update the data source's request with the new URL to fake the URL change
+    m_frame-&gt;document()-&gt;setURL(url);
+    documentLoader()-&gt;replaceRequestURLForSameDocumentNavigation(url);
+    if (isNewNavigation &amp;&amp; !shouldTreatURLAsSameAsCurrent(url) &amp;&amp; !stateObject) {
+        // NB: must happen after replaceRequestURLForSameDocumentNavigation(), since we add 
+        // based on the current request. Must also happen before we openURL and displace the 
+        // scroll position, since adding the BF item will save away scroll state.
+        
+        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
+        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
+        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
+        // though its load is not yet done.  I think this all works out OK, for one because
+        // we have already saved away the scroll and doc state for the long slow load,
+        // but it's not an obvious case.
+
+        history()-&gt;updateBackForwardListForFragmentScroll();
</ins><span class="cx">     }
</span><span class="cx">     
</span><ins>+    bool hashChange = equalIgnoringFragmentIdentifier(url, m_URL) &amp;&amp; url.fragmentIdentifier() != m_URL.fragmentIdentifier();
</ins><span class="cx">     m_URL = url;
</span><del>-    history()-&gt;updateForAnchorScroll();
</del><ins>+    history()-&gt;updateForSameDocumentNavigation();
</ins><span class="cx"> 
</span><span class="cx">     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
</span><del>-    m_frame-&gt;eventHandler()-&gt;stopAutoscrollTimer();
-    started();
-    if (FrameView* view = m_frame-&gt;view())
-        view-&gt;scrollToFragment(m_URL);
-
</del><ins>+    if (hashChange)
+        m_frame-&gt;eventHandler()-&gt;stopAutoscrollTimer();
+    
</ins><span class="cx">     // It's important to model this as a load that starts and immediately finishes.
</span><span class="cx">     // Otherwise, the parent frame may think we never finished loading.
</span><ins>+    started();
+    
+    if (hashChange) {
+        if (FrameView* view = m_frame-&gt;view())
+            view-&gt;scrollToFragment(m_URL);
+    }
+    
</ins><span class="cx">     m_isComplete = false;
</span><span class="cx">     checkCompleted();
</span><ins>+
+    if (isNewNavigation) {
+        // This will clear previousItem from the rest of the frame tree that didn't
+        // doing any loading. We need to make a pass on this now, since for anchor nav
+        // we'll not go through a real load and reach Completed state.
+        checkLoadComplete();
+    }
+
+    if (stateObject) {
+        m_frame-&gt;document()-&gt;statePopped(stateObject);
+        m_client-&gt;dispatchDidPopStateWithinPage();
+    }
+    
+    if (hashChange) {
+        m_frame-&gt;document()-&gt;dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
+        m_client-&gt;dispatchDidChangeLocationWithinPage();
+    }
+    
+    // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
+    m_client-&gt;didFinishLoad();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool FrameLoader::isComplete() const
</span><span class="lines">@@ -3362,40 +3380,13 @@
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&amp; request, bool shouldContinue)
</span><span class="cx"> {
</span><del>-    bool isRedirect = m_quickRedirectComing || policyChecker()-&gt;loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
</del><span class="cx">     m_quickRedirectComing = false;
</span><span class="cx"> 
</span><span class="cx">     if (!shouldContinue)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    KURL url = request.url();
-    
-    m_documentLoader-&gt;replaceRequestURLForAnchorScroll(url);
-    if (!isRedirect &amp;&amp; !shouldTreatURLAsSameAsCurrent(url)) {
-        // NB: must happen after _setURL, since we add based on the current request.
-        // Must also happen before we openURL and displace the scroll position, since
-        // adding the BF item will save away scroll state.
-        
-        // NB2:  If we were loading a long, slow doc, and the user anchor nav'ed before
-        // it was done, currItem is now set the that slow doc, and prevItem is whatever was
-        // before it.  Adding the b/f item will bump the slow doc down to prevItem, even
-        // though its load is not yet done.  I think this all works out OK, for one because
-        // we have already saved away the scroll and doc state for the long slow load,
-        // but it's not an obvious case.
-
-        history()-&gt;updateBackForwardListForFragmentScroll();
-    }
-    
-    scrollToAnchor(url);
-    
-    if (!isRedirect)
-        // This will clear previousItem from the rest of the frame tree that didn't
-        // doing any loading. We need to make a pass on this now, since for anchor nav
-        // we'll not go through a real load and reach Completed state.
-        checkLoadComplete();

-    m_client-&gt;dispatchDidChangeLocationWithinPage();
-    m_client-&gt;didFinishLoad();
</del><ins>+    bool isRedirect = m_quickRedirectComing || policyChecker()-&gt;loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;    
+    loadInSameDocument(request.url(), 0, !isRedirect);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL&amp; url)
</span><span class="lines">@@ -3670,14 +3661,51 @@
</span><span class="cx">     return frame;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// Loads content into this frame, as specified by history item
</del><ins>+void FrameLoader::navigateWithinDocument(HistoryItem* item)
+{
+    ASSERT(!item-&gt;document() || item-&gt;document() == m_frame-&gt;document());
+
+    // Save user view state to the current history item here since we don't do a normal load.
+    // FIXME: Does form state need to be saved here too?
+    history()-&gt;saveScrollPositionAndViewStateToItem(history()-&gt;currentItem());
+    if (FrameView* view = m_frame-&gt;view())
+        view-&gt;setWasScrolledByUser(false);
+
+    history()-&gt;setCurrentItem(item);
+        
+    // loadInSameDocument() actually changes the URL and notifies load delegates of a &quot;fake&quot; load
+    loadInSameDocument(item-&gt;url(), item-&gt;stateObject(), false);
+
+    // Restore user view state from the current history item here since we don't do a normal load.
+    // Even though we just manually set the current history item, this ASSERT verifies nothing 
+    // inside of loadInSameDocument() caused it to change.
+    ASSERT(history()-&gt;currentItem() == item);
+    history()-&gt;restoreScrollPositionAndViewState();
+}
+
</ins><span class="cx"> // FIXME: This function should really be split into a couple pieces, some of
</span><span class="cx"> // which should be methods of HistoryController and some of which should be
</span><span class="cx"> // methods of FrameLoader.
