--- a/webengine/osswebengine/WebCore/html/HTMLTokenizer.cpp	Fri Jul 03 15:54:40 2009 +0100
+++ b/webengine/osswebengine/WebCore/html/HTMLTokenizer.cpp	Thu Aug 27 07:44:59 2009 +0300
@@ -1597,6 +1597,9 @@
     inWrite = wasInWrite;
 
     m_state = state;
+    // Flush remaining text if doing a document.write.
+    if (!appendData && buffer && !m_state.hasTagState())
+        processToken();
 
     if (noMoreData && !inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive()) {
         end(); // this actually causes us to be deleted