</span><del>-void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
</del><ins>+void FrameLoader::navigateToDifferentDocument(HistoryItem* item, FrameLoadType loadType)
</ins><span class="cx"> {
</span><del>-    if (!m_frame-&gt;page())
-        return;
</del><ins>+    // Remember this item so we can traverse any child items as child frames load
+    history()-&gt;setProvisionalItem(item);
+    
+    // Check if we'll be using the page cache.  We only use the page cache
+    // if one exists and it is less than _backForwardCacheExpirationInterval
+    // seconds old.  If the cache is expired it gets flushed here.
+    if (RefPtr&lt;CachedPage&gt; cachedPage = pageCache()-&gt;get(item)) {
+        // FIXME: 1800 should not be hardcoded, it should come from
+        // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
+        // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
+        if (currentTime() - cachedPage-&gt;timeStamp() &lt;= 1800) {
+            loadWithDocumentLoader(cachedPage-&gt;documentLoader(), loadType, 0);   
+            return;
+        }
+        
+        LOG(PageCache, &quot;Not restoring page for %s from back/forward cache because cache entry has expired&quot;, history()-&gt;provisionalItem()-&gt;url().string().ascii().data());
+        pageCache()-&gt;remove(item);
+    }
</ins><span class="cx"> 
</span><span class="cx">     KURL itemURL = item-&gt;url();
</span><span class="cx">     KURL itemOriginalURL = item-&gt;originalURL();
</span><span class="lines">@@ -3686,138 +3714,96 @@
</span><span class="cx">         currentURL = documentLoader()-&gt;url();
</span><span class="cx">     RefPtr&lt;FormData&gt; formData = item-&gt;formData();
</span><span class="cx"> 
</span><del>-    // Are we navigating to an anchor within the page?
-    // Note if we have child frames we do a real reload, since the child frames might not
-    // match our current frame structure, or they might not have the right content.  We could
-    // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form or navigating from
-    // a page that was resulted from a form post.
-    bool shouldScroll = !formData &amp;&amp; !(history()-&gt;currentItem() &amp;&amp; history()-&gt;currentItem()-&gt;formData()) &amp;&amp; history()-&gt;urlsMatchItem(item);
</del><ins>+    bool addedExtraFields = false;
+    ResourceRequest request(itemURL);
</ins><span class="cx"> 
</span><del>-#if ENABLE(WML)
-    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
-    if (frameContainsWMLContent(m_frame))
-        shouldScroll = false;
-#endif
</del><ins>+    if (!item-&gt;referrer().isNull())
+        request.setHTTPReferrer(item-&gt;referrer());
+    
+    // If this was a repost that failed the page cache, we might try to repost the form.
+    NavigationAction action;
+    if (formData) {
+        formData-&gt;generateFiles(m_frame-&gt;page()-&gt;chrome()-&gt;client());
</ins><span class="cx"> 
</span><del>-    if (shouldScroll) {
-        // Must do this maintenance here, since we don't go through a real page reload
-        history()-&gt;saveScrollPositionAndViewStateToItem(history()-&gt;currentItem());
</del><ins>+        request.setHTTPMethod(&quot;POST&quot;);
+        request.setHTTPBody(formData);
+        request.setHTTPContentType(item-&gt;formContentType());
+        RefPtr&lt;SecurityOrigin&gt; securityOrigin = SecurityOrigin::createFromString(item-&gt;referrer());
+        addHTTPOriginIfNeeded(request, securityOrigin-&gt;toString());
</ins><span class="cx"> 
</span><del>-        if (FrameView* view = m_frame-&gt;view())
-            view-&gt;setWasScrolledByUser(false);
-
-        history()-&gt;setCurrentItem(item);
-
-        // FIXME: Form state might need to be saved here too.
-
-        // We always call scrollToAnchor here, even if the URL doesn't have an
-        // anchor fragment. This is so we'll keep the WebCore Frame's URL up-to-date.
-        scrollToAnchor(item-&gt;url());
-    
-        // must do this maintenance here, since we don't go through a real page reload
-        history()-&gt;restoreScrollPositionAndViewState();
</del><ins>+        // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
+        // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
+        addedExtraFields = true;
</ins><span class="cx">         
</span><del>-        // Fake the URL change by updating the data source's request.  This will no longer
-        // be necessary if we do the better fix described above.
-        documentLoader()-&gt;replaceRequestURLForAnchorScroll(itemURL);
-
-        m_client-&gt;dispatchDidChangeLocationWithinPage();
</del><ins>+        // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
+        // We want to know this before talking to the policy delegate, since it affects whether 
+        // we show the DoYouReallyWantToRepost nag.
+        //
+        // This trick has a small bug (3123893) where we might find a cache hit, but then
+        // have the item vanish when we try to use it in the ensuing nav.  This should be
+        // extremely rare, but in that case the user will get an error on the navigation.
</ins><span class="cx">         
</span><del>-        // FrameLoaderClient::didFinishLoad() tells the internal load delegate the load finished with no error
-        m_client-&gt;didFinishLoad();
</del><ins>+        if (ResourceHandle::willLoadFromCache(request, m_frame))
+            action = NavigationAction(itemURL, loadType, false);
+        else {
+            request.setCachePolicy(ReloadIgnoringCacheData);
+            action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
+        }
</ins><span class="cx">     } else {
</span><del>-        // Remember this item so we can traverse any child items as child frames load
-        history()-&gt;setProvisionalItem(item);
-
-        bool inPageCache = false;
-        
-        // Check if we'll be using the page cache.  We only use the page cache
-        // if one exists and it is less than _backForwardCacheExpirationInterval
-        // seconds old.  If the cache is expired it gets flushed here.
-        if (RefPtr&lt;CachedPage&gt; cachedPage = pageCache()-&gt;get(item)) {
-            double interval = currentTime() - cachedPage-&gt;timeStamp();
-            
-            // FIXME: 1800 should not be hardcoded, it should come from
-            // WebKitBackForwardCacheExpirationIntervalKey in WebKit.
-            // Or we should remove WebKitBackForwardCacheExpirationIntervalKey.
-            if (interval &lt;= 1800) {
-                loadWithDocumentLoader(cachedPage-&gt;documentLoader(), loadType, 0);   
-                inPageCache = true;
-            } else {
-                LOG(PageCache, &quot;Not restoring page for %s from back/forward cache because cache entry has expired&quot;, history()-&gt;provisionalItem()-&gt;url().string().ascii().data());
-                pageCache()-&gt;remove(item);
-            }
</del><ins>+        switch (loadType) {
+            case FrameLoadTypeReload:
+            case FrameLoadTypeReloadFromOrigin:
+                request.setCachePolicy(ReloadIgnoringCacheData);
+                break;
+            case FrameLoadTypeBack:
+            case FrameLoadTypeBackWMLDeckNotAccessible:
+            case FrameLoadTypeForward:
+            case FrameLoadTypeIndexedBackForward:
+                if (itemURL.protocolIs(&quot;https&quot;))
+                    request.setCachePolicy(ReturnCacheDataElseLoad);
+                break;
+            case FrameLoadTypeStandard:
+            case FrameLoadTypeRedirectWithLockedBackForwardList:
+                break;
+            case FrameLoadTypeSame:
+            default:
+                ASSERT_NOT_REACHED();
</ins><span class="cx">         }
</span><del>-        
-        if (!inPageCache) {
-            bool addedExtraFields = false;
-            ResourceRequest request(itemURL);
</del><span class="cx"> 
</span><del>-            if (!item-&gt;referrer().isNull())
-                request.setHTTPReferrer(item-&gt;referrer());
-            
-            // If this was a repost that failed the page cache, we might try to repost the form.
-            NavigationAction action;
-            if (formData) {
-                
-                formData-&gt;generateFiles(m_frame-&gt;page()-&gt;chrome()-&gt;client());
</del><ins>+        action = NavigationAction(itemOriginalURL, loadType, false);
+    }
+    
+    if (!addedExtraFields)
+        addExtraFieldsToRequest(request, m_loadType, true, formData);
</ins><span class="cx"> 
</span><del>-                request.setHTTPMethod(&quot;POST&quot;);
-                request.setHTTPBody(formData);
-                request.setHTTPContentType(item-&gt;formContentType());
-                RefPtr&lt;SecurityOrigin&gt; securityOrigin = SecurityOrigin::createFromString(item-&gt;referrer());
-                addHTTPOriginIfNeeded(request, securityOrigin-&gt;toString());
-        
-                // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
-                // See https://bugs.webkit.org/show_bug.cgi?id=22194 for more discussion.
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
-                addedExtraFields = true;
-                
-                // FIXME: Slight hack to test if the NSURL cache contains the page we're going to.
-                // We want to know this before talking to the policy delegate, since it affects whether 
-                // we show the DoYouReallyWantToRepost nag.
-                //
-                // This trick has a small bug (3123893) where we might find a cache hit, but then
-                // have the item vanish when we try to use it in the ensuing nav.  This should be
-                // extremely rare, but in that case the user will get an error on the navigation.
-                
-                if (ResourceHandle::willLoadFromCache(request, m_frame))
-                    action = NavigationAction(itemURL, loadType, false);
-                else {
-                    request.setCachePolicy(ReloadIgnoringCacheData);
-                    action = NavigationAction(itemURL, NavigationTypeFormResubmitted);
-                }
-            } else {
-                switch (loadType) {
-                    case FrameLoadTypeReload:
-                    case FrameLoadTypeReloadFromOrigin:
-                        request.setCachePolicy(ReloadIgnoringCacheData);
-                        break;
-                    case FrameLoadTypeBack:
-                    case FrameLoadTypeBackWMLDeckNotAccessible:
-                    case FrameLoadTypeForward:
-                    case FrameLoadTypeIndexedBackForward:
-                        if (itemURL.protocol() != &quot;https&quot;)
-                            request.setCachePolicy(ReturnCacheDataElseLoad);
-                        break;
-                    case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedBackForwardList:
-                        break;
-                    case FrameLoadTypeSame:
-                    default:
-                        ASSERT_NOT_REACHED();
-                }
</del><ins>+    loadWithNavigationAction(request, action, false, loadType, 0);
+}
</ins><span class="cx"> 
</span><del>-                action = NavigationAction(itemOriginalURL, loadType, false);
-            }
-            
-            if (!addedExtraFields)
-                addExtraFieldsToRequest(request, m_loadType, true, formData);
</del><ins>+// Loads content into this frame, as specified by history item
+void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
+{
+    // We do same-document navigation in the following cases:
+    // - The HistoryItem has a history state object
+    // - Navigating to an anchor within the page, with no form data stored on the target item or the current history entry,
+    //   and the URLs in the frame tree match the history item for fragment scrolling.
+    bool sameDocumentNavigation = (!item-&gt;formData() &amp;&amp; !(history()-&gt;currentItem() &amp;&amp; history()-&gt;currentItem()-&gt;formData()) &amp;&amp; history()-&gt;urlsMatchItem(item)) || item-&gt;document() == m_frame-&gt;document();
</ins><span class="cx"> 
</span><del>-            loadWithNavigationAction(request, action, false, loadType, 0);
-        }
-    }
</del><ins>+#if ENABLE(WML)
+    // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
+    // FIXME: Why do WML decks have this different behavior?
+    // Are WML decks incompatible with HTML5 pushState/replaceState which require inter-document history navigations?
+    // Should this new API be disabled for WML pages, or does WML need to update their mechanism to act like normal loads?
+    // If scroll-to-anchor navigations were broken for WML and required them to have different loading behavior, then  
+    // state object loads are certainly also broken for them.
+    if (frameContainsWMLContent(m_frame))
+        sameDocumentNavigation = false;
+#endif
+
+    if (sameDocumentNavigation)
+        navigateWithinDocument(item);
+    else
+        navigateToDifferentDocument(item, loadType);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError&amp; error)
</span></span></pre></div>
<a id="trunkWebCoreloaderFrameLoaderh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/FrameLoader.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/FrameLoader.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/FrameLoader.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -73,6 +73,7 @@
</span><span class="cx"> class ScriptString;
</span><span class="cx"> class ScriptValue;
</span><span class="cx"> class SecurityOrigin;
</span><ins>+class SerializedScriptValue;
</ins><span class="cx"> class SharedBuffer;
</span><span class="cx"> class SubstituteData;
</span><span class="cx"> class TextResourceDecoder;
</span><span class="lines">@@ -350,6 +351,9 @@
</span><span class="cx">     bool loadPlugin(RenderPart*, const KURL&amp;, const String&amp; mimeType,
</span><span class="cx">     const Vector&lt;String&gt;&amp; paramNames, const Vector&lt;String&gt;&amp; paramValues, bool useFallback);
</span><span class="cx">     
</span><ins>+    void navigateWithinDocument(HistoryItem*);
+    void navigateToDifferentDocument(HistoryItem*, FrameLoadType);
+    
</ins><span class="cx">     bool loadProvisionalItemFromCachedPage();
</span><span class="cx">     void cachePageForHistoryItem(HistoryItem*);
</span><span class="cx">     void pageHidden();
</span><span class="lines">@@ -424,7 +428,7 @@
</span><span class="cx"> 
</span><span class="cx">     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&amp;, const String&amp; name, const String&amp; referrer);
</span><span class="cx"> 
</span><del>-    void scrollToAnchor(const KURL&amp;);
</del><ins>+    void loadInSameDocument(const KURL&amp;, SerializedScriptValue* stateObject, bool isNewNavigation);
</ins><span class="cx"> 
</span><span class="cx">     void provisionalLoadStarted();
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCoreloaderFrameLoaderClienth"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/FrameLoaderClient.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/FrameLoaderClient.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/FrameLoaderClient.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -117,6 +117,9 @@
</span><span class="cx">         virtual void dispatchDidCancelClientRedirect() = 0;
</span><span class="cx">         virtual void dispatchWillPerformClientRedirect(const KURL&amp;, double interval, double fireDate) = 0;
</span><span class="cx">         virtual void dispatchDidChangeLocationWithinPage() = 0;
</span><ins>+        virtual void dispatchDidPushStateWithinPage() = 0;
+        virtual void dispatchDidReplaceStateWithinPage() = 0;
+        virtual void dispatchDidPopStateWithinPage() = 0;
</ins><span class="cx">         virtual void dispatchWillClose() = 0;
</span><span class="cx">         virtual void dispatchDidReceiveIcon() = 0;
</span><span class="cx">         virtual void dispatchDidStartProvisionalLoad() = 0;
</span></span></pre></div>
<a id="trunkWebCoreloaderHistoryControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/HistoryController.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/HistoryController.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/HistoryController.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -402,7 +402,7 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void HistoryController::updateForAnchorScroll()
</del><ins>+void HistoryController::updateForSameDocumentNavigation()
</ins><span class="cx"> {
</span><span class="cx">     if (m_frame-&gt;loader()-&gt;url().isEmpty())
</span><span class="cx">         return;
</span><span class="lines">@@ -624,4 +624,41 @@
</span><span class="cx">     page-&gt;backForwardList()-&gt;addItem(item);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void HistoryController::pushState(PassRefPtr&lt;SerializedScriptValue&gt; stateObject, const String&amp; title, const String&amp; urlString)
+{
+    Page* page = m_frame-&gt;page();
+    ASSERT(page);
+    Frame* mainFrame = page-&gt;mainFrame();
+    ASSERT(mainFrame);
+
+    // Get a HistoryItem tree for the current frame tree.
+    RefPtr&lt;HistoryItem&gt; item = createItemTree(m_frame, false);
+    
+    // Override data in the target item to reflect the pushState() arguments.
+    HistoryItem* targetItem = item-&gt;targetItem();
+    ASSERT(targetItem-&gt;isTargetItem());
+    targetItem-&gt;setDocument(m_frame-&gt;document());
+    targetItem-&gt;setTitle(title);
+    targetItem-&gt;setStateObject(stateObject);
+    targetItem-&gt;setURLString(urlString);
+    
+    page-&gt;backForwardList()-&gt;pushStateItem(item.release());
+}
+
+void HistoryController::replaceState(PassRefPtr&lt;SerializedScriptValue&gt; stateObject, const String&amp; title, const String&amp; urlString)
+{
+    Page* page = m_frame-&gt;page();
+    ASSERT(page);
+    HistoryItem* current = page-&gt;backForwardList()-&gt;currentItem();
+    ASSERT(current);
+    
+    ASSERT(!current-&gt;document() || current-&gt;document() == m_frame-&gt;document());
+    current-&gt;setDocument(m_frame-&gt;document());
+    
+    if (!urlString.isEmpty())
+        current-&gt;setURLString(urlString);
+    current-&gt;setTitle(title);
+    current-&gt;setStateObject(stateObject);
+}
+
</ins><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkWebCoreloaderHistoryControllerh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/loader/HistoryController.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/loader/HistoryController.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/loader/HistoryController.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -39,6 +39,7 @@
</span><span class="cx"> 
</span><span class="cx"> class Frame;
</span><span class="cx"> class HistoryItem;
</span><ins>+class SerializedScriptValue;
</ins><span class="cx"> 
</span><span class="cx"> class HistoryController : public Noncopyable {
</span><span class="cx"> public:
</span><span class="lines">@@ -65,7 +66,7 @@
</span><span class="cx">     void updateForRedirectWithLockedBackForwardList();
</span><span class="cx">     void updateForClientRedirect();
</span><span class="cx">     void updateForCommit();
</span><del>-    void updateForAnchorScroll();
</del><ins>+    void updateForSameDocumentNavigation();
</ins><span class="cx">     void updateForFrameLoadCompleted();
</span><span class="cx"> 
</span><span class="cx">     HistoryItem* currentItem() const { return m_currentItem.get(); }
</span><span class="lines">@@ -75,6 +76,9 @@
</span><span class="cx">     HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
</span><span class="cx">     void setProvisionalItem(HistoryItem*);
</span><span class="cx"> 
</span><ins>+    void pushState(PassRefPtr&lt;SerializedScriptValue&gt;, const String&amp; title, const String&amp; url);
+    void replaceState(PassRefPtr&lt;SerializedScriptValue&gt;, const String&amp; title, const String&amp; url);
+
</ins><span class="cx"> private:
</span><span class="cx">     PassRefPtr&lt;HistoryItem&gt; createItem(bool useOriginal);
</span><span class="cx">     PassRefPtr&lt;HistoryItem&gt; createItemTree(Frame* targetFrame, bool clipAtTarget);
</span></span></pre></div>
<a id="trunkWebCorepageDOMWindowh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/DOMWindow.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/DOMWindow.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/DOMWindow.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -248,9 +248,13 @@
</span><span class="cx">         void dispatchLoadEvent();
</span><span class="cx"> 
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
</span><span class="lines">@@ -259,13 +263,22 @@
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
</span><span class="lines">@@ -276,41 +289,30 @@
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(popstate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
</span><ins>+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
</ins><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
</span><del>-        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
</del><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
</span><del>-        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
</del><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitbeginfullscreen);
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitendfullscreen);
</span><del>-        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
-        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
</del><ins>+
</ins><span class="cx"> #if ENABLE(ORIENTATION_EVENTS)
</span><span class="cx">         DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkWebCorepageDOMWindowidl"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/DOMWindow.idl (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/DOMWindow.idl        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/DOMWindow.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -252,6 +252,7 @@
</span><span class="cx">         attribute EventListener onpause;
</span><span class="cx">         attribute EventListener onplay;
</span><span class="cx">         attribute EventListener onplaying;
</span><ins>+        attribute EventListener onpopstate;
</ins><span class="cx">         attribute EventListener onprogress;
</span><span class="cx">         attribute EventListener onratechange;
</span><span class="cx">         attribute EventListener onresize;
</span></span></pre></div>
<a id="trunkWebCorepageHistorycpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/History.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/History.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/History.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -26,8 +26,11 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;History.h&quot;
</span><span class="cx"> 
</span><ins>+#include &quot;ExceptionCode.h&quot;
</ins><span class="cx"> #include &quot;Frame.h&quot;
</span><span class="cx"> #include &quot;FrameLoader.h&quot;
</span><ins>+#include &quot;FrameLoaderClient.h&quot;
+#include &quot;HistoryItem.h&quot;
</ins><span class="cx"> #include &quot;Page.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="lines">@@ -77,4 +80,46 @@
</span><span class="cx">     m_frame-&gt;redirectScheduler()-&gt;scheduleHistoryNavigation(distance);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+KURL History::urlForState(const String&amp; urlString)
+{
+    KURL baseURL = m_frame-&gt;loader()-&gt;baseURL();
+    if (urlString.isEmpty())
+        return baseURL;
+        
+    KURL absoluteURL(baseURL, urlString);
+    if (!absoluteURL.isValid())
+        return KURL();
+    
+    if (absoluteURL.string().left(absoluteURL.pathStart()) != baseURL.string().left(baseURL.pathStart()))
+        return KURL();
+    
+    return absoluteURL;
+}
+
+void History::stateObjectAdded(PassRefPtr&lt;SerializedScriptValue&gt; data, const String&amp; title, const String&amp; urlString, StateObjectType stateObjectType, ExceptionCode&amp; ec)
+{
+    if (!m_frame)
+        return;
+    ASSERT(m_frame-&gt;page());
+    
+    KURL fullURL = urlForState(urlString);
+    if (!fullURL.isValid()) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    if (stateObjectType == StateObjectPush)
+        m_frame-&gt;loader()-&gt;history()-&gt;pushState(data, title, fullURL.string());
+    else if (stateObjectType == StateObjectReplace)
+        m_frame-&gt;loader()-&gt;history()-&gt;replaceState(data, title, fullURL.string());
+            
+    if (!urlString.isEmpty()) {
+        m_frame-&gt;document()-&gt;updateURLForPushOrReplaceState(fullURL);
+        if (stateObjectType == StateObjectPush)
+            m_frame-&gt;loader()-&gt;client()-&gt;dispatchDidPushStateWithinPage();
+        else if (stateObjectType == StateObjectReplace)
+            m_frame-&gt;loader()-&gt;client()-&gt;dispatchDidReplaceStateWithinPage();
+    }
+}
+
</ins><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkWebCorepageHistoryh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/History.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/History.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/History.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -26,31 +26,43 @@
</span><span class="cx"> #ifndef History_h
</span><span class="cx"> #define History_h
</span><span class="cx"> 
</span><ins>+#include &quot;KURL.h&quot;
</ins><span class="cx"> #include &lt;wtf/PassRefPtr.h&gt;
</span><span class="cx"> #include &lt;wtf/RefCounted.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-    class Frame;
</del><ins>+class Frame;
+class SerializedScriptValue;
+class String;
+typedef int ExceptionCode;
</ins><span class="cx"> 
</span><del>-    class History : public RefCounted&lt;History&gt; {
-    public:
-        static PassRefPtr&lt;History&gt; create(Frame* frame) { return adoptRef(new History(frame)); }
-        
-        Frame* frame() const;
-        void disconnectFrame();
</del><ins>+class History : public RefCounted&lt;History&gt; {
+public:
+    static PassRefPtr&lt;History&gt; create(Frame* frame) { return adoptRef(new History(frame)); }
+    
+    Frame* frame() const;
+    void disconnectFrame();
</ins><span class="cx"> 
</span><del>-        unsigned length() const;
-        void back();
-        void forward();
-        void go(int distance);
</del><ins>+    unsigned length() const;
+    void back();
+    void forward();
+    void go(int distance);
</ins><span class="cx"> 
</span><del>-    private:
-        History(Frame*);
-
-        Frame* m_frame;
</del><ins>+    enum StateObjectType {
+        StateObjectPush,
+        StateObjectReplace
</ins><span class="cx">     };
</span><ins>+    void stateObjectAdded(PassRefPtr&lt;SerializedScriptValue&gt;, const String&amp; title, const String&amp; url, StateObjectType, ExceptionCode&amp;);
</ins><span class="cx"> 
</span><ins>+private:
+    History(Frame*);
+
+    KURL urlForState(const String&amp; url);
+
+    Frame* m_frame;
+};
+
</ins><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><span class="cx"> #endif // History_h
</span></span></pre></div>
<a id="trunkWebCorepageHistoryidl"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/History.idl (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/History.idl        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/History.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -39,6 +39,11 @@
</span><span class="cx">         [DoNotCheckDomainSecurity] void back();
</span><span class="cx">         [DoNotCheckDomainSecurity] void forward();
</span><span class="cx">         [DoNotCheckDomainSecurity] void go(in long distance);
</span><ins>+        
+        [Custom] void pushState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
+        [Custom] void replaceState(in any data, in DOMString title, in optional DOMString url)
+            raises(DOMException);
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkWebCorepagePagecpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/page/Page.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/page/Page.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebCore/page/Page.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -21,6 +21,7 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;Page.h&quot;
</span><span class="cx"> 
</span><ins>+#include &quot;BackForwardList.h&quot;
</ins><span class="cx"> #include &quot;Base64.h&quot;
</span><span class="cx"> #include &quot;CSSStyleSelector.h&quot;
</span><span class="cx"> #include &quot;Chrome.h&quot;
</span><span class="lines">@@ -277,20 +278,30 @@
</span><span class="cx"> 
</span><span class="cx"> void Page::goToItem(HistoryItem* item, FrameLoadType type)
</span><span class="cx"> {
</span><del>-    // Abort any current load if we're going to a history item
</del><ins>+#if !ASSERT_DISABLED
+    // If we're navigating to an item with history state for a Document other than the
+    // current Document, the new Document had better be in the page cache.
+    if (item-&gt;stateObject() &amp;&amp; item-&gt;document() != m_mainFrame-&gt;document())
+        ASSERT(item-&gt;document()-&gt;inPageCache());
+#endif
</ins><span class="cx"> 
</span><del>-    // Define what to do with any open database connections. By default we stop them and terminate the database thread.
-    DatabasePolicy databasePolicy = DatabasePolicyStop;
</del><ins>+    // Abort any current load unless we're navigating the current document to a new state object
+    if (!item-&gt;stateObject() || item-&gt;document() != m_mainFrame-&gt;document()) {
+        // Define what to do with any open database connections. By default we stop them and terminate the database thread.
+        DatabasePolicy databasePolicy = DatabasePolicyStop;
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(DATABASE)
</span><del>-    // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-    const KURL&amp; currentURL = m_mainFrame-&gt;loader()-&gt;url();
-    const KURL&amp; newURL = item-&gt;url();
</del><ins>+        // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
+        const KURL&amp; currentURL = m_mainFrame-&gt;loader()-&gt;url();
+        const KURL&amp; newURL = item-&gt;url();
+    
+        if (newURL.hasFragmentIdentifier() &amp;&amp; equalIgnoringFragmentIdentifier(currentURL, newURL))
+            databasePolicy = DatabasePolicyContinue;
+#endif
</ins><span class="cx"> 
</span><del>-    if (newURL.hasFragmentIdentifier() &amp;&amp; equalIgnoringFragmentIdentifier(currentURL, newURL))
-        databasePolicy = DatabasePolicyContinue;
-#endif
-    m_mainFrame-&gt;loader()-&gt;stopAllLoaders(databasePolicy);
</del><ins>+        m_mainFrame-&gt;loader()-&gt;stopAllLoaders(databasePolicy);
+    }
+        
</ins><span class="cx">     m_mainFrame-&gt;loader()-&gt;history()-&gt;goToItem(item, type);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebKitchromiumChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/chromium/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/chromium/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/chromium/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::dispatchDidPushStateWithinPage):
+        (WebKit::FrameLoaderClientImpl::dispatchDidReplaceStateWithinPage):
+        (WebKit::FrameLoaderClientImpl::dispatchDidPopStateWithinPage):
+        * src/FrameLoaderClientImpl.h:
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@chromium.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitchromiumsrcFrameLoaderClientImplcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/chromium/src/FrameLoaderClientImpl.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/chromium/src/FrameLoaderClientImpl.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/chromium/src/FrameLoaderClientImpl.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -599,6 +599,21 @@
</span><span class="cx">         webView-&gt;client()-&gt;didStopLoading();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void FrameLoaderClientImpl::dispatchDidPushStateWithinPage()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidReplaceStateWithinPage()
+{
+    // FIXME
+}
+
+void FrameLoaderClientImpl::dispatchDidPopStateWithinPage()
+{
+    // FIXME
+}
+
</ins><span class="cx"> void FrameLoaderClientImpl::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     if (m_webFrame-&gt;client())
</span></span></pre></div>
<a id="trunkWebKitchromiumsrcFrameLoaderClientImplh"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/chromium/src/FrameLoaderClientImpl.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/chromium/src/FrameLoaderClientImpl.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/chromium/src/FrameLoaderClientImpl.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -95,6 +95,9 @@
</span><span class="cx">     virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">     virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&amp;, double interval, double fireDate);
</span><span class="cx">     virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
</ins><span class="cx">     virtual void dispatchWillClose();
</span><span class="cx">     virtual void dispatchDidReceiveIcon();
</span><span class="cx">     virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitgtkChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/gtk/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/gtk/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/gtk/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebKit::FrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebKit::FrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientGtk.h:
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@dhcp-172-28-174-220.spb.corp.google.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitgtkWebCoreSupportFrameLoaderClientGtkcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -669,6 +669,21 @@
</span><span class="cx">         g_object_notify(G_OBJECT(webView), &quot;uri&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void FrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    notImplemented();
+}
+
</ins><span class="cx"> void FrameLoaderClient::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     notImplemented();
</span></span></pre></div>
<a id="trunkWebKitgtkWebCoreSupportFrameLoaderClientGtkh"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -76,6 +76,9 @@
</span><span class="cx">         virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">         virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&amp;, double, double);
</span><span class="cx">         virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
</ins><span class="cx">         virtual void dispatchWillClose();
</span><span class="cx">         virtual void dispatchDidReceiveIcon();
</span><span class="cx">         virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebFrameLoadDelegatePrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _cacheFrameLoadDelegateImplementations]):
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@dhcp-172-28-174-220.spb.corp.google.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitmacWebCoreSupportWebFrameLoaderClienth"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -91,6 +91,10 @@
</span><span class="cx">     virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">     virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&amp;, double interval, double fireDate);
</span><span class="cx">     virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
+    
</ins><span class="cx">     virtual void dispatchWillClose();
</span><span class="cx">     virtual void dispatchDidReceiveIcon();
</span><span class="cx">     virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitmacWebCoreSupportWebFrameLoaderClientmm"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -538,6 +538,30 @@
</span><span class="cx">         CallFrameLoadDelegate(implementations-&gt;didChangeLocationWithinPageForFrameFunc, webView, @selector(webView:didChangeLocationWithinPageForFrame:), m_webFrame.get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void WebFrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations-&gt;didPushStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations-&gt;didPushStateWithinPageForFrameFunc, webView, @selector(webView:didPushStateWithinPageForFrame:), m_webFrame.get());
+}
+
+void WebFrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations-&gt;didReplaceStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations-&gt;didReplaceStateWithinPageForFrameFunc, webView, @selector(webView:didReplaceStateWithinPageForFrame:), m_webFrame.get());
+}
+
+void WebFrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    WebView *webView = getWebView(m_webFrame.get());
+    WebFrameLoadDelegateImplementationCache* implementations = WebViewGetFrameLoadDelegateImplementations(webView);
+    if (implementations-&gt;didPopStateWithinPageForFrameFunc)
+        CallFrameLoadDelegate(implementations-&gt;didPopStateWithinPageForFrameFunc, webView, @selector(webView:didPopStateWithinPageForFrame:), m_webFrame.get());
+}
+
</ins><span class="cx"> void WebFrameLoaderClient::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     WebView *webView = getWebView(m_webFrame.get());   
</span></span></pre></div>
<a id="trunkWebKitmacWebViewWebDelegateImplementationCachingh"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/WebView/WebDelegateImplementationCaching.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/WebView/WebDelegateImplementationCaching.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/WebView/WebDelegateImplementationCaching.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -57,6 +57,9 @@
</span><span class="cx">     IMP didCancelClientRedirectForFrameFunc;
</span><span class="cx">     IMP willPerformClientRedirectToURLDelayFireDateForFrameFunc;
</span><span class="cx">     IMP didChangeLocationWithinPageForFrameFunc;
</span><ins>+    IMP didPushStateWithinPageForFrameFunc;
+    IMP didReplaceStateWithinPageForFrameFunc;
+    IMP didPopStateWithinPageForFrameFunc;
</ins><span class="cx">     IMP willCloseFrameFunc;
</span><span class="cx">     IMP didStartProvisionalLoadForFrameFunc;
</span><span class="cx">     IMP didReceiveTitleForFrameFunc;
</span></span></pre></div>
<a id="trunkWebKitmacWebViewWebFrameLoadDelegatePrivateh"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/WebView/WebFrameLoadDelegatePrivate.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -39,4 +39,8 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)webView:(WebView *)webView didClearWindowObjectForFrame:(WebFrame *)frame inScriptWorld:(WebScriptWorld *)world;
</span><span class="cx"> 
</span><ins>+- (void)webView:(WebView *)webView didPushStateWithinPageForFrame:(WebFrame *)frame;
+- (void)webView:(WebView *)webView didReplaceStateWithinPageForFrame:(WebFrame *)frame;
+- (void)webView:(WebView *)webView didPopStateWithinPageForFrame:(WebFrame *)frame;
+
</ins><span class="cx"> @end
</span></span></pre></div>
<a id="trunkWebKitmacWebViewWebViewmm"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/mac/WebView/WebView.mm (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/mac/WebView/WebView.mm        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/mac/WebView/WebView.mm        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1353,6 +1353,9 @@
</span><span class="cx"> 
</span><span class="cx">     cache-&gt;didCancelClientRedirectForFrameFunc = getMethod(delegate, @selector(webView:didCancelClientRedirectForFrame:));
</span><span class="cx">     cache-&gt;didChangeLocationWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didChangeLocationWithinPageForFrame:));
</span><ins>+    cache-&gt;didPushStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didPushStateWithinPageForFrame:));
+    cache-&gt;didReplaceStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didReplaceStateWithinPageForFrame:));
+    cache-&gt;didPopStateWithinPageForFrameFunc = getMethod(delegate, @selector(webView:didPopStateWithinPageForFrame:));
</ins><span class="cx">     cache-&gt;didClearWindowObjectForFrameFunc = getMethod(delegate, @selector(webView:didClearWindowObject:forFrame:));
</span><span class="cx">     cache-&gt;didClearWindowObjectForFrameInScriptWorldFunc = getMethod(delegate, @selector(webView:didClearWindowObjectForFrame:inScriptWorld:));
</span><span class="cx">     cache-&gt;didClearInspectorWindowObjectForFrameFunc = getMethod(delegate, @selector(webView:didClearInspectorWindowObject:forFrame:));
</span></span></pre></div>
<a id="trunkWebKitqtChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/qt/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/qt/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/qt/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@dhcp-172-28-174-220.spb.corp.google.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitqtWebCoreSupportFrameLoaderClientQtcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -304,7 +304,30 @@
</span><span class="cx">     m_webFrame-&gt;page()-&gt;d-&gt;updateNavigationActions();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf(&quot;%s - dispatchDidPushStateWithinPage\n&quot;, qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
</ins><span class="cx"> 
</span><ins>+void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf(&quot;%s - dispatchDidReplaceStateWithinPage\n&quot;, qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
+void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
+{
+    if (dumpFrameLoaderCallbacks)
+        printf(&quot;%s - dispatchDidPopStateWithinPage\n&quot;, qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
+        
+    notImplemented();
+}
+
</ins><span class="cx"> void FrameLoaderClientQt::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     if (dumpFrameLoaderCallbacks)
</span></span></pre></div>
<a id="trunkWebKitqtWebCoreSupportFrameLoaderClientQth"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -103,6 +103,9 @@
</span><span class="cx">         virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">         virtual void dispatchWillPerformClientRedirect(const KURL&amp;, double interval, double fireDate);
</span><span class="cx">         virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
</ins><span class="cx">         virtual void dispatchWillClose();
</span><span class="cx">         virtual void dispatchDidReceiveIcon();
</span><span class="cx">         virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitwinChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/win/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/win/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/win/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * Interfaces/IWebFrameLoadDelegatePrivate2.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidPushStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidReplaceStateWithinPage):
+        (WebFrameLoaderClient::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@dhcp-172-28-174-220.spb.corp.google.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitwinInterfacesIWebFrameLoadDelegatePrivate2idl"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/win/Interfaces/IWebFrameLoadDelegatePrivate2.idl        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -48,4 +48,8 @@
</span><span class="cx">     HRESULT didRunInsecureContent([in] IWebView* sender, [in] IWebSecurityOrigin* origin);
</span><span class="cx"> 
</span><span class="cx">     HRESULT didClearWindowObjectForFrameInScriptWorld([in] IWebView* webView, [in] IWebFrame* frame, [in] IWebScriptWorld*);
</span><ins>+
+    HRESULT didPushStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
+    HRESULT didReplaceStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
+    HRESULT didPopStateWithinPageForFrame([in] IWebView* webView, [in] IWebFrame* frame);
</ins><span class="cx"> }
</span></span></pre></div>
<a id="trunkWebKitwinWebCoreSupportWebFrameLoaderClientcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -306,6 +306,47 @@
</span><span class="cx">         frameLoadDelegate-&gt;didChangeLocationWithinPageForFrame(webView, m_webFrame);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void WebFrameLoaderClient::dispatchDidPushStateWithinPage()
+{
+    WebView* webView = m_webFrame-&gt;webView();
+    COMPtr&lt;IWebFrameLoadDelegatePrivate&gt; frameLoadDelegatePriv;
+    if (FAILED(webView-&gt;frameLoadDelegatePrivate(&amp;frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr&lt;IWebFrameLoadDelegatePrivate2&gt; frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2-&gt;didPushStateWithinPageForFrame(webView, m_webFrame);
+}
+
+void WebFrameLoaderClient::dispatchDidReplaceStateWithinPage()
+{
+    WebView* webView = m_webFrame-&gt;webView();
+    COMPtr&lt;IWebFrameLoadDelegatePrivate&gt; frameLoadDelegatePriv;
+    if (FAILED(webView-&gt;frameLoadDelegatePrivate(&amp;frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr&lt;IWebFrameLoadDelegatePrivate2&gt; frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2-&gt;didReplaceStateWithinPageForFrame(webView, m_webFrame);
+}
+
+void WebFrameLoaderClient::dispatchDidPopStateWithinPage()
+{
+    WebView* webView = m_webFrame-&gt;webView();
+    COMPtr&lt;IWebFrameLoadDelegatePrivate&gt; frameLoadDelegatePriv;
+    if (FAILED(webView-&gt;frameLoadDelegatePrivate(&amp;frameLoadDelegatePriv)) || !frameLoadDelegatePriv)
+        return;
+
+    COMPtr&lt;IWebFrameLoadDelegatePrivate2&gt; frameLoadDelegatePriv2(Query, frameLoadDelegatePriv);
+    if (!frameLoadDelegatePriv2)
+        return;
+
+    frameLoadDelegatePriv2-&gt;didPopStateWithinPageForFrame(webView, m_webFrame);
+}
</ins><span class="cx"> void WebFrameLoaderClient::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     WebView* webView = m_webFrame-&gt;webView();
</span></span></pre></div>
<a id="trunkWebKitwinWebCoreSupportWebFrameLoaderClienth"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -65,6 +65,9 @@
</span><span class="cx">     virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">     virtual void dispatchWillPerformClientRedirect(const WebCore::KURL&amp;, double interval, double fireDate);
</span><span class="cx">     virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+    virtual void dispatchDidPushStateWithinPage();
+    virtual void dispatchDidReplaceStateWithinPage();
+    virtual void dispatchDidPopStateWithinPage();
</ins><span class="cx">     virtual void dispatchWillClose();
</span><span class="cx">     virtual void dispatchDidReceiveIcon();
</span><span class="cx">     virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitwxChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/wx/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/wx/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/wx/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientWx::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientWx::dispatchDidPopStateWithinPage):
+        * WebKitSupport/FrameLoaderClientWx.h:
+
</ins><span class="cx"> 2009-12-03  Pavel Feldman  &lt;pfeldman@dhcp-172-28-174-220.spb.corp.google.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Timothy Hatcher.
</span></span></pre></div>
<a id="trunkWebKitwxWebKitSupportFrameLoaderClientWxcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -262,7 +262,21 @@
</span><span class="cx">     notImplemented();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void FrameLoaderClientWx::dispatchDidPushStateWithinPage()
+{
+    notImplemented();
+}
</ins><span class="cx"> 
</span><ins>+void FrameLoaderClientWx::dispatchDidReplaceStateWithinPage()
+{
+    notImplemented();
+}
+
+void FrameLoaderClientWx::dispatchDidPopStateWithinPage()
+{
+    notImplemented();
+}
+
</ins><span class="cx"> void FrameLoaderClientWx::dispatchWillClose()
</span><span class="cx"> {
</span><span class="cx">     notImplemented();
</span></span></pre></div>
<a id="trunkWebKitwxWebKitSupportFrameLoaderClientWxh"></a>
<div class="modfile"><h4>Modified: trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKit/wx/WebKitSupport/FrameLoaderClientWx.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -96,6 +96,9 @@
</span><span class="cx">         virtual void dispatchDidCancelClientRedirect();
</span><span class="cx">         virtual void dispatchWillPerformClientRedirect(const KURL&amp;, double interval, double fireDate);
</span><span class="cx">         virtual void dispatchDidChangeLocationWithinPage();
</span><ins>+        virtual void dispatchDidPushStateWithinPage();
+        virtual void dispatchDidReplaceStateWithinPage();
+        virtual void dispatchDidPopStateWithinPage();
</ins><span class="cx">         virtual void dispatchWillClose();
</span><span class="cx">         virtual void dispatchDidReceiveIcon();
</span><span class="cx">         virtual void dispatchDidStartProvisionalLoad();
</span></span></pre></div>
<a id="trunkWebKitToolsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebKitTools/ChangeLog (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKitTools/ChangeLog        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKitTools/ChangeLog        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2009-12-03  Brady Eidson  &lt;beidson@apple.com&gt;
+
+        Reviewed by Sam Weinig.
+
+        &lt;rdar://problem/7214236&gt; and http://webkit.org/b/32052 - Implement HTML5 state object history API
+
+        Keep DRT-win building...
+
+        * DumpRenderTree/win/FrameLoadDelegate.h:
+        (FrameLoadDelegate::didPushStateWithinPageForFrame):
+        (FrameLoadDelegate::didReplaceStateWithinPageForFrame):
+        (FrameLoadDelegate::didPopStateWithinPageForFrame):
+
</ins><span class="cx"> 2009-12-03  Andras Becsi  &lt;abecsi@inf.u-szeged.hu&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed build fix.
</span></span></pre></div>
<a id="trunkWebKitToolsDumpRenderTreewinFrameLoadDelegateh"></a>
<div class="modfile"><h4>Modified: trunk/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h (51643 => 51644)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h        2009-12-03 18:53:45 UTC (rev 51643)
+++ trunk/WebKitTools/DumpRenderTree/win/FrameLoadDelegate.h        2009-12-03 19:04:40 UTC (rev 51644)
</span><span class="lines">@@ -143,6 +143,18 @@
</span><span class="cx"> 
</span><span class="cx">     virtual HRESULT STDMETHODCALLTYPE didClearWindowObjectForFrameInScriptWorld(IWebView*, IWebFrame*, IWebScriptWorld*);
</span><span class="cx"> 
</span><ins>+    virtual HRESULT STDMETHODCALLTYPE didPushStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+    
+    virtual HRESULT STDMETHODCALLTYPE didReplaceStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+
+    virtual HRESULT STDMETHODCALLTYPE didPopStateWithinPageForFrame( 
+        /* [in] */ IWebView *sender,
+        /* [in] */ IWebFrame *frame) { return E_NOTIMPL; } 
+
</ins><span class="cx"> private:
</span><span class="cx">     void didClearWindowObjectForFrameInIsolatedWorld(IWebFrame*, IWebScriptWorld*);
</span><span class="cx">     void didClearWindowObjectForFrameInStandardWorld(IWebFrame*);
</span></span></pre>
</div>
</div>

</body>
</html